Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1637467
MD5:	5b63b3a5d527ed5259811d2d46ecca58
SHA1:	8382155b7c465dd216ea7f31fa10c7115f93f1c5
SHA256:	17a3259df1b54d390acd9b338e0afd6a3ed926f294e494e07512efdb99bb99fb
Tags:	exeuser-jstrosch
Infos:

Detection

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6272 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5B63B3A5D527ED5259811D2D46ECCA58)

file.exe (PID: 6584 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5B63B3A5D527ED5259811D2D46ECCA58)

cleanup

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T16:56:42.224610+0100	2028371	3	Unknown Traffic	192.168.2.8	49682	104.21.112.1	443	TCP
2025-03-13T16:56:48.236689+0100	2028371	3	Unknown Traffic	192.168.2.8	49685	104.21.112.1	443	TCP
2025-03-13T16:56:53.993843+0100	2028371	3	Unknown Traffic	192.168.2.8	49688	104.21.64.1	443	TCP
2025-03-13T16:56:59.513807+0100	2028371	3	Unknown Traffic	192.168.2.8	49693	188.114.96.3	443	TCP
2025-03-13T16:57:11.484017+0100	2028371	3	Unknown Traffic	192.168.2.8	57954	188.114.96.3	443	TCP
2025-03-13T16:57:20.057414+0100	2028371	3	Unknown Traffic	192.168.2.8	57961	104.21.64.1	443	TCP
2025-03-13T16:57:25.642451+0100	2028371	3	Unknown Traffic	192.168.2.8	57965	104.21.48.1	443	TCP
2025-03-13T16:57:31.224001+0100	2028371	3	Unknown Traffic	192.168.2.8	57968	104.21.80.1	443	TCP
2025-03-13T16:57:36.793806+0100	2028371	3	Unknown Traffic	192.168.2.8	57971	104.21.112.1	443	TCP
2025-03-13T16:57:41.295573+0100	2028371	3	Unknown Traffic	192.168.2.8	57975	104.73.234.102	443	TCP
2025-03-13T16:57:43.866370+0100	2028371	3	Unknown Traffic	192.168.2.8	57976	104.73.234.102	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.co

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 49%			Perma Link
Source: file.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.6% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zfurrycomp.top/kFwo
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: crosshairc.life/dAnjhw
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000000.00000002.910831575.0000000001371000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:57975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:57976 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A68ECE FindFirstFileExW,	0_2_00A68ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A68F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A68F7F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A68ECE FindFirstFileExW,	2_2_00A68ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A68F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00A68F7F

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CF91E6EAh	2_2_0044A106
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi+3E8E80E8h]	2_2_0044D300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ecx], bx	2_2_0044D300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044D7F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+18h]	2_2_0040EFAE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_00429840
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [00451018h]	2_2_0040F066
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402800
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000104h]	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	2_2_004480C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 6D58C181h	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-4926828Eh]	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00410897
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_00410897
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+04h]	2_2_00413143
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044D950
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0D0EF488h]	2_2_0042D92B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	2_2_004019E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-51AE6CD0h]	2_2_0044AA55
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 8B8A8924h	2_2_0043F250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+19DCC0F6h]	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ebp+edi+00h]	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00423A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00423A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], C446A772h	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4926821Eh]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4926821Eh]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 656D2358h	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-49268212h]	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	2_2_00448220
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_004292C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6BB1A2B4h]	2_2_004482E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea ecx, dword ptr [eax+eax]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea ecx, dword ptr [eax-40000000h]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000FAh]	2_2_00433A88
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044C2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	2_2_00449B7F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000104h]	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+44h]	2_2_00444300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000FAh]	2_2_00433A88
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+34h]	2_2_00433330
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00436BE5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], esi	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, ebx	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+68h]	2_2_00437BB8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00411C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_00435C60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+08h], ebx	2_2_00445C70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00410C1B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_00410C1B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+5Ch]	2_2_0042F430
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00441480
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+49408C66h]	2_2_00428CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0044BD46
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041EDDC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6D3F2F7Eh]	2_2_00420D90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	2_2_00448590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+50h]	2_2_004305B2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0041AE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00438E42
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+10h], ecx	2_2_00438E42
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, di	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1272D010h]	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, esi	2_2_00437627
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx+00h]	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+10h], ecx	2_2_00438E39
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx+0Ah]	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	2_2_004236EB
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_004386EC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esi+edx]	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00432F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-4926828Ah]	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1A92C912h]	2_2_0040C710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-2Ah]	2_2_0044C7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+04h]	2_2_00412FDB
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_00446790
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041EFAD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00433FB0

Source: global traffic

TCP traffic: 192.168.2.8:57952 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57961 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49682 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49685 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49688 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49693 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57975 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57968 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57976 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57971 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57954 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:57965 -> 104.21.48.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ ht equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1544894861.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.co equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=Nonesessionid=70588f281b3ca5b19c7b1ee6; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 15:57:44 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=Nonesessionid=7b11a90485460255568d3a0d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26244Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 13 Mar 2025 15:57:41 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: m/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000002.00000003.1569965615.00000000015FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tps://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: zfurrycomp.top
Source: global traffic	DNS traffic detected: DNS query: crosshairc.life
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu
Source: global traffic	DNS traffic detected: DNS query: legenassedk.top
Source: global traffic	DNS traffic detected: DNS query: htardwarehu.icu
Source: global traffic	DNS traffic detected: DNS query: cjlaspcorne.icu
Source: global traffic	DNS traffic detected: DNS query: bugildbett.top
Source: global traffic	DNS traffic detected: DNS query: weaponrywo.digital
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=J1-T6FXbrr0Z&a
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=jfdbROVe
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000002.00000003.1544894861.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.co
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/2
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000002.00000002.1571345083.0000000001598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570099768.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570241410.0000000001598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128b
Source: file.exe, 00000002.00000003.1570099768.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128q
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000002.00000003.1570099768.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/y
Source: file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/z
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 57953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57964
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57971
Source: unknown	Network traffic detected: HTTP traffic on port 57966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 57960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57975
Source: unknown	Network traffic detected: HTTP traffic on port 57967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57960
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443

Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:57975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.8:57976 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043F410 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F410

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043F410 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043F410

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043FC48 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0043FC48

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A231F0	0_2_00A231F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A23640	0_2_00A23640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A258A0	0_2_00A258A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E0A0	0_2_00A3E0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A24080	0_2_00A24080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4D080	0_2_00A4D080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A28090	0_2_00A28090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A30890	0_2_00A30890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A43890	0_2_00A43890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51890	0_2_00A51890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A500D0	0_2_00A500D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3A820	0_2_00A3A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39020	0_2_00A39020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A020	0_2_00A4A020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A21000	0_2_00A21000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3C010	0_2_00A3C010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53813	0_2_00A53813
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F060	0_2_00A4F060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A26070	0_2_00A26070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A34040	0_2_00A34040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F9B0	0_2_00A4F9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36180	0_2_00A36180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3B1E0	0_2_00A3B1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A52920	0_2_00A52920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49100	0_2_00A49100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6C908	0_2_00A6C908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40110	0_2_00A40110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53160	0_2_00A53160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2E170	0_2_00A2E170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A24940	0_2_00A24940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3C940	0_2_00A3C940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2EAA0	0_2_00A2EAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49AB0	0_2_00A49AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A22280	0_2_00A22280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A34290	0_2_00A34290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F2E0	0_2_00A4F2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A352C0	0_2_00A352C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2F2D0	0_2_00A2F2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A25220	0_2_00A25220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A29220	0_2_00A29220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A45220	0_2_00A45220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A46A00	0_2_00A46A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48200	0_2_00A48200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40A10	0_2_00A40A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56A54	0_2_00A56A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48A50	0_2_00A48A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3ABA0	0_2_00A3ABA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A26390	0_2_00A26390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33390	0_2_00A33390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A373F0	0_2_00A373F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3F3D0	0_2_00A3F3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B300	0_2_00A2B300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C310	0_2_00A2C310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3FB70	0_2_00A3FB70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A41370	0_2_00A41370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A28340	0_2_00A28340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4EB40	0_2_00A4EB40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40350	0_2_00A40350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A254A0	0_2_00A254A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A26C80	0_2_00A26C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36480	0_2_00A36480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A45480	0_2_00A45480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A52480	0_2_00A52480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A30490	0_2_00A30490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53C90	0_2_00A53C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3CCE0	0_2_00A3CCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2E4C0	0_2_00A2E4C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33CC0	0_2_00A33CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A25C20	0_2_00A25C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A61420	0_2_00A61420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5B41A	0_2_00A5B41A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A45C60	0_2_00A45C60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53477	0_2_00A53477
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A22C40	0_2_00A22C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3EC40	0_2_00A3EC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48C40	0_2_00A48C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48450	0_2_00A48450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A355B0	0_2_00A355B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4EDB0	0_2_00A4EDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A29580	0_2_00A29580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DD80	0_2_00A4DD80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A535C0	0_2_00A535C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F5D0	0_2_00A4F5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A27D30	0_2_00A27D30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2F530	0_2_00A2F530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2AD30	0_2_00A2AD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39500	0_2_00A39500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3D560	0_2_00A3D560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A38540	0_2_00A38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3DD50	0_2_00A3DD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4FD50	0_2_00A4FD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3C6A0	0_2_00A3C6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4B680	0_2_00A4B680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A32E90	0_2_00A32E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48690	0_2_00A48690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A52E90	0_2_00A52E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A326F0	0_2_00A326F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51EF0	0_2_00A51EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A37620	0_2_00A37620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A30E20	0_2_00A30E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50620	0_2_00A50620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3B630	0_2_00A3B630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49630	0_2_00A49630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A24660	0_2_00A24660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A28640	0_2_00A28640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36E40	0_2_00A36E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A37E50	0_2_00A37E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2B780	0_2_00A2B780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6E782	0_2_00A6E782
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40F80	0_2_00A40F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A21790	0_2_00A21790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A36790	0_2_00A36790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A29FF0	0_2_00A29FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A267D0	0_2_00A267D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39720	0_2_00A39720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2E730	0_2_00A2E730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49F00	0_2_00A49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3FF70	0_2_00A3FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040BA50	2_2_0040BA50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040E6D0	2_2_0040E6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040EFAE	2_2_0040EFAE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041F065	2_2_0041F065
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00417870	2_2_00417870
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00427830	2_2_00427830
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445830	2_2_00445830
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00449832	2_2_00449832
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004380C8	2_2_004380C8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004110F9	2_2_004110F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00421890	2_2_00421890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004378B8	2_2_004378B8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040D940	2_2_0040D940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00402140	2_2_00402140
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00426150	2_2_00426150
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451150	2_2_00451150
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00439160	2_2_00439160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00442168	2_2_00442168
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040B970	2_2_0040B970
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451170	2_2_00451170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424900	2_2_00424900
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D92B	2_2_0042D92B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0045113C	2_2_0045113C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040F9C0	2_2_0040F9C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004139D0	2_2_004139D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043B9F9	2_2_0043B9F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00412185	2_2_00412185
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445250	2_2_00445250
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00429A70	2_2_00429A70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042020C	2_2_0042020C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00426A15	2_2_00426A15
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041E21B	2_2_0041E21B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004292C0	2_2_004292C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044CAE0	2_2_0044CAE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00412AF8	2_2_00412AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00408A80	2_2_00408A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B280	2_2_0044B280
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00431290	2_2_00431290
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445AA0	2_2_00445AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004512AC	2_2_004512AC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004252B0	2_2_004252B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00402B50	2_2_00402B50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041C833	2_2_0041C833
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00444300	2_2_00444300
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040C320	2_2_0040C320
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040A320	2_2_0040A320
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00416B81	2_2_00416B81
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B380	2_2_0044B380
