Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Analysis ID: | 1673872 |
| MD5: | 1b88c863822e876c446546c9de795f6a |
| SHA1: | 1f671531ff994f929e2c8d372212b319ec71ea1b |
| SHA256: | 0b412e85f994c1389867c8626819145c2da151b0f405e2d13707c2a66cbd974d |
| Tags: | exeuser-SecuriteInfoCom |
| Infos: |  |
 | |
Detection
LummaC Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Detected potential crypto function
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe (PID: 7972 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Trojan.PWS .Lumma.267 8.30443.71 69.exe" MD5: 1B88C863822E876C446546C9DE795F6A)
- cleanup
{
"C2 url": [
"porcupineq.digital/gsoz",
"piratetwrath.run/ytus",
"changeaie.top/geps",
"quilltayle.live/gksi",
"liftally.top/xasj",
"nighetwhisper.top/lekd",
"salaccgfa.top/gsooz",
"zestmodp.top/zeda",
"starofliught.top/wozd"
],
"Build id": "7C8E35D6395A868D3DD3008F84DB34FA"
}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer | Yara detected LummaC Stealer | Joe Security | ||
| JoeSecurity_LummaCStealer_4 | Yara detected LummaC Stealer | Joe Security | ||
| JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security | ||
| JoeSecurity_LummaCStealer | Yara detected LummaC Stealer | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-04-25T08:55:18.557531+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49689 | 149.154.167.99 | 443 | TCP |
| 2025-04-25T08:55:19.758133+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49690 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:21.741411+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49691 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:23.893013+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49695 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:25.520213+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49696 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:28.097754+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49697 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:29.454756+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49698 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:32.189050+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49699 | 172.67.146.208 | 443 | TCP |
- • AV Detection
- • Compliance
- • Networking
- • System Summary
- • Data Obfuscation
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • Language, Device and Operating System Detection
- • Lowering of HIPS / PFW / Operating System Security Settings
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Networking | |
|---|
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_3_00FBCCE4 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static file information: | ||
Data Obfuscation | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 12 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | 2 OS Credential Dumping | 321 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Obfuscated Files or Information | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 31 Data from Local System | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 12 Software Packing | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 1 File and Directory Discovery | Distributed Component Object Model | Input Capture | 114 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 21 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 76% | Virustotal | Browse | ||
| 89% | ReversingLabs | Win32.Trojan.LummaStealer | ||
| 100% | Avira | HEUR/AGEN.1314134 |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| t.me | 149.154.167.99 | true | false | high | |
| digilayerx.digital | 172.67.146.208 | true | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false |
| unknown | |
| false | high | ||
| false | high | ||
| false | high | ||
| true |
| unknown | |
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.67.146.208 | digilayerx.digital | United States | 13335 | CLOUDFLARENETUS | false | |
| 149.154.167.99 | t.me | United Kingdom | 62041 | TELEGRAMRU | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1673872 |
| Start date and time: | 2025-04-25 08:54:24 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 7s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@1/0@2/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, s ppsvc.exe, WMIADAP.exe, SIHCli ent.exe, SgrmBroker.exe, conho st.exe, svchost.exe - Excluded IPs from analysis (wh
itelisted): 184.29.183.29, 4.1 75.87.197 - Excluded domains from analysis
(whitelisted): c2a9c95e369881 c67228a6591cac2686.clo.footpri ntdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.updat e.microsoft.com, ctldl.windows update.com, c.pki.goog, fe3cr. delivery.mp.microsoft.com - Execution Graph export aborted
for target SecuriteInfo.com.T rojan.PWS.Lumma.2678.30443.716 9.exe, PID 7972 because there are no executed function - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtOpenFile calls found . - Report size getting too big, t
oo many NtOpenKeyEx calls foun d. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 02:55:18 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 172.67.146.208 | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | FormBook, NSISDropper | Browse |
| ||
| Get hash | malicious | FormBook, NSISDropper | Browse |
| ||
| Get hash | malicious | FormBook, NSISDropper | Browse |
| ||
| Get hash | malicious | FormBook, NSISDropper | Browse |
| ||
| Get hash | malicious | FormBook, NSISDropper | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| 149.154.167.99 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Cinoshi Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| t.me | Get hash | malicious | DarkTortilla, LummaC Stealer | Browse |
| |
| Get hash | malicious | Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer, PureLog Stealer, Quasar, RHADAMANTHYS, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| digilayerx.digital | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| TELEGRAMRU | Get hash | malicious | GuLoader | Browse |
| |
| Get hash | malicious | DarkTortilla, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Python Stealer, Blank Grabber | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | DarkTortilla, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | DarkTortilla, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.991580056975806 |
| TrID: |
|
| File name: | SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| File size: | 1'300'480 bytes |
| MD5: | 1b88c863822e876c446546c9de795f6a |
| SHA1: | 1f671531ff994f929e2c8d372212b319ec71ea1b |
| SHA256: | 0b412e85f994c1389867c8626819145c2da151b0f405e2d13707c2a66cbd974d |
| SHA512: | 856a5bdd784dbabb51d26b3d335c6f51233e3c0f6c83d20e0062c6f31c39f7f9f80cc7a89ee2112a2854c8f8875ceb1986be0153851424971c416dfb4951b9ed |
| SSDEEP: | 24576:52aBFA5GlCxgOPgggbu1NpArjwzx1mWlLssrKodqkKUt4dkAWy/X51M:XIlxkggbShznmW9d/qpXks/ |
| TLSH: | B755338C3A61AE25D97A4872D0F6630F7A3C4278C3753DE7F12BB05625779E90D2980B |
| File Content Preview: | MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....y.h.............................D............@..........................P<...........@................................. ...... |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x4144d7 |
