Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1637461
MD5:	b7d4565a9d634456b769b497ab240125
SHA1:	895b664866ac5fb4e6b602f1525982e69f30c9e2
SHA256:	8076fa4a81dc3069adfc7c9f902e6bded83edfc4131714d17f2528267789bc19
Tags:	exeuser-jstrosch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6688 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B7D4565A9D634456B769B497AB240125)

file.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B7D4565A9D634456B769B497AB240125)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["citydisco.bet/gdJIS", "crosshairc.life/dAnjhw", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.951169747.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6784	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49699	104.21.64.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49708	104.21.32.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49684	188.114.96.3	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49717	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49702	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49690	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49693	188.114.97.3	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49714	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49720	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49687	104.21.48.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49705	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	3	Unknown Traffic	192.168.2.8	49696	188.114.97.3	443	TCP
2025-03-13T16:50:45.797007+0100	2028371	3	Unknown Traffic	192.168.2.8	49682	188.114.96.3	443	TCP
2025-03-13T16:50:48.889982+0100	2028371	3	Unknown Traffic	192.168.2.8	49683	188.114.96.3	443	TCP
2025-03-13T16:50:57.063905+0100	2028371	3	Unknown Traffic	192.168.2.8	49723	23.197.127.21	443	TCP
2025-03-13T16:51:00.531465+0100	2028371	3	Unknown Traffic	192.168.2.8	49724	188.114.96.3	443	TCP
2025-03-13T16:51:03.758619+0100	2028371	3	Unknown Traffic	192.168.2.8	49727	23.197.127.21	443	TCP
2025-03-13T16:51:06.715043+0100	2028371	3	Unknown Traffic	192.168.2.8	49731	23.197.127.21	443	TCP
2025-03-13T16:51:08.145988+0100	2028371	3	Unknown Traffic	192.168.2.8	49732	23.197.127.21	443	TCP
2025-03-13T16:51:09.644822+0100	2028371	3	Unknown Traffic	192.168.2.8	49733	23.197.127.21	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 2.2.file.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["citydisco.bet/gdJIS", "crosshairc.life/dAnjhw", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"]}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 58%			Perma Link
Source: file.exe	ReversingLabs: Detection: 52%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.3% probability

Sample uses string decryption to hide its real strings

Source: 2.2.file.exe.400000.0.unpack	String decryptor: citydisco.bet/gdJIS
Source: 2.2.file.exe.400000.0.unpack	String decryptor: crosshairc.life/dAnjhw
Source: 2.2.file.exe.400000.0.unpack	String decryptor: mrodularmall.top/aNzS
Source: 2.2.file.exe.400000.0.unpack	String decryptor: jowinjoinery.icu/bdWUa
Source: 2.2.file.exe.400000.0.unpack	String decryptor: legenassedk.top/bdpWO
Source: 2.2.file.exe.400000.0.unpack	String decryptor: htardwarehu.icu/Sbdsa
Source: 2.2.file.exe.400000.0.unpack	String decryptor: cjlaspcorne.icu/DbIps
Source: 2.2.file.exe.400000.0.unpack	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833 CryptUnprotectData,CryptUnprotectData,	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041BCC0 CryptUnprotectData,	2_2_0041BCC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833 CryptUnprotectData,CryptUnprotectData,	2_2_0041C833

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49733 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8ECE FindFirstFileExW,	0_2_006E8ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006E8F7F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006E8ECE FindFirstFileExW,	2_2_006E8ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006E8F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_006E8F7F

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000104h]	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 6D58C181h	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-4926828Eh]	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+04h]	2_2_00413143
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CF91E6EAh	2_2_0044A106
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea ecx, dword ptr [eax+eax]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea ecx, dword ptr [eax-40000000h]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044C2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+44h]	2_2_00444300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi+3E8E80E8h]	2_2_0044D300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ecx], bx	2_2_0044D300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], esi	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, ebx	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, di	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1272D010h]	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044D7F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+18h]	2_2_0040EFAE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_00429840
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [00451018h]	2_2_0040F066
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402800
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	2_2_004480C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00410897
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_00410897
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044D950
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0D0EF488h]	2_2_0042D92B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	2_2_004019E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-51AE6CD0h]	2_2_0044AA55
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 8B8A8924h	2_2_0043F250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+19DCC0F6h]	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ebp+edi+00h]	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00423A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00423A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], C446A772h	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4926821Eh]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4926821Eh]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 656D2358h	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-49268212h]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	2_2_00448220
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_004292C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6BB1A2B4h]	2_2_004482E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000FAh]	2_2_00433A88
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	2_2_00449B7F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000104h]	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000FAh]	2_2_00433A88
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+34h]	2_2_00433330
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00436BE5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+68h]	2_2_00437BB8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00411C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_00435C60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+08h], ebx	2_2_00445C70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00410C1B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_00410C1B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+5Ch]	2_2_0042F430
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00441480
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+49408C66h]	2_2_00428CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0044BD46
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041EDDC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6D3F2F7Eh]	2_2_00420D90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	2_2_00448590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+50h]	2_2_004305B2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0041AE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00438E42
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+10h], ecx	2_2_00438E42
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, esi	2_2_00437627
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx+00h]	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+10h], ecx	2_2_00438E39
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx+0Ah]	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	2_2_004236EB
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_004386EC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esi+edx]	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-4926828Ah]	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1A92C912h]	2_2_0040C710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-2Ah]	2_2_0044C7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+04h]	2_2_00412FDB
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_00446790
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041EFAD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00433FB0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: citydisco.bet/gdJIS
Source: Malware configuration extractor	URLs: crosshairc.life/dAnjhw
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49682 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49683 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49723 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49724 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49732 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49733 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49731 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49727 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49699 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49684 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49717 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49702 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49690 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49693 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49714 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49720 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49687 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49705 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49696 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=m169HiqDFgH2QgDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14506Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bSHsyZD HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y17c6EffWzeKDYzOHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2489Host: guntac.bet