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042CBA0	2_2_0042CBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004283A0	2_2_004283A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044C3A0	2_2_0044C3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00411C5F	2_2_00411C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D460	2_2_0042D460
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00432407	2_2_00432407
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043F410	2_2_0043F410
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042F430	2_2_0042F430
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043DC31	2_2_0043DC31
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004384C3	2_2_004384C3
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041BCC0	2_2_0041BCC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040D4D0	2_2_0040D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004434DF	2_2_004434DF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041DCDF	2_2_0041DCDF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B4F0	2_2_0044B4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00410483	2_2_00410483
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042F489	2_2_0042F489
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424C90	2_2_00424C90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044BCB6	2_2_0044BCB6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00409540	2_2_00409540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00443540	2_2_00443540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043155F	2_2_0043155F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00425560	2_2_00425560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00413D09	2_2_00413D09
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040AD20	2_2_0040AD20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043B536	2_2_0043B536
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041EDDC	2_2_0041EDDC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00447DF0	2_2_00447DF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B580	2_2_0044B580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00420D90	2_2_00420D90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00407DA0	2_2_00407DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004305B2	2_2_004305B2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042FE40	2_2_0042FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00433640	2_2_00433640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00448650	2_2_00448650
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043C610	2_2_0043C610
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044CE10	2_2_0044CE10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00437627	2_2_00437627
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044B622	2_2_0044B622
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040CE30	2_2_0040CE30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00444ED0	2_2_00444ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00445ED1	2_2_00445ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004326E0	2_2_004326E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004386EC	2_2_004386EC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00415EF9	2_2_00415EF9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00430E93	2_2_00430E93
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00410EAB	2_2_00410EAB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043E703	2_2_0043E703
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041AF00	2_2_0041AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040C710	2_2_0040C710
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00436729	2_2_00436729
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0042D730	2_2_0042D730
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00408FC0	2_2_00408FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044C7D0	2_2_0044C7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004047E2	2_2_004047E2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004437A0	2_2_004437A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A258A0	2_2_00A258A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3E0A0	2_2_00A3E0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A24080	2_2_00A24080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4D080	2_2_00A4D080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A28090	2_2_00A28090
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A30890	2_2_00A30890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A43890	2_2_00A43890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A51890	2_2_00A51890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A500D0	2_2_00A500D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3A820	2_2_00A3A820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A39020	2_2_00A39020
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4A020	2_2_00A4A020
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A21000	2_2_00A21000
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3C010	2_2_00A3C010
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A53813	2_2_00A53813
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4F060	2_2_00A4F060
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A26070	2_2_00A26070
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A34040	2_2_00A34040
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4F9B0	2_2_00A4F9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A36180	2_2_00A36180
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3B1E0	2_2_00A3B1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A231F0	2_2_00A231F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A52920	2_2_00A52920
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A49100	2_2_00A49100
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A6C908	2_2_00A6C908
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A40110	2_2_00A40110
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A53160	2_2_00A53160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2E170	2_2_00A2E170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A24940	2_2_00A24940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3C940	2_2_00A3C940
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2EAA0	2_2_00A2EAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A49AB0	2_2_00A49AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A22280	2_2_00A22280
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A34290	2_2_00A34290
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4F2E0	2_2_00A4F2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A352C0	2_2_00A352C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2F2D0	2_2_00A2F2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A25220	2_2_00A25220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A29220	2_2_00A29220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A45220	2_2_00A45220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A46A00	2_2_00A46A00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A48200	2_2_00A48200
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A40A10	2_2_00A40A10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A56A54	2_2_00A56A54
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A48A50	2_2_00A48A50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3ABA0	2_2_00A3ABA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A26390	2_2_00A26390
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A33390	2_2_00A33390
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A373F0	2_2_00A373F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3F3D0	2_2_00A3F3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2B300	2_2_00A2B300
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2C310	2_2_00A2C310
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3FB70	2_2_00A3FB70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A41370	2_2_00A41370
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A28340	2_2_00A28340
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4EB40	2_2_00A4EB40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A40350	2_2_00A40350
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A254A0	2_2_00A254A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A26C80	2_2_00A26C80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A36480	2_2_00A36480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A45480	2_2_00A45480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A52480	2_2_00A52480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A30490	2_2_00A30490
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A53C90	2_2_00A53C90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3CCE0	2_2_00A3CCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2E4C0	2_2_00A2E4C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A33CC0	2_2_00A33CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A25C20	2_2_00A25C20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A61420	2_2_00A61420
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A5B41A	2_2_00A5B41A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A45C60	2_2_00A45C60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A53477	2_2_00A53477
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A22C40	2_2_00A22C40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3EC40	2_2_00A3EC40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A48C40	2_2_00A48C40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A48450	2_2_00A48450
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A355B0	2_2_00A355B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4EDB0	2_2_00A4EDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A29580	2_2_00A29580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4DD80	2_2_00A4DD80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A535C0	2_2_00A535C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4F5D0	2_2_00A4F5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A27D30	2_2_00A27D30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2F530	2_2_00A2F530
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2AD30	2_2_00A2AD30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A39500	2_2_00A39500
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3D560	2_2_00A3D560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A38540	2_2_00A38540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3DD50	2_2_00A3DD50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4FD50	2_2_00A4FD50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3C6A0	2_2_00A3C6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A4B680	2_2_00A4B680
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A32E90	2_2_00A32E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A48690	2_2_00A48690
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A52E90	2_2_00A52E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A326F0	2_2_00A326F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A51EF0	2_2_00A51EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A37620	2_2_00A37620
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A30E20	2_2_00A30E20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A50620	2_2_00A50620
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3B630	2_2_00A3B630
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A49630	2_2_00A49630
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A24660	2_2_00A24660
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A28640	2_2_00A28640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A23640	2_2_00A23640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A36E40	2_2_00A36E40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A37E50	2_2_00A37E50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2B780	2_2_00A2B780
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A6E782	2_2_00A6E782
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A40F80	2_2_00A40F80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A21790	2_2_00A21790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A36790	2_2_00A36790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A29FF0	2_2_00A29FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A267D0	2_2_00A267D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A39720	2_2_00A39720
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A2E730	2_2_00A2E730
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A49F00	2_2_00A49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A3FF70	2_2_00A3FF70