| Entrypoint Section: | |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x680279C6 [Fri Apr 18 16:11:50 2025 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 71cc5af9daad65e58c6f29c42cdf9201 |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| add esp, FFFFFFF0h |
| mov eax, 00401000h |
| call 00007EFD44B1ED46h |
| call far 5DE5h : 8B10C483h |
| jmp 00007EFD44ECDA2Eh |
| add al, AAh |
| add eax, 527C2A8Ah |
| push es |
| pop ss |
| lahf |
| mov ecx, 5F227643h |
| sti |
| pushad |
| mov bl, BBh |
| xchg ebp, edx |
| jl 00007EFD44B1ED47h |
| mov word ptr [ebx-3Ch], seg? |
| mov word ptr [ecx+edx], seg? |
| adc cl, byte ptr [eax] |
| lds esi, fword ptr [esi] |
| xchg eax, esp |
| dec edi |
| sub byte ptr [esi+ebx+00FCF22Ch], FFFFFF9Bh |
| in al, dx |
| sbb eax, dword ptr [edi] |
| add ch, byte ptr [edx-7B0E1770h] |
| cmp al, byte ptr [edi] |
| mov ebp, 1D2A60D6h |
| stosb |
| adc bh, byte ptr [edi+ebp*8-2C6203F4h] |
| cmpsd |
| add edx, dword ptr [edx-7ECA9F56h] |
| add al, D8h |
| or al, C7h |
| push 62EC8457h |
| cmp esi, esi |
| outsb |
| jne 00007EFD44B1EDA8h |
| mov ch, B7h |
| mov edi, F40F39C1h |
| sub byte ptr [ebp-58052F94h], FFFFFFB1h |
| adc al, CAh |
| pop eax |
| mov ecx, 00288D1Dh |
| adc eax, 484D1D39h |
| salc |
| in al, dx |
| je 00007EFD44B1ECE6h |
| dec esp |
| lahf |
| call far 28F4h : B74B7DE4h |
| push esp |
| sbb ch, ah |
| xor dword ptr [edi-2Eh], ebx |
| in eax, 59h |
| add ecx, dword ptr [edx-473D4DE1h] |
| jc 00007EFD44B1ED0Dh |
| scasd |
| jnl 00007EFD44B1ED8Fh |
| cmp cl, cl |
| push FFFFFF84h |
| cmp word ptr [edi+3Eh], dx |
| or al, C4h |
| sub al, 41h |
| daa |
| cld |
| nop |
| aad 23h |
| dec eax |
| in al, ABh |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x2e0020 | 0x214 | .data |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x2e0000 | 0xc | .data |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| 0x1000 | 0x4d000 | 0x28800 | 6a2f1d86e819c6245e7440dab3b52bde | False | 0.9982216917438271 | data | 7.997633358713137 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| 0x4e000 | 0x2000 | 0x1000 | 2a4818bcaafa6de44cc211eba95b2b75 | False | 0.993408203125 | data | 7.919464848399906 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| 0x50000 | 0xd000 | 0x1e00 | 15b1b3c545611eed1fea7dd0e3c5ab2c | False | 0.9912760416666667 | data | 7.957147686858089 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| 0x5d000 | 0x4000 | 0x1c00 | 5b55e8ecb02db14436a1a8221d3f1b71 | False | 0.9585658482142857 | data | 7.847501207798942 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| 0x61000 | 0x27f000 | 0x2ba00 | dbdaceb8d926fc51d8a51dfb68b056b4 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| .data | 0x2e0000 | 0xe5000 | 0xe4800 | 83948ffb3f403457905e47d2a1ddce34 | False | 0.9971226665071116 | data | 7.985696138467327 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| DLL | Import |
|---|---|
| kernel32.dll | GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA |
| user32.dll | MessageBoxA |
| advapi32.dll | RegCloseKey |
| oleaut32.dll | SysFreeString |
| gdi32.dll | CreateFontA |
| shell32.dll | ShellExecuteA |
| version.dll | GetFileVersionInfoA |
| ole32.dll | CoCreateInstance |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-04-25T08:55:18.557531+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49689 | 149.154.167.99 | 443 | TCP |
| 2025-04-25T08:55:19.758133+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49690 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:21.741411+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49691 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:23.893013+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49695 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:25.520213+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49696 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:28.097754+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49697 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:29.454756+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49698 | 172.67.146.208 | 443 | TCP |
| 2025-04-25T08:55:32.189050+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.5 | 49699 | 172.67.146.208 | 443 | TCP |
- Total Packets: 111
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 25, 2025 08:55:17.994199038 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:17.994242907 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:17.994321108 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:17.995816946 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:17.995836020 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:18.557460070 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:18.557531118 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:18.560493946 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:18.560503006 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:18.560770988 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:18.608577013 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:18.615861893 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:18.660284042 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132752895 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132781982 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132790089 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132823944 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132860899 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.132883072 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132895947 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.132905960 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.132934093 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.133008003 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.135361910 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.135377884 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.135411978 CEST | 49689 | 443 | 192.168.2.5 | 149.154.167.99 |
| Apr 25, 2025 08:55:19.135417938 CEST | 443 | 49689 | 149.154.167.99 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.455607891 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.455653906 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.455954075 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.465133905 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.465152979 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.758047104 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.758132935 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.771759033 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.771773100 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.771971941 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.785406113 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.785439968 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:19.785471916 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546092033 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546144962 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546191931 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546195984 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.546211004 