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: file.exe, 00000002.00000002.1123997285.0000000003249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=Nonesessionid=1e6f4a77fc546841ab2a14ea; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35710Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 15:50:58 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=Nonesessionid=809de0151fe81a063233b55e; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 15:51:07 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1122666006.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ecaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1122666006.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ecaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=Nonesessionid=bf4dd5b165566a36602ef9d3; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 15:51:10 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: citydisco.bet
Source: global traffic	DNS traffic detected: DNS query: crosshairc.life
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu
Source: global traffic	DNS traffic detected: DNS query: legenassedk.top
Source: global traffic	DNS traffic detected: DNS query: htardwarehu.icu
Source: global traffic	DNS traffic detected: DNS query: cjlaspcorne.icu
Source: global traffic	DNS traffic detected: DNS query: bugildbett.top
Source: global traffic	DNS traffic detected: DNS query: weaponrywo.digital
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: guntac.bet

Source: unknown

HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: citydisco.bet

Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030347917.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093067065.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122584508.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000002.00000003.916855878.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.917909763.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS
Source: file.exe, 00000002.00000003.917323221.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.917031305.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISAAAA
Source: file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastl
Source: file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastlNN
Source: file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=J1-T6FXbrr0Z&a
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122515243.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123537225.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javasc
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=jfdbROVe
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am
Source: file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=whw8EcafG167&l=e
Source: file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/s
Source: file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/ja
Source: file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am
Source: file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030427977.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet/bSHsyZDmu
Source: file.exe, 00000002.00000003.1030286347.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122515243.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guntac.bet:443/bSHsyZD
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123537225.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000002.00000003.1053420450.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/5rV
Source: file.exe, 00000002.00000003.942965550.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945746568.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.942879187.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945498591.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945844284.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/=r
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Urv
Source: file.exe, 00000002.00000003.1007319763.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/ca
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/er
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/mr
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000002.00000003.942879187.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: file.exe, 00000002.00000003.951169747.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128.36
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/badges
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030555132.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/inventory/
Source: file.exe, 00000002.00000003.1122515243.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123537225.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128T
Source: file.exe, 00000002.00000003.942965550.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.942879187.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128W
Source: file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/ur
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128
Source: file.exe, 00000002.00000003.1122515243.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128%
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123997285.0000000003249000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122666006.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122666006.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000002.00000003.944523945.0000000003264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093067065.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122584508.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.8:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043F410 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F410

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043F410 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F410

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043FE3C GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0043FE3C