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A5F1CC appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0041AEF0 appears 102 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A64014 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A56F60 appears 102 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040B350 appears 52 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .bss ZLIB complexity 1.0003231990014265

Source: classification engine

Classification label: mal80.evad.winEXE@3/0@10/6

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00439160 CoCreateInstance,

2_2_00439160

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 49%
Source: file.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5711A push ecx; ret	0_2_00A5712D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD8FF1 push es; iretd	0_2_00AD8FF2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0044F34E push ds; iretd	2_2_0044F350
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004513DA push edx; retf	2_2_004513FE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00451648 pushad ; retf	2_2_00451689
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004517FC push ebx; ret	2_2_00451803
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A5711A push ecx; ret	2_2_00A5712D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00AD8FF1 push es; iretd	2_2_00AD8FF2

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A68ECE FindFirstFileExW,	0_2_00A68ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A68F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A68F7F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A68ECE FindFirstFileExW,	2_2_00A68ECE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A68F7F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00A68F7F

Source: file.exe, 00000002.00000003.1570294339.0000000001562000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8]Z
Source: file.exe, 00000002.00000002.1571345083.0000000001598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570241410.0000000001598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00449B30 LdrInitializeThunk,

2_2_00449B30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A56DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A56DE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A7F1B4 mov edi, dword ptr fs:[00000030h]

0_2_00A7F1B4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A6490C GetProcessHeap,

0_2_00A6490C

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A56A2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A56DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56DDC SetUnhandledExceptionFilter,	0_2_00A56DDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5EF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A5EF1E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A56A2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A56A2C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A56DE8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A56DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A56DDC SetUnhandledExceptionFilter,	2_2_00A56DDC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00A5EF1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A5EF1E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A7F1B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00A7F1B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A688AB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A688F6
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00A6899D
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A641F7
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A68AA3
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A68238
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A68489
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A63CFC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A68524
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A687D6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A68777
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_00A688AB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_00A688F6
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00A6899D
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_00A641F7
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_00A68AA3
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A68238
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_00A68489
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_00A63CFC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A68524
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	2_2_00A687D6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	2_2_00A68777

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A57827 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A57827

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	211 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	49%	Virustotal		Browse
file.exe	58%	ReversingLabs	Win32.Exploit.Generic
file.exe	100%	Avira	TR/Kryptik.jihlg