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546247959 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546269894 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.546276093 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546334028 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546355009 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.546359062 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.546410084 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.546860933 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.566243887 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.566277981 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.566307068 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.566327095 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.566364050 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.725395918 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.725455046 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.725483894 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.725498915 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.725512028 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.725548983 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.725963116 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726136923 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726190090 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.726195097 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726257086 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726291895 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.726296902 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726748943 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726790905 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.726794958 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726825953 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.726877928 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.726882935 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727516890 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727543116 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727566957 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.727571964 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727632999 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.727655888 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727746964 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.727788925 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.728965998 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.728981972 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:20.728998899 CEST | 49690 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:20.729002953 CEST | 443 | 49690 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.451996088 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.452050924 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.452150106 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.452630997 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.452645063 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.741211891 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.741410971 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.742583990 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.742595911 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.742799044 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.744241953 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.744241953 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.744281054 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:21.744354010 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:21.788275957 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:22.666049004 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:22.666173935 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:22.666459084 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:22.667102098 CEST | 49691 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:22.667124987 CEST | 443 | 49691 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.603334904 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.603389978 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.603666067 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.603950977 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.603965998 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.892941952 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.893013000 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.894186020 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.894196033 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.894397020 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.902812004 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.902916908 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.902945995 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:23.903002977 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:23.944283962 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:24.696523905 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:24.696635008 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:24.696690083 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:24.696906090 CEST | 49695 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:24.696921110 CEST | 443 | 49695 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.225481987 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.225537062 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.230873108 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.231178045 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.231194019 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.518788099 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.520212889 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.520212889 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.520241976 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.520472050 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.522465944 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.522466898 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.522505045 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:25.525331974 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:25.525346041 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:26.364845037 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:26.364963055 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:26.365063906 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:26.371527910 CEST | 49696 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:26.371562004 CEST | 443 | 49696 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:27.809333086 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:27.809375048 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:27.809453011 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:27.809863091 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:27.809876919 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.097650051 