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A31F0	0_2_006A31F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A3640	0_2_006A3640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CF060	0_2_006CF060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A6070	0_2_006A6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B4040	0_2_006B4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BA820	0_2_006BA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B9020	0_2_006B9020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CA020	0_2_006CA020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A1000	0_2_006A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BC010	0_2_006BC010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D3813	0_2_006D3813
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D00D0	0_2_006D00D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A58A0	0_2_006A58A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BE0A0	0_2_006BE0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4080	0_2_006A4080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CD080	0_2_006CD080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A8090	0_2_006A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B0890	0_2_006B0890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C3890	0_2_006C3890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D1890	0_2_006D1890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D3160	0_2_006D3160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AE170	0_2_006AE170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4940	0_2_006A4940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BC940	0_2_006BC940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D2920	0_2_006D2920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EC908	0_2_006EC908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9100	0_2_006C9100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0110	0_2_006C0110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BB1E0	0_2_006BB1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CF9B0	0_2_006CF9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B6180	0_2_006B6180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D6A54	0_2_006D6A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C8A50	0_2_006C8A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A5220	0_2_006A5220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A9220	0_2_006A9220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C5220	0_2_006C5220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C6A00	0_2_006C6A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C8200	0_2_006C8200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0A10	0_2_006C0A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CF2E0	0_2_006CF2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B52C0	0_2_006B52C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AF2D0	0_2_006AF2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AEAA0	0_2_006AEAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9AB0	0_2_006C9AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A2280	0_2_006A2280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B4290	0_2_006B4290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BFB70	0_2_006BFB70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C1370	0_2_006C1370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A8340	0_2_006A8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CEB40	0_2_006CEB40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0350	0_2_006C0350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AB300	0_2_006AB300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AC310	0_2_006AC310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B73F0	0_2_006B73F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BF3D0	0_2_006BF3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BABA0	0_2_006BABA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A6390	0_2_006A6390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B3390	0_2_006B3390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C5C60	0_2_006C5C60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D3477	0_2_006D3477
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A2C40	0_2_006A2C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BEC40	0_2_006BEC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C8C40	0_2_006C8C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C8450	0_2_006C8450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A5C20	0_2_006A5C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E1420	0_2_006E1420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DB41A	0_2_006DB41A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BCCE0	0_2_006BCCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AE4C0	0_2_006AE4C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B3CC0	0_2_006B3CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A54A0	0_2_006A54A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A6C80	0_2_006A6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B6480	0_2_006B6480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C5480	0_2_006C5480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D2480	0_2_006D2480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B0490	0_2_006B0490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D3C90	0_2_006D3C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BD560	0_2_006BD560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B8540	0_2_006B8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BDD50	0_2_006BDD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CFD50	0_2_006CFD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A7D30	0_2_006A7D30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AF530	0_2_006AF530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AAD30	0_2_006AAD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B9500	0_2_006B9500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D35C0	0_2_006D35C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CF5D0	0_2_006CF5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B55B0	0_2_006B55B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CEDB0	0_2_006CEDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A9580	0_2_006A9580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CDD80	0_2_006CDD80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4660	0_2_006A4660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A8640	0_2_006A8640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B6E40	0_2_006B6E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B7E50	0_2_006B7E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B7620	0_2_006B7620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B0E20	0_2_006B0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D0620	0_2_006D0620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BB630	0_2_006BB630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9630	0_2_006C9630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B26F0	0_2_006B26F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D1EF0	0_2_006D1EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BC6A0	0_2_006BC6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006CB680	0_2_006CB680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B2E90	0_2_006B2E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C8690	0_2_006C8690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D2E90	0_2_006D2E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BFF70	0_2_006BFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B9720	0_2_006B9720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AE730	0_2_006AE730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C9F00	0_2_006C9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A9FF0	0_2_006A9FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A67D0	0_2_006A67D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AB780	0_2_006AB780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE782	0_2_006EE782
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0F80	0_2_006C0F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A1790	0_2_006A1790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B6790	0_2_006B6790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004380C8	2_2_004380C8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004110F9	2_2_004110F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00421890	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004378B8	2_2_004378B8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040BA50	2_2_0040BA50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00412AF8	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00444300	2_2_00444300
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042CBA0	2_2_0042CBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004283A0	2_2_004283A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044C3A0	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041BCC0	2_2_0041BCC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00447DF0	2_2_00447DF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042FE40	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044CE10	2_2_0044CE10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040E6D0	2_2_0040E6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00415EF9	2_2_00415EF9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040EFAE	2_2_0040EFAE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041F065	2_2_0041F065
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00417870	2_2_00417870
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00427830	2_2_00427830
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445830	2_2_00445830
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00449832	2_2_00449832
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040D940	2_2_0040D940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00402140	2_2_00402140
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00426150	2_2_00426150
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451150	2_2_00451150
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00439160	2_2_00439160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00442168	2_2_00442168
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040B970	2_2_0040B970
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451170	2_2_00451170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424900	2_2_00424900
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D92B	2_2_0042D92B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0045113C	2_2_0045113C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040F9C0	2_2_0040F9C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004139D0	2_2_004139D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043B9F9	2_2_0043B9F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00412185	2_2_00412185
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445250	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00429A70	2_2_00429A70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042020C	2_2_0042020C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00426A15	2_2_00426A15
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041E21B	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004292C0	2_2_004292C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044CAE0	2_2_0044CAE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00408A80	2_2_00408A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B280	2_2_0044B280
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00431290	2_2_00431290
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445AA0	2_2_00445AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004512AC	2_2_004512AC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004252B0	2_2_004252B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00402B50	2_2_00402B50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040C320	2_2_0040C320
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040A320	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00416B81	2_2_00416B81
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B380	2_2_0044B380
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00411C5F	2_2_00411C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D460	2_2_0042D460
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00432407	2_2_00432407
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043F410	2_2_0043F410
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042F430	2_2_0042F430
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043DC31	2_2_0043DC31
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004384C3	2_2_004384C3
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040D4D0	2_2_0040D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004434DF	2_2_004434DF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041DCDF	2_2_0041DCDF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B4F0	2_2_0044B4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00410483	2_2_00410483
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042F489	2_2_0042F489
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424C90	2_2_00424C90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044BCB6	2_2_0044BCB6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00409540	2_2_00409540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00443540	2_2_00443540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043155F	2_2_0043155F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00403560	2_2_00403560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00425560	2_2_00425560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00413D09	2_2_00413D09
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040AD20	2_2_0040AD20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043B536	2_2_0043B536
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041EDDC	2_2_0041EDDC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B580	2_2_0044B580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00420D90	2_2_00420D90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00407DA0	2_2_00407DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004305B2	2_2_004305B2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00433640	2_2_00433640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00448650	2_2_00448650
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043C610	2_2_0043C610
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00437627	2_2_00437627
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B622	2_2_0044B622
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040CE30	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00444ED0	2_2_00444ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445ED1	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004326E0	2_2_004326E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004386EC	2_2_004386EC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00430E93	2_2_00430E93
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00410EAB	2_2_00410EAB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00403F00	2_2_00403F00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043E703	2_2_0043E703
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041AF00	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040C710	2_2_0040C710
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00436729	2_2_00436729
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D730	2_2_0042D730
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00408FC0	2_2_00408FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044C7D0	2_2_0044C7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004047E2	2_2_004047E2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004437A0	2_2_004437A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CF060	2_2_006CF060
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A6070	2_2_006A6070
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B4040	2_2_006B4040
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BA820	2_2_006BA820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B9020	2_2_006B9020
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CA020	2_2_006CA020
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A1000	2_2_006A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BC010	2_2_006BC010
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D3813	2_2_006D3813
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D00D0	2_2_006D00D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A58A0	2_2_006A58A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BE0A0	2_2_006BE0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A4080	2_2_006A4080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CD080	2_2_006CD080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A8090	2_2_006A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B0890	2_2_006B0890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C3890	2_2_006C3890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D1890	2_2_006D1890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D3160	2_2_006D3160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AE170	2_2_006AE170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A4940	2_2_006A4940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BC940	2_2_006BC940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D2920	2_2_006D2920
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006EC908	2_2_006EC908
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C9100	2_2_006C9100
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C0110	2_2_006C0110
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BB1E0	2_2_006BB1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A31F0	2_2_006A31F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CF9B0	2_2_006CF9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B6180	2_2_006B6180
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D6A54	2_2_006D6A54
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C8A50	2_2_006C8A50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A5220	2_2_006A5220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A9220	2_2_006A9220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C5220	2_2_006C5220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C6A00	2_2_006C6A00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C8200	2_2_006C8200
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C0A10	2_2_006C0A10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CF2E0	2_2_006CF2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B52C0	2_2_006B52C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AF2D0	2_2_006AF2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AEAA0	2_2_006AEAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C9AB0	2_2_006C9AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A2280	2_2_006A2280
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B4290	2_2_006B4290
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BFB70	2_2_006BFB70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C1370	2_2_006C1370
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A8340	2_2_006A8340
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CEB40	2_2_006CEB40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C0350	2_2_006C0350
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AB300	2_2_006AB300
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AC310	2_2_006AC310
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B73F0	2_2_006B73F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BF3D0	2_2_006BF3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BABA0	2_2_006BABA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A6390	2_2_006A6390
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B3390	2_2_006B3390
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C5C60	2_2_006C5C60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D3477	2_2_006D3477
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A2C40	2_2_006A2C40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BEC40	2_2_006BEC40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C8C40	2_2_006C8C40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C8450	2_2_006C8450
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A5C20	2_2_006A5C20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006E1420	2_2_006E1420
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006DB41A	2_2_006DB41A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BCCE0	2_2_006BCCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AE4C0	2_2_006AE4C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B3CC0	2_2_006B3CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A54A0	2_2_006A54A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A6C80	2_2_006A6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B6480	2_2_006B6480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C5480	2_2_006C5480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D2480	2_2_006D2480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B0490	2_2_006B0490
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D3C90	2_2_006D3C90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BD560	2_2_006BD560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B8540	2_2_006B8540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BDD50	2_2_006BDD50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CFD50	2_2_006CFD50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A7D30	2_2_006A7D30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AF530	2_2_006AF530
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AAD30	2_2_006AAD30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B9500	2_2_006B9500
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D35C0	2_2_006D35C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CF5D0	2_2_006CF5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B55B0	2_2_006B55B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CEDB0	2_2_006CEDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A9580	2_2_006A9580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CDD80	2_2_006CDD80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A4660	2_2_006A4660
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A8640	2_2_006A8640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A3640	2_2_006A3640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B6E40	2_2_006B6E40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B7E50	2_2_006B7E50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B7620	2_2_006B7620
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B0E20	2_2_006B0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D0620	2_2_006D0620
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BB630	2_2_006BB630
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C9630	2_2_006C9630
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B26F0	2_2_006B26F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D1EF0	2_2_006D1EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BC6A0	2_2_006BC6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006CB680	2_2_006CB680
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B2E90	2_2_006B2E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C8690	2_2_006C8690
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D2E90	2_2_006D2E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006BFF70	2_2_006BFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B9720	2_2_006B9720
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AE730	2_2_006AE730
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C9F00	2_2_006C9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A9FF0	2_2_006A9FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A67D0	2_2_006A67D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006AB780	2_2_006AB780
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006EE782	2_2_006EE782
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006C0F80	2_2_006C0F80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006A1790	2_2_006A1790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006B6790	2_2_006B6790