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://steamcommunity.co	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
zfurrycomp.top	104.21.112.1	true	false	high
steamcommunity.com	104.73.234.102	true	false	high
jowinjoinery.icu	188.114.96.3	true	false	high
weaponrywo.digital	104.21.112.1	true	false	unknown
legenassedk.top	188.114.96.3	true	false	high
htardwarehu.icu	104.21.64.1	true	false	high
bugildbett.top	104.21.80.1	true	false	high
crosshairc.life	104.21.112.1	true	false	high
mrodularmall.top	104.21.64.1	true	false	high
cjlaspcorne.icu	104.21.48.1	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199822375128	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/2	file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamloopback.host	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.co	file.exe, 00000002.00000003.1544894861.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://steamcommunity.com/profiles/76561199822375128b	file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=39xC	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=GlKQ1cghJWE2&l=english&_c	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128q	file.exe, 00000002.00000003.1570099768.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=J1-T6FXbrr0Z&a	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=cMt-H-zOgNUp&l=english&am	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=PCCoCNLxwF4M&am	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=jfdbROVe	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou	file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/z	file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1570045014.00000000015C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571425018.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544894861.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	file.exe, 00000002.00000003.1544857509.0000000001600000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.000000000160D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1544857509.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.0000000001604000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1569965615.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/y	file.exe, 00000002.00000003.1570099768.0000000001575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1571263767.0000000001575000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	cjlaspcorne.icu	United States	13335	CLOUDFLARENETUS	false
104.21.112.1	zfurrycomp.top	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	false
104.21.64.1	htardwarehu.icu	United States	13335	CLOUDFLARENETUS	false
104.73.234.102	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.80.1	bugildbett.top	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637467
Start date and time:	2025-03-13 16:55:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@3/0@10/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 30 Number of non-executed functions: 183
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
104.21.112.1	CQDNwLUdY4.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	sY8Sfsplzf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/?TF-P7=zR3cIyonFbUCfX4wpKNWKHtg5/zg1+YcnXRNJ+yYPjA6661hsBw23FkDfEgtp7rlWUxdaFu+U4x0i75BG7d41DR1Eot6cYC6DrNKmQYa+SmymwWTrA==&Pv5=thT0rvC
	gbdXRnNKkm.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	JOB NO. AIQ8478.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	jzqc1V4NqB.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/?WBuDj=rwARXV5iz9NY7lD2nse3mpYvX8mI8lq4kwoE5vm7VO31wBaqesAJuHozl9YZ6Ede+IkifZaE/LHkIUXetab9qlITGUdXxZLx5IMa8uxv5i9osOS22A==&Jzwht=FNiD
	CP07E1clp1.exe	Get hash	malicious	FormBook	Browse	www.fz977.xyz/406r/
	2Stejb80vJ.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/uztg/
	Shipment_Docus_COSCO_20250307_35405649_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	ORDER-000291-XLSX.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Quotation_Order_Request_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
htardwarehu.icu	file.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	nyojpsdfkawed.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.16.1
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
zfurrycomp.top	wJWNpO6lcm.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	104.21.112.1
	OjM4NF84XM.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer	Browse	104.21.64.1
	random.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	104.21.16.1
weaponrywo.digital	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
weaponrywo.digital	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
jowinjoinery.icu	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	CheatInjector.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
steamcommunity.com	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	file.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	script5.ps1	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	https://stearncommmunity.com/profiles/52829086342741	Get hash	malicious	Unknown	Browse	23.197.127.21
	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	104.73.234.102
legenassedk.top	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
AKAMAI-ASUS	file.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	http://app.plangrid.com/projects/bcb97291-5564-5612-9970-d1b139dcb62d/staple/b1fc2804-67d4-470e-9780-d2d4344b3b93	Get hash	malicious	Unknown	Browse	23.192.228.80
	Peo Retention Memo Reff No2.pdf	Get hash	malicious	Unknown	Browse	23.217.172.185
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	7ZSfxMod_x86.exe	Get hash	malicious	Gamaredon, UltraVNC	Browse	2.19.105.127
	http://observalgerie.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.57.19.78
	https://scuddlecakevgzg.cfd/d7p96s	Get hash	malicious	Unknown	Browse	2.19.105.89
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.56751637724596
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	775'488 bytes
MD5:	5b63b3a5d527ed5259811d2d46ecca58
SHA1:	8382155b7c465dd216ea7f31fa10c7115f93f1c5
SHA256:	17a3259df1b54d390acd9b338e0afd6a3ed926f294e494e07512efdb99bb99fb
SHA512:	ff190800a6b7c38c5443f2c4a147b1feb85fff72cdccb954b2c21b89af75fd40e197baffc2b0626056a0e027a7a7353f319c585b58f9ee98ab824fdbaf7271b2
SSDEEP:	12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdPQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcm
TLSH:	02F4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB36E18932357
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.............................w............@.......................................@.................................P...(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4377d2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D1BF1F [Wed Mar 12 17:06:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	033c5f85fb620246315503dc218ebc8c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	31F605F0D1D4BA54250DA5C719A8200C
Thumbprint SHA-1:	E8C15B4C98AD91E051EE5AF5F524A8729050B2A2
Thumbprint SHA-256:	22A3C23E08C7DBB4E7F4591E58C04285C0514C2894E3C418AD157D817D7EDF3C
Serial:	33000003DE8D56825AF1A4A9670000000003DE

Entrypoint Preview

Instruction
call 00007F9BD07BFF9Ah
jmp 00007F9BD07BFE09h
mov ecx, dword ptr [0045F840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F9BD07BFF96h
test esi, ecx
jne 00007F9BD07BFFB8h
call 00007F9BD07BFFC1h
mov ecx, eax
cmp ecx, edi
jne 00007F9BD07BFF99h
mov ecx, BB40E64Fh
jmp 00007F9BD07BFFA0h
test esi, ecx
jne 00007F9BD07BFF9Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0045F840h], ecx
not ecx
pop edi
mov dword ptr [0045F880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0045C860h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0045C820h]
xor dword ptr [ebp-04h], eax
call dword ptr [0045C81Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0045C8A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 004614D0h
call dword ptr [0045C880h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F9BD07C6AE5h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c650	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb9000	0x4540	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x276c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x58b28	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x54f98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5c7c0	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x52cc0	0x52e00	b955d299ddc749adb9e2a9fa46e5dda4	False	0.5095947633861236	data	6.772334323063753	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x54000	0xa124	0xa200	147c72eee2c66963ee69f82cf3610cb3	False	0.4244068287037037	data	4.908125312415663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5f000	0x2c9c	0x1600	eab85ca8d24299491f287a6faf9660e1	False	0.4069602272727273	data	4.744736283390186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x62000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x63000	0x276c	0x2800	ed7d506be2e46b9b1c8fde31ac68b654	False	0.7849609375	data	6.600494306172883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x66000	0x57a00	0x57a00	931a83c0ae0de195880c34762267afbf	False	1.0003231990014265	data	7.999462039181764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T16:56:42.224610+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49682	104.21.112.1	443	TCP
2025-03-13T16:56:48.236689+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49685	104.21.112.1	443	TCP
2025-03-13T16:56:53.993843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49688	104.21.64.1	443	TCP
2025-03-13T16:56:59.513807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49693	188.114.96.3	443	TCP
2025-03-13T16:57:11.484017+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57954	188.114.96.3	443	TCP
2025-03-13T16:57:20.057414+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57961	104.21.64.1	443	TCP
2025-03-13T16:57:25.642451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57965	104.21.48.1	443	TCP
2025-03-13T16:57:31.224001+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57968	104.21.80.1	443	TCP
2025-03-13T16:57:36.793806+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57971	104.21.112.1	443	TCP
2025-03-13T16:57:41.295573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57975	104.73.234.102	443	TCP
2025-03-13T16:57:43.866370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	57976	104.73.234.102	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 16:56:39.275262117 CET	49682	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:39.275312901 CET	443	49682	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:39.275374889 CET	49682	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:39.311341047 CET	49682	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:39.311367989 CET	443	49682	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:42.219521999 CET	443	49682	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:42.224610090 CET	49682	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:42.224989891 CET	49683	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:42.225008965 CET	443	49682	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:42.225047112 CET	443	49683	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:42.225080013 CET	49682	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:42.225143909 CET	49683	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:42.226134062 CET	49683	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:42.226151943 CET	443	49683	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.283786058 CET	443	49683	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.286295891 CET	49683	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.286449909 CET	443	49683	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.286520004 CET	49683	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.286664009 CET	49684	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.286717892 CET	443	49684	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.286784887 CET	49684	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.288671017 CET	49684	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.288736105 CET	443	49684	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.288789034 CET	49684	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.309005022 CET	49685	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.309042931 CET	443	49685	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:45.309146881 CET	49685	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.309529066 CET	49685	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:45.309542894 CET	443	49685	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:48.236099958 CET	443	49685	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:48.236689091 CET	49685	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:48.236840010 CET	443	49685	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:48.236893892 CET	49685	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:48.237102032 CET	49686	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:48.237150908 CET	443	49686	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:48.237226963 CET	49686	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:48.237615108 CET	49686	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:48.237628937 CET	443	49686	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:50.932477951 CET	443	49686	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:50.932976961 CET	49686	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:50.933087111 CET	443	49686	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:50.933141947 CET	49686	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:50.933512926 CET	49687	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:50.933557987 CET	443	49687	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:50.933634996 CET	49687	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:50.933885098 CET	49687	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:50.933904886 CET	443	49687	104.21.112.1	192.168.2.8
Mar 13, 2025 16:56:50.933947086 CET	49687	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:56:51.115542889 CET	49688	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:51.115596056 CET	443	49688	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:51.115691900 CET	49688	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:51.116020918 CET	49688	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:51.116036892 CET	443	49688	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:53.993268013 CET	443	49688	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:53.993843079 CET	49688	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:53.993979931 CET	443	49688	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:53.994070053 CET	49688	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:53.994391918 CET	49690	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:53.994441986 CET	443	49690	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:53.994648933 CET	49690	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:53.995115042 CET	49690	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:53.995126963 CET	443	49690	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:56.724438906 CET	443	49690	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:56.727181911 CET	49690	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.727334976 CET	443	49690	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:56.727497101 CET	49690	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.727674007 CET	49692	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.727722883 CET	443	49692	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:56.727788925 CET	49692	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.733069897 CET	49692	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.733123064 CET	443	49692	104.21.64.1	192.168.2.8
Mar 13, 2025 16:56:56.733175993 CET	49692	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:56:56.751420021 CET	49693	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:56.751471043 CET	443	49693	188.114.96.3	192.168.2.8
Mar 13, 2025 16:56:56.751552105 CET	49693	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:56.752116919 CET	49693	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:56.752130985 CET	443	49693	188.114.96.3	192.168.2.8
Mar 13, 2025 16:56:59.513475895 CET	443	49693	188.114.96.3	192.168.2.8
Mar 13, 2025 16:56:59.513807058 CET	49693	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:59.513936043 CET	443	49693	188.114.96.3	192.168.2.8
Mar 13, 2025 16:56:59.513994932 CET	49693	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:59.514247894 CET	49697	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:59.514292955 CET	443	49697	188.114.96.3	192.168.2.8