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006D6F60 appears 102 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0041AEF0 appears 102 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006DF1CC appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006E4014 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040B350 appears 52 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .bss ZLIB complexity 1.0003231990014265

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@13/8

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00444300 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00444300

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000002.00000003.888771121.0000000000BD2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.888439094.0000000003245000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.917414747.000000000325B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 58%
Source: file.exe	ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D711A push ecx; ret	0_2_006D712D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00758FF1 push es; iretd	0_2_00758FF2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004513DA push edx; retf	2_2_004513FE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004554C9 push 00000000h; iretd	2_2_00455520
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451648 pushad ; retf	2_2_00451689
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044F658 push cs; retf	2_2_0044F665
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004517FC push ebx; ret	2_2_00451803
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D711A push ecx; ret	2_2_006D712D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00758FF1 push es; iretd	2_2_00758FF2

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5432	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5432	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8ECE FindFirstFileExW,	0_2_006E8ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006E8F7F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006E8ECE FindFirstFileExW,	2_2_006E8ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006E8F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_006E8F7F

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: file.exe, 00000002.00000003.917613533.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.951469889.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123372934.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.951469889.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123372934.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWAm
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: file.exe, 00000002.00000003.917613533.000000000327C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00449B30 LdrInitializeThunk,

2_2_00449B30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006D6DE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006FF1B4 mov edi, dword ptr fs:[00000030h]

0_2_006FF1B4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E490C GetProcessHeap,

0_2_006E490C

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D6A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006D6A2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006D6DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D6DDC SetUnhandledExceptionFilter,	0_2_006D6DDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DEF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006DEF1E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D6A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_006D6A2C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D6DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_006D6DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006D6DDC SetUnhandledExceptionFilter,	2_2_006D6DDC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_006DEF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_006DEF1E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006FF1B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_006FF1B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006E88F6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006E88AB
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006E41F7
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_006E899D
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_006E8238
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006E8AA3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006E3CFC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006E8489
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_006E8524
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006E8777
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006E87D6
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_006E88F6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_006E88AB
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_006E41F7
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_006E899D
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_006E8238
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_006E8AA3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_006E3CFC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_006E8489
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_006E8524
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_006E8777
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_006E87D6

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D7827 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006D7827

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030462721.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B35000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6784, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000002.00000002.1123459108.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"^
Source: file.exe, 00000002.00000003.951169747.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000002.00000003.950882849.0000000000B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000002.00000003.950882849.0000000000B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior

Source: Yara match	File source: 00000002.00000003.951169747.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6784, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6784, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	59%	Virustotal		Browse
file.exe	53%	ReversingLabs	Win32.Exploit.LummaC
file.exe	100%	Avira	TR/Kryptik.jihlg