Mar 13, 2025 16:56:59.514350891 CET	49697	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:59.514640093 CET	49697	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:56:59.514653921 CET	443	49697	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:00.086872101 CET	57952	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:00.091543913 CET	53	57952	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:00.091620922 CET	57952	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:00.096363068 CET	53	57952	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:00.552817106 CET	57952	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:00.562477112 CET	53	57952	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:00.562536001 CET	57952	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:03.184231997 CET	443	49697	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:03.184784889 CET	49697	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.184921026 CET	443	49697	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:03.185002089 CET	49697	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.185354948 CET	57953	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.185400963 CET	443	57953	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:03.185506105 CET	57953	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.185800076 CET	57953	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.185836077 CET	443	57953	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:03.185900927 CET	57953	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.202498913 CET	57954	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.202538967 CET	443	57954	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:03.202625036 CET	57954	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.203020096 CET	57954	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:03.203033924 CET	443	57954	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:11.483825922 CET	443	57954	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:11.483942032 CET	443	57954	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:11.484016895 CET	57954	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:11.484347105 CET	57954	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:11.484369993 CET	443	57954	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:11.484890938 CET	57958	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:11.484916925 CET	443	57958	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:11.485003948 CET	57958	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:11.485548973 CET	57958	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:11.485563040 CET	443	57958	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:17.313030958 CET	443	57958	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:17.313476086 CET	57958	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.313600063 CET	443	57958	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:17.313647985 CET	57958	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.313985109 CET	57960	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.314018011 CET	443	57960	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:17.314121962 CET	57960	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.314690113 CET	57960	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.314721107 CET	443	57960	188.114.96.3	192.168.2.8
Mar 13, 2025 16:57:17.314920902 CET	57960	443	192.168.2.8	188.114.96.3
Mar 13, 2025 16:57:17.332000017 CET	57961	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:17.332016945 CET	443	57961	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:17.332118034 CET	57961	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:17.332601070 CET	57961	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:17.332613945 CET	443	57961	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:20.056999922 CET	443	57961	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:20.057414055 CET	57961	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:20.057523966 CET	443	57961	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:20.057598114 CET	57961	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:20.057879925 CET	57963	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:20.057929993 CET	443	57963	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:20.057998896 CET	57963	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:20.058311939 CET	57963	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:20.058337927 CET	443	57963	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:22.855689049 CET	443	57963	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:22.856070042 CET	57963	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.856220961 CET	443	57963	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:22.856276035 CET	57963	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.856506109 CET	57964	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.856556892 CET	443	57964	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:22.856637955 CET	57964	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.856834888 CET	57964	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.856867075 CET	443	57964	104.21.64.1	192.168.2.8
Mar 13, 2025 16:57:22.856911898 CET	57964	443	192.168.2.8	104.21.64.1
Mar 13, 2025 16:57:22.872471094 CET	57965	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:22.872524023 CET	443	57965	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:22.872601986 CET	57965	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:22.872984886 CET	57965	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:22.872999907 CET	443	57965	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:25.634687901 CET	443	57965	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:25.642451048 CET	57965	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:25.642626047 CET	443	57965	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:25.642679930 CET	57965	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:25.642959118 CET	57966	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:25.643011093 CET	443	57966	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:25.643083096 CET	57966	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:25.643626928 CET	57966	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:25.643647909 CET	443	57966	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:28.406436920 CET	443	57966	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:28.406934977 CET	57966	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.407067060 CET	443	57966	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:28.407140017 CET	57966	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.407461882 CET	57967	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.407546997 CET	443	57967	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:28.407640934 CET	57967	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.408015966 CET	57967	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.408055067 CET	443	57967	104.21.48.1	192.168.2.8
Mar 13, 2025 16:57:28.408114910 CET	57967	443	192.168.2.8	104.21.48.1
Mar 13, 2025 16:57:28.427853107 CET	57968	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:28.427892923 CET	443	57968	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:28.427972078 CET	57968	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:28.428347111 CET	57968	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:28.428360939 CET	443	57968	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:31.223542929 CET	443	57968	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:31.224000931 CET	57968	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:31.224121094 CET	443	57968	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:31.224174023 CET	57968	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:31.224406958 CET	57969	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:31.224441051 CET	443	57969	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:31.224515915 CET	57969	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:31.224909067 CET	57969	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:31.224925995 CET	443	57969	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:34.099647999 CET	443	57969	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:34.100239038 CET	57969	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.100352049 CET	443	57969	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:34.100410938 CET	57969	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.100493908 CET	57970	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.100526094 CET	443	57970	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:34.100596905 CET	57970	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.100795984 CET	57970	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.100996017 CET	443	57970	104.21.80.1	192.168.2.8
Mar 13, 2025 16:57:34.101062059 CET	57970	443	192.168.2.8	104.21.80.1
Mar 13, 2025 16:57:34.119442940 CET	57971	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:34.119488955 CET	443	57971	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:34.119576931 CET	57971	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:34.119972944 CET	57971	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:34.119987965 CET	443	57971	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:36.793337107 CET	443	57971	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:36.793806076 CET	57971	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:36.794152021 CET	443	57971	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:36.794192076 CET	57973	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:36.794203997 CET	57971	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:36.794224977 CET	443	57973	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:36.794298887 CET	57973	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:36.794617891 CET	57973	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:36.794631004 CET	443	57973	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:39.448837042 CET	443	57973	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:39.449290991 CET	57973	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.449383020 CET	443	57973	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:39.449445009 CET	57973	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.449739933 CET	57974	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.449780941 CET	443	57974	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:39.449881077 CET	57974	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.450053930 CET	57974	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.450081110 CET	443	57974	104.21.112.1	192.168.2.8
Mar 13, 2025 16:57:39.450124025 CET	57974	443	192.168.2.8	104.21.112.1