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://guntac.bet:443/bSHsyZD	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://citydisco.bet/gdJISAAAA	0%	Avira URL Cloud	safe
https://community.fastlNN	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.73.234.102	true	false	high
jowinjoinery.icu	188.114.97.3	true	false	high
citydisco.bet	188.114.96.3	true	false	high
weaponrywo.digital	104.21.32.1	true	false	unknown
legenassedk.top	188.114.97.3	true	false	high
htardwarehu.icu	104.21.64.1	true	false	high
bugildbett.top	104.21.112.1	true	false	high
crosshairc.life	104.21.48.1	true	false	high
mrodularmall.top	104.21.112.1	true	false	high
cjlaspcorne.icu	104.21.112.1	true	false	high
guntac.bet	188.114.96.3	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
bugildbett.top/bAuz	false	high
citydisco.bet/gdJIS	false	high
crosshairc.life/dAnjhw	false	high
mrodularmall.top/aNzS	false	high
https://steamcommunity.com/profiles/76561199822375128	false	high
jowinjoinery.icu/bdWUa	false	high
htardwarehu.icu/Sbdsa	false	high
https://citydisco.bet/gdJIS	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/5rV	file.exe, 00000002.00000003.1053420450.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199822375128/badges	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/inventory/	file.exe, 00000002.00000003.1030347917.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030555132.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/ja	file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199822375128%	file.exe, 00000002.00000003.1122515243.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093067065.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122584508.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=whw8EcafG167&l=e	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastlNN	file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am	file.exe, 00000002.00000003.1093024878.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122515243.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123537225.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com	file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javasc	file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199822375128	file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000002.00000003.944637930.000000000362D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/=r	file.exe, 00000002.00000003.942965550.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945746568.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.942879187.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945498591.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.945844284.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://guntac.bet:443/bSHsyZD	file.exe, 00000002.00000003.1030286347.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122515243.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123459108.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/er	file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	file.exe, 00000002.00000003.1093024878.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123997285.0000000003249000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122666006.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128W	file.exe, 00000002.00000003.942965550.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.942879187.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/ur	file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamloopback.host	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/mr	file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122649399.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123605917.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128T	file.exe, 00000002.00000003.1122515243.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123537225.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://citydisco.bet/gdJISAAAA	file.exe, 00000002.00000003.917323221.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.917031305.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199822375128.36	file.exe, 00000002.00000003.951169747.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.950882849.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000002.00000003.945342020.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092973498.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123437052.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007319763.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007382936.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123682305.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	file.exe, 00000002.00000003.1007443009.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122617963.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123657442.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007429111.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007398974.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007415004.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003620000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1123242243.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.000000000361A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.1124144144.0000000003610000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1093116818.0000000000BF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000002.00000003.943594035.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000002.00000003.888824551.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122568884.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092868576.0000000003611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122435162.0000000000BCF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030239572.0000000000BE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1030329549.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1122409277.0000000003621000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092959310.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=J1-T6FXbrr0Z&a	file.exe, 00000002.00000003.1092895103.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	file.exe, 00000002.00000003.1007252705.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007365841.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1007252705.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	crosshairc.life	United States	13335	CLOUDFLARENETUS	false
104.21.112.1	bugildbett.top	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	false
104.21.32.1	weaponrywo.digital	United States	13335	CLOUDFLARENETUS	false
23.197.127.21	unknown	United States	20940	AKAMAI-ASN1EU	false
188.114.96.3	citydisco.bet	European Union	13335	CLOUDFLARENETUS	false
104.21.64.1	htardwarehu.icu	United States	13335	CLOUDFLARENETUS	false
104.73.234.102	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637461
Start date and time:	2025-03-13 16:49:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@13/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 36 Number of non-executed functions: 158
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 2.16.185.191
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:50:46	API Interceptor	7x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
104.21.112.1	CQDNwLUdY4.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	sY8Sfsplzf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/?TF-P7=zR3cIyonFbUCfX4wpKNWKHtg5/zg1+YcnXRNJ+yYPjA6661hsBw23FkDfEgtp7rlWUxdaFu+U4x0i75BG7d41DR1Eot6cYC6DrNKmQYa+SmymwWTrA==&Pv5=thT0rvC
	gbdXRnNKkm.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	JOB NO. AIQ8478.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	jzqc1V4NqB.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/?WBuDj=rwARXV5iz9NY7lD2nse3mpYvX8mI8lq4kwoE5vm7VO31wBaqesAJuHozl9YZ6Ede+IkifZaE/LHkIUXetab9qlITGUdXxZLx5IMa8uxv5i9osOS22A==&Jzwht=FNiD
	CP07E1clp1.exe	Get hash	malicious	FormBook	Browse	www.fz977.xyz/406r/
	2Stejb80vJ.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/uztg/
	Shipment_Docus_COSCO_20250307_35405649_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	ORDER-000291-XLSX.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Quotation_Order_Request_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
citydisco.bet	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SoftWare.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	FortniteHack.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.96.3
	setupx 1.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3
	Installer64x.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	setupx 2.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
weaponrywo.digital	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
steamcommunity.com	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	script5.ps1	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	https://stearncommmunity.com/profiles/52829086342741	Get hash	malicious	Unknown	Browse	23.197.127.21
	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	104.73.234.102
	https://sceanmcommnunmnlty.com/sotep/aofpe/zoepr	Get hash	malicious	Unknown	Browse	104.73.234.102
	http://gift50steam.com/50	Get hash	malicious	Unknown	Browse	104.73.234.102
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.73.234.102
jowinjoinery.icu	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	CheatInjector.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
legenassedk.top	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SecuriteInfo.com.Win32.MalwareX-gen.1567.5483.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	https://ctrk.klclick3.com/l/01JP5VPSP6JS7E5VAEC1KGWEB7_2	Get hash	malicious	Unknown	Browse	104.17.93.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	file.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	https://ctrk.klclick3.com/l/01JP5VPSP6JS7E5VAEC1KGWEB7_2	Get hash	malicious	Unknown	Browse	104.17.93.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	file.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	https://ctrk.klclick3.com/l/01JP5VPSP6JS7E5VAEC1KGWEB7_2	Get hash	malicious	Unknown	Browse	104.17.93.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	file.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	https://ctrk.klclick3.com/l/01JP5VPSP6JS7E5VAEC1KGWEB7_2	Get hash	malicious	Unknown	Browse	104.17.93.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	file.exe	Get hash	malicious	Unknown	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	23.197.127.21 188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21 188.114.96.3
	DropboxInstaller.exe	Get hash	malicious	Unknown	Browse	23.197.127.21 188.114.96.3
	DropboxInstaller.exe	Get hash	malicious	Unknown	Browse	23.197.127.21 188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.567510617380908
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	775'488 bytes
MD5:	b7d4565a9d634456b769b497ab240125
SHA1:	895b664866ac5fb4e6b602f1525982e69f30c9e2
SHA256:	8076fa4a81dc3069adfc7c9f902e6bded83edfc4131714d17f2528267789bc19
SHA512:	ec4e8d7a41e45cebd50310a8164fc3997c1711c914f0cbf0314ab647f334ac0cc1af597293a11f78b0d50b1aeed5c91287794b616aa13ef198552fa2fc5efe99
SSDEEP:	12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdyQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcF
TLSH:	3DF4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB76E08932357
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.............................w............@.......................................@.................................P...(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4377d2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D1BF1F [Wed Mar 12 17:06:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	033c5f85fb620246315503dc218ebc8c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	31F605F0D1D4BA54250DA5C719A8200C
Thumbprint SHA-1:	E8C15B4C98AD91E051EE5AF5F524A8729050B2A2
Thumbprint SHA-256:	22A3C23E08C7DBB4E7F4591E58C04285C0514C2894E3C418AD157D817D7EDF3C
Serial:	33000003DE8D56825AF1A4A9670000000003DE