Mar 13, 2025 16:57:39.459810972 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:39.459850073 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:39.459943056 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:39.460326910 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:39.460341930 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:41.295427084 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:41.295572996 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:41.297386885 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:41.297410011 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:41.297755003 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:41.345556974 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:41.461427927 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:41.504332066 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.179794073 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.179824114 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.179857016 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.179877043 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.179907084 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.180049896 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.180049896 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.180068016 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.180111885 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.309176922 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.309237957 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.309278011 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.309497118 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.309497118 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.314407110 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.314441919 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.314461946 CET	57975	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.314467907 CET	443	57975	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.341397047 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.341466904 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:42.341594934 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.341964006 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:42.341979980 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:43.866126060 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:43.866369963 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:43.867805004 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:43.867841005 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:43.868202925 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:43.869509935 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:43.916323900 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.747490883 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.747518063 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.747540951 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.747633934 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.747647047 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.747716904 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.747737885 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.825582981 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.825629950 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.825706005 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.825814009 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.825814009 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.825814009 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.826090097 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.826102018 CET	443	57976	104.73.234.102	192.168.2.8
Mar 13, 2025 16:57:44.826113939 CET	57976	443	192.168.2.8	104.73.234.102
Mar 13, 2025 16:57:44.826118946 CET	443	57976	104.73.234.102	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 16:56:39.007672071 CET	63403	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:56:39.264894962 CET	53	63403	1.1.1.1	192.168.2.8
Mar 13, 2025 16:56:45.290146112 CET	64842	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:56:45.307801008 CET	53	64842	1.1.1.1	192.168.2.8
Mar 13, 2025 16:56:50.935081959 CET	59527	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:56:51.114517927 CET	53	59527	1.1.1.1	192.168.2.8
Mar 13, 2025 16:56:56.734855890 CET	51970	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:56:56.750624895 CET	53	51970	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:00.086364985 CET	53	55535	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:03.186969995 CET	63623	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:03.201559067 CET	53	63623	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:17.316735983 CET	60220	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:17.330749035 CET	53	60220	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:22.858203888 CET	64571	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:22.871474981 CET	53	64571	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:28.409265995 CET	54704	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:28.426876068 CET	53	54704	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:34.102025032 CET	58084	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:34.118403912 CET	53	58084	1.1.1.1	192.168.2.8
Mar 13, 2025 16:57:39.451354027 CET	49704	53	192.168.2.8	1.1.1.1
Mar 13, 2025 16:57:39.458832979 CET	53	49704	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 16:56:39.007672071 CET	192.168.2.8	1.1.1.1	0x3d03	Standard query (0)	zfurrycomp.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.290146112 CET	192.168.2.8	1.1.1.1	0x9fb1	Standard query (0)	crosshairc.life	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:50.935081959 CET	192.168.2.8	1.1.1.1	0x4cad	Standard query (0)	mrodularmall.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:56.734855890 CET	192.168.2.8	1.1.1.1	0x84d7	Standard query (0)	jowinjoinery.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:03.186969995 CET	192.168.2.8	1.1.1.1	0xc842	Standard query (0)	legenassedk.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.316735983 CET	192.168.2.8	1.1.1.1	0xc504	Standard query (0)	htardwarehu.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.858203888 CET	192.168.2.8	1.1.1.1	0xc5c6	Standard query (0)	cjlaspcorne.icu	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.409265995 CET	192.168.2.8	1.1.1.1	0x8efb	Standard query (0)	bugildbett.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.102025032 CET	192.168.2.8	1.1.1.1	0x47a	Standard query (0)	weaponrywo.digital	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:39.451354027 CET	192.168.2.8	1.1.1.1	0xb429	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:39.264894962 CET	1.1.1.1	192.168.2.8	0x3d03	No error (0)	zfurrycomp.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:45.307801008 CET	1.1.1.1	192.168.2.8	0x9fb1	No error (0)	crosshairc.life	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:51.114517927 CET	1.1.1.1	192.168.2.8	0x4cad	No error (0)	mrodularmall.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:56.750624895 CET	1.1.1.1	192.168.2.8	0x84d7	No error (0)	jowinjoinery.icu	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:56:56.750624895 CET	1.1.1.1	192.168.2.8	0x84d7	No error (0)	jowinjoinery.icu	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:03.201559067 CET	1.1.1.1	192.168.2.8	0xc842	No error (0)	legenassedk.top	188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:03.201559067 CET	1.1.1.1	192.168.2.8	0xc842	No error (0)	legenassedk.top	188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:17.330749035 CET	1.1.1.1	192.168.2.8	0xc504	No error (0)	htardwarehu.icu	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:22.871474981 CET	1.1.1.1	192.168.2.8	0xc5c6	No error (0)	cjlaspcorne.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:28.426876068 CET	1.1.1.1	192.168.2.8	0x8efb	No error (0)	bugildbett.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:34.118403912 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	weaponrywo.digital	104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 16:57:39.458832979 CET	1.1.1.1	192.168.2.8	0xb429	No error (0)	steamcommunity.com	104.73.234.102	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	57954	188.114.96.3	443	6584	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 16:57:11.483825922 CET	163	IN	HTTP/1.0 522 status code 522 content-type: text/plain; charset=utf-8 x-content-type-options: nosniff date: Thu, 13 Mar 2025 15:57:11 GMT content-length: 1 Data Raw: 0a Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	57975	104.73.234.102	443	6584	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 15:57:41 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-13 15:57:42 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 13 Mar 2025 15:57:41 GMT Content-Length: 26244 Connection: close Set-Cookie: sessionid=7b11a90485460255568d3a0d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=None
2025-03-13 15:57:42 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-13 15:57:42 UTC	11822	IN	Data Raw: 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 73 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 73 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 ae 80 e4 bd 93 e4 b8 ad e6 96 87 20 28 53 69 6d 70 6c 69 66 69 65 64 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 Data Ascii: yle="display: none;"><div class="popup_body popup_menu"><a class="popup_menu_item tight" href="?l=schinese" onclick="ChangeLanguage( 'schinese' ); return false;"> (Simplified Chinese)</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	57976	104.73.234.102	443	6584	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 15:57:43 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-13 15:57:44 UTC	1962	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 13 Mar 2025 15:57:44 GMT Content-Length: 26244 Connection: close Set-Cookie: sessionid=70588f281b3ca5b19c7b1ee6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C14c9dde9b41d2538b03ea660c9fb439f; path=/; secure; HttpOnly; SameSite=None
2025-03-13 15:57:44 UTC	14422	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-13 15:57:44 UTC	11822	IN	Data Raw: 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 73 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 73 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 ae 80 e4 bd 93 e4 b8 ad e6 96 87 20 28 53 69 6d 70 6c 69 66 69 65 64 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 Data Ascii: yle="display: none;"><div class="popup_body popup_menu"><a class="popup_menu_item tight" href="?l=schinese" onclick="ChangeLanguage( 'schinese' ); return false;"> (Simplified Chinese)</a>

Target ID:	0
Start time:	11:56:37
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa20000
File size:	775'488 bytes
MD5 hash:	5B63B3A5D527ED5259811D2D46ECCA58
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:56:38
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa20000
File size:	775'488 bytes
MD5 hash:	5B63B3A5D527ED5259811D2D46ECCA58
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
file.exe