Entrypoint Preview

Instruction
call 00007F529986B82Ah
jmp 00007F529986B699h
mov ecx, dword ptr [0045F840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F529986B826h
test esi, ecx
jne 00007F529986B848h
call 00007F529986B851h
mov ecx, eax
cmp ecx, edi
jne 00007F529986B829h
mov ecx, BB40E64Fh
jmp 00007F529986B830h
test esi, ecx
jne 00007F529986B82Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0045F840h], ecx
not ecx
pop edi
mov dword ptr [0045F880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0045C860h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0045C820h]
xor dword ptr [ebp-04h], eax
call dword ptr [0045C81Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0045C8A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 004614D0h
call dword ptr [0045C880h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F5299872375h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c650	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb9000	0x4540	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x276c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x58b28	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x54f98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5c7c0	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x52cc0	0x52e00	b955d299ddc749adb9e2a9fa46e5dda4	False	0.5095947633861236	data	6.772334323063753	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x54000	0xa124	0xa200	147c72eee2c66963ee69f82cf3610cb3	False	0.4244068287037037	data	4.908125312415663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5f000	0x2c9c	0x1600	eab85ca8d24299491f287a6faf9660e1	False	0.4069602272727273	data	4.744736283390186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x62000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x63000	0x276c	0x2800	ed7d506be2e46b9b1c8fde31ac68b654	False	0.7849609375	data	6.600494306172883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x66000	0x57a00	0x57a00	41b8163128c25210889882063c781b17	False	1.0003231990014265	data	7.999460106949404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49699	104.21.64.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49708	104.21.32.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49684	188.114.96.3	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49717	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49702	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49690	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49693	188.114.97.3	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49714	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49720	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	104.73.234.102	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49687	104.21.48.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49705	104.21.112.1	443	TCP
2025-03-13T16:50:39.942646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49696	188.114.97.3	443	TCP
2025-03-13T16:50:45.797007+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49682	188.114.96.3	443	TCP
2025-03-13T16:50:48.889982+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49683	188.114.96.3	443	TCP
2025-03-13T16:50:57.063905+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49723	23.197.127.21	443	TCP
2025-03-13T16:51:00.531465+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49724	188.114.96.3	443	TCP
2025-03-13T16:51:03.758619+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49727	23.197.127.21	443	TCP
2025-03-13T16:51:06.715043+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49731	23.197.127.21	443	TCP
2025-03-13T16:51:08.145988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49732	23.197.127.21	443	TCP
2025-03-13T16:51:09.644822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49733	23.197.127.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 16:50:44.189563036 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:44.189605951 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:44.189754963 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:44.194327116 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:44.194349051 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:45.796941042 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:45.797007084 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:45.847989082 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:45.848007917 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:45.848400116 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:45.895704031 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.025229931 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.025229931 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.025376081 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900170088 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900333881 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900453091 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900456905 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.900479078 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900523901 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.900552034 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900691032 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.900777102 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.900789976 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.942578077 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.952847004 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.954478025 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.954561949 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.954570055 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.986517906 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:46.986613989 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:46.986627102 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.036328077 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.126231909 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.126319885 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.126430035 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.127345085 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.127367973 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.127404928 CET	49682	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.127412081 CET	443	49682	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.351648092 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.351705074 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:47.351780891 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.352123976 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:47.352139950 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:48.889890909 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:48.889981985 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:48.891330004 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:48.891349077 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:48.891616106 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:48.892934084 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:48.893086910 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:48.893120050 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:50.098822117 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:50.098927975 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:50.099073887 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:50.099153042 CET	49683	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:50.099173069 CET	443	49683	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:50.228431940 CET	49684	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:50.228478909 CET	443	49684	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:50.228576899 CET	49684	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:50.228884935 CET	49684	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:50.228900909 CET	443	49684	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.497987032 CET	443	49684	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.498452902 CET	49685	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.498493910 CET	443	49685	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.498558998 CET	49685	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.499047041 CET	49685	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.499058008 CET	443	49685	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.500166893 CET	443	49685	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.500503063 CET	49686	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.500534058 CET	443	49686	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.500628948 CET	49686	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.501246929 CET	49686	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.501281023 CET	443	49686	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:51.501385927 CET	49686	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:51.517606974 CET	49687	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.517633915 CET	443	49687	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.517700911 CET	49687	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.518196106 CET	49687	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.518209934 CET	443	49687	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.518837929 CET	443	49687	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.519224882 CET	49688	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.519244909 CET	443	49688	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.519296885 CET	49688	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.519587040 CET	49688	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.519597054 CET	443	49688	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.520025969 CET	443	49688	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.520396948 CET	49689	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.520428896 CET	443	49689	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.520489931 CET	49689	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.520667076 CET	49689	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.520701885 CET	443	49689	104.21.48.1	192.168.2.8
Mar 13, 2025 16:50:51.520747900 CET	49689	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:50:51.824595928 CET	49690	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.824645996 CET	443	49690	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.824732065 CET	49690	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.825107098 CET	49690	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.825115919 CET	443	49690	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.826333046 CET	443	49690	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.826667070 CET	49691	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.826705933 CET	443	49691	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.826780081 CET	49691	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.827032089 CET	49691	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.827044010 CET	443	49691	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.827477932 CET	443	49691	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.827743053 CET	49692	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.827775955 CET	443	49692	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.827877045 CET	49692	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.827986956 CET	49692	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.828015089 CET	443	49692	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:51.828068018 CET	49692	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:51.875950098 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.875972033 CET	443	49693	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.876063108 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.876435995 CET	49693	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.876447916 CET	443	49693	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.877151966 CET	443	49693	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.877474070 CET	49694	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.877491951 CET	443	49694	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.877548933 CET	49694	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.877938986 CET	49694	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.877947092 CET	443	49694	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.878427029 CET	443	49694	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.878707886 CET	49695	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.878731966 CET	443	49695	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.878778934 CET	49695	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.878917933 CET	49695	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:51.878948927 CET	443	49695	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:51.879010916 CET	49695	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.256602049 CET	49696	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.256656885 CET	443	49696	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.256854057 CET	49696	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.257132053 CET	49696	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.257148027 CET	443	49696	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.257844925 CET	443	49696	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.258321047 CET	49697	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.258375883 CET	443	49697	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.258579969 CET	49697	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.258730888 CET	49697	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.258750916 CET	443	49697	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.259126902 CET	443	49697	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.259382963 CET	49698	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.259411097 CET	443	49698	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.259485960 CET	49698	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.259608030 CET	49698	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.259638071 CET	443	49698	188.114.97.3	192.168.2.8
Mar 13, 2025 16:50:52.259687901 CET	49698	443	192.168.2.8	188.114.97.3
Mar 13, 2025 16:50:52.285919905 CET	49699	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.285978079 CET	443	49699	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.286185980 CET	49699	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.286705971 CET	49699	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.286724091 CET	443	49699	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.287436008 CET	443	49699	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.287760019 CET	49700	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.287802935 CET	443	49700	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.287862062 CET	49700	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.288119078 CET	49700	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.288131952 CET	443	49700	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.288515091 CET	443	49700	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.288778067 CET	49701	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.288825035 CET	443	49701	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.288887978 CET	49701	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.289020061 CET	49701	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.289048910 CET	443	49701	104.21.64.1	192.168.2.8
Mar 13, 2025 16:50:52.289113998 CET	49701	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:50:52.316121101 CET	49702	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.316167116 CET	443	49702	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.316266060 CET	49702	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.316643953 CET	49702	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.316663027 CET	443	49702	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.317065954 CET	443	49702	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.317384958 CET	49703	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.317406893 CET	443	49703	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.317498922 CET	49703	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.317971945 CET	49703	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.317985058 CET	443	49703	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.318334103 CET	443	49703	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.318675995 CET	49704	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.318703890 CET	443	49704	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.318886995 CET	49704	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.319036961 CET	49704	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.319523096 CET	443	49704	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.319632053 CET	49704	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.674786091 CET	49705	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.674840927 CET	443	49705	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.674916029 CET	49705	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.675259113 CET	49705	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.675271034 CET	443	49705	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.676008940 CET	443	49705	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.676290989 CET	49706	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.676342010 CET	443	49706	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.676398993 CET	49706	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.676630974 CET	49706	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.676641941 CET	443	49706	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.677067995 CET	443	49706	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.677496910 CET	49707	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.677537918 CET	443	49707	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.677598000 CET	49707	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.677791119 CET	49707	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.677818060 CET	443	49707	104.21.112.1	192.168.2.8
Mar 13, 2025 16:50:52.677870035 CET	49707	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:50:52.695204020 CET	49708	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.695255041 CET	443	49708	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.695333004 CET	49708	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.695696115 CET	49708	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.695713043 CET	443	49708	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.696449041 CET	443	49708	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.696820021 CET	49709	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.696866035 CET	443	49709	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.696952105 CET	49709	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.697232962 CET	49709	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.697257996 CET	443	49709	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.697654963 CET	443	49709	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.698003054 CET	49710	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.698028088 CET	443	49710	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.698077917 CET	49710	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.698242903 CET	49710	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.698271036 CET	443	49710	104.21.32.1	192.168.2.8
Mar 13, 2025 16:50:52.698316097 CET	49710	443	192.168.2.8	104.21.32.1
Mar 13, 2025 16:50:52.706772089 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.706809998 CET	443	49711	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.706876993 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.707194090 CET	49711	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.707211971 CET	443	49711	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.707767010 CET	443	49711	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.708142042 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.708169937 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.708218098 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.708762884 CET	49712	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.708775043 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.709156036 CET	443	49712	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.709527016 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.709556103 CET	443	49713	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.709620953 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.709805965 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.709831953 CET	443	49713	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.709882021 CET	49713	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.712331057 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.712368011 CET	443	49714	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.712445974 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.712683916 CET	49714	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.712697983 CET	443	49714	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.713040113 CET	443	49714	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.713421106 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.713454008 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.713515043 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.713751078 CET	49715	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.713763952 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.714097023 CET	443	49715	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.714462996 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.714473009 CET	443	49716	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.714525938 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.714677095 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.714708090 CET	443	49716	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.714750051 CET	49716	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.966342926 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.966397047 CET	443	49717	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.966454983 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.966793060 CET	49717	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.966804981 CET	443	49717	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.967477083 CET	443	49717	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.967777967 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.967809916 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.967885017 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.968102932 CET	49718	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.968120098 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.968497992 CET	443	49718	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.968735933 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.968782902 CET	443	49719	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.968828917 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.968952894 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.968986034 CET	443	49719	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.969032049 CET	49719	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.970012903 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.970046043 CET	443	49720	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.970117092 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.970341921 CET	49720	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.970364094 CET	443	49720	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.970711946 CET	443	49720	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.971010923 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.971055031 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.971117020 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.971335888 CET	49721	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.971349955 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.971673965 CET	443	49721	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.971895933 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.971929073 CET	443	49722	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.971972942 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.972085953 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:52.972117901 CET	443	49722	104.73.234.102	192.168.2.8
Mar 13, 2025 16:50:52.972160101 CET	49722	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:50:54.267585993 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:54.267633915 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:54.268235922 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:54.268531084 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:54.268551111 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:57.063811064 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:57.063905001 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:57.067373037 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:57.067397118 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:57.067660093 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:57.069298029 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:57.112333059 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:58.916193008 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:58.916234016 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:58.916250944 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:58.916311026 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:58.916342974 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:58.916371107 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:58.916398048 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.026717901 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.026777029 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.026818991 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.026839972 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.026875019 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.104634047 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.104681969 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.104703903 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.104717970 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.104733944 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.104741096 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.104794025 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.149755001 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.149790049 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.149805069 CET	49723	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:50:59.149811983 CET	443	49723	23.197.127.21	192.168.2.8
Mar 13, 2025 16:50:59.186475992 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:59.186520100 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:50:59.186599970 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:59.186948061 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:50:59.186960936 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:00.531359911 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:00.531465054 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:51:00.533027887 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:51:00.533039093 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:00.533289909 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:00.534425020 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:51:00.534553051 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:51:00.534570932 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:01.376427889 CET	443	49724	188.114.96.3	192.168.2.8
Mar 13, 2025 16:51:01.376658916 CET	49724	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:51:01.891612053 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:01.891658068 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:01.891733885 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:01.892026901 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:01.892039061 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:03.758543968 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:03.758619070 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:03.766321898 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:03.766345024 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:03.766590118 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:03.782210112 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:03.828325033 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.854252100 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.854285002 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.854319096 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.854362965 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.854413033 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.854427099 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.854434013 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.854465008 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.964049101 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.964128971 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.964159012 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.964200020 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.964252949 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.995531082 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.995598078 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.995628119 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.995646000 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.995738029 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.995762110 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.995775938 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.995785952 CET	49727	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.995790958 CET	443	49727	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.997323990 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.997381926 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:04.997463942 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.997781038 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:04.997798920 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:06.714929104 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:06.715043068 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:06.716403008 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:06.716413975 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:06.716679096 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:06.725522995 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:06.772316933 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.630546093 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.630578041 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.630593061 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.630641937 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.630670071 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.630702972 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.630733967 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.712960005 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.713088989 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.713134050 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.713191032 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.713366032 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.713387012 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.713399887 CET	49731	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.713407040 CET	443	49731	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.757925034 CET	49732	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.757962942 CET	443	49732	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:07.758057117 CET	49732	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.758341074 CET	49732	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:07.758354902 CET	443	49732	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:08.145987988 CET	49732	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:08.147620916 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:08.147671938 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:08.147783995 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:08.148063898 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:08.148075104 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:09.644675016 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:09.644821882 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:09.646377087 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:09.646390915 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:09.646636009 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:09.648083925 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:09.692329884 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.580548048 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.580621958 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.580665112 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.580708981 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.580730915 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.580753088 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.580787897 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.664323092 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.664380074 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.664453983 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.664472103 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.664516926 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.667515993 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.667581081 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.667587996 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.667635918 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.667640924 CET	443	49733	23.197.127.21	192.168.2.8
Mar 13, 2025 16:51:10.667663097 CET	49733	443	192.168.2.8	23.197.127.21
Mar 13, 2025 16:51:10.667700052 CET	443	49733	23.197.127.21	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 16:50:44.167203903 CET	62315	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:44.181704044 CET	53	62315	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:51.502306938 CET	54549	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:51.516741037 CET	53	54549	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:51.521652937 CET	63575	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:51.823621988 CET	53	63575	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:51.828933001 CET	62041	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:51.875003099 CET	53	62041	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:51.879767895 CET	57437	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.255280018 CET	53	57437	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:52.260503054 CET	61424	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.284948111 CET	53	61424	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:52.289894104 CET	64277	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.315159082 CET	53	64277	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:52.319736958 CET	52141	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.673763990 CET	53	52141	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:52.678654909 CET	55370	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.694344044 CET	53	55370	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:52.699363947 CET	53903	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:52.705996037 CET	53	53903	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:54.260126114 CET	49988	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:54.266773939 CET	53	49988	1.1.1.1	192.168.2.8
Mar 13, 2025 16:50:59.175462961 CET	63981	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:50:59.185751915 CET	53	63981	1.1.1.1	192.168.2.8
Mar 13, 2025 16:51:07.749839067 CET	53391	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:51:07.757247925 CET	53	53391	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 16:50:44.167203903 CET	192.168.2.8	1.1.1.1	0xb498	Standard query (0)	citydisco.bet	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.502306938 CET	192.168.2.8	1.1.1.1	0xc9a5	Standard query (0)	crosshairc.life	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.521652937 CET	192.168.2.8	1.1.1.1	0xeee8	Standard query (0)	mrodularmall.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.828933001 CET	192.168.2.8	1.1.1.1	0xd132	Standard query (0)	jowinjoinery.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.879767895 CET	192.168.2.8	1.1.1.1	0x5aa8	Standard query (0)	legenassedk.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.260503054 CET	192.168.2.8	1.1.1.1	0xf5fa	Standard query (0)	htardwarehu.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.289894104 CET	192.168.2.8	1.1.1.1	0xfaa0	Standard query (0)	cjlaspcorne.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.319736958 CET	192.168.2.8	1.1.1.1	0xde16	Standard query (0)	bugildbett.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.678654909 CET	192.168.2.8	1.1.1.1	0xa190	Standard query (0)	weaponrywo.digital	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.699363947 CET	192.168.2.8	1.1.1.1	0x7006	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:54.260126114 CET	192.168.2.8	1.1.1.1	0x5169	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:59.175462961 CET	192.168.2.8	1.1.1.1	0xdceb	Standard query (0)	guntac.bet	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:51:07.749839067 CET	192.168.2.8	1.1.1.1	0x657a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 16:50:44.181704044 CET	1.1.1.1	192.168.2.8	0xb498	No error (0)	citydisco.bet	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:44.181704044 CET	1.1.1.1	192.168.2.8	0xb498	No error (0)	citydisco.bet	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.516741037 CET	1.1.1.1	192.168.2.8	0xc9a5	No error (0)	crosshairc.life	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.823621988 CET	1.1.1.1	192.168.2.8	0xeee8	No error (0)	mrodularmall.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.875003099 CET	1.1.1.1	192.168.2.8	0xd132	No error (0)	jowinjoinery.icu	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:51.875003099 CET	1.1.1.1	192.168.2.8	0xd132	No error (0)	jowinjoinery.icu	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.255280018 CET	1.1.1.1	192.168.2.8	0x5aa8	No error (0)	legenassedk.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.255280018 CET	1.1.1.1	192.168.2.8	0x5aa8	No error (0)	legenassedk.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.284948111 CET	1.1.1.1	192.168.2.8	0xf5fa	No error (0)	htardwarehu.icu	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.315159082 CET	1.1.1.1	192.168.2.8	0xfaa0	No error (0)	cjlaspcorne.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.673763990 CET	1.1.1.1	192.168.2.8	0xde16	No error (0)	bugildbett.top	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.694344044 CET	1.1.1.1	192.168.2.8	0xa190	No error (0)	weaponrywo.digital	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:52.705996037 CET	1.1.1.1	192.168.2.8	0x7006	No error (0)	steamcommunity.com	104.73.234.102	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:50:54.266773939 CET	1.1.1.1	192.168.2.8	0x5169	No error (0)	steamcommunity.com	23.197.127.21

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
file.exe