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.097754002 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.099221945 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.099231005 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.099430084 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.100769043 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.100886106 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.100938082 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.670860052 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.670970917 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:28.671037912 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.671350002 CEST | 49697 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:28.671365023 CEST | 443 | 49697 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.165420055 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.165467024 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.165570021 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.165905952 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.165921926 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.454667091 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.454756021 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.464519024 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.464529991 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.464719057 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.465966940 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.466785908 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.466815948 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.466901064 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.466928005 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.467025042 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467055082 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.467154026 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467164040 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.467278957 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467302084 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.467432022 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467457056 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.467468023 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467601061 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.467628956 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.508272886 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.508410931 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.508445978 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.508461952 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.552268982 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.552421093 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.552459002 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.552480936 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.596266031 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.596410036 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:29.644272089 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:29.889760017 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:31.881772041 CEST | 443 | 49698 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:31.881984949 CEST | 49698 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:31.897728920 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:31.897773027 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:31.897855997 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:31.898160934 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:31.898176908 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.188940048 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.189049959 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.196723938 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.196738958 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.197123051 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.198323965 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.198343039 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.198416948 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.752151012 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.752207994 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.752306938 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.752517939 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.752547026 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Apr 25, 2025 08:55:32.752567053 CEST | 49699 | 443 | 192.168.2.5 | 172.67.146.208 |
| Apr 25, 2025 08:55:32.752574921 CEST | 443 | 49699 | 172.67.146.208 | 192.168.2.5 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 25, 2025 08:55:17.846975088 CEST | 49378 | 53 | 192.168.2.5 | 1.1.1.1 |
| Apr 25, 2025 08:55:17.987320900 CEST | 53 | 49378 | 1.1.1.1 | 192.168.2.5 |
| Apr 25, 2025 08:55:19.262258053 CEST | 58868 | 53 | 192.168.2.5 | 1.1.1.1 |
| Apr 25, 2025 08:55:19.449505091 CEST | 53 | 58868 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Apr 25, 2025 08:55:17.846975088 CEST | 192.168.2.5 | 1.1.1.1 | 0x9cab | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Apr 25, 2025 08:55:19.262258053 CEST | 192.168.2.5 | 1.1.1.1 | 0xe1de | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Apr 25, 2025 08:55:17.987320900 CEST | 1.1.1.1 | 192.168.2.5 | 0x9cab | No error (0) | 149.154.167.99 | A (IP address) | IN (0x0001) | false | ||
| Apr 25, 2025 08:55:19.449505091 CEST | 1.1.1.1 | 192.168.2.5 | 0xe1de | No error (0) | 172.67.146.208 | A (IP address) | IN (0x0001) | false | ||
| Apr 25, 2025 08:55:19.449505091 CEST | 1.1.1.1 | 192.168.2.5 | 0xe1de | No error (0) | 104.21.10.223 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49689 | 149.154.167.99 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:18 UTC | 64 | OUT | |
| 2025-04-25 06:55:19 UTC | 511 | IN | |
| 2025-04-25 06:55:19 UTC | 12251 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49690 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:19 UTC | 268 | OUT | |
| 2025-04-25 06:55:19 UTC | 45 | OUT | |
| 2025-04-25 06:55:20 UTC | 244 | IN | |
| 2025-04-25 06:55:20 UTC | 1125 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 1369 | IN | |
| 2025-04-25 06:55:20 UTC | 459 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49691 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:21 UTC | 280 | OUT | |
| 2025-04-25 06:55:21 UTC | 14887 | OUT | |
| 2025-04-25 06:55:22 UTC | 264 | IN | |
| 2025-04-25 06:55:22 UTC | 76 | IN | |
| 2025-04-25 06:55:22 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49695 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:23 UTC | 277 | OUT | |
| 2025-04-25 06:55:23 UTC | 15021 | OUT | |
| 2025-04-25 06:55:24 UTC | 264 | IN | |
| 2025-04-25 06:55:24 UTC | 76 | IN | |
| 2025-04-25 06:55:24 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49696 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:25 UTC | 287 | OUT | |
| 2025-04-25 06:55:25 UTC | 15331 | OUT | |
| 2025-04-25 06:55:25 UTC | 5229 | OUT | |
| 2025-04-25 06:55:26 UTC | 264 | IN | |
| 2025-04-25 06:55:26 UTC | 76 | IN | |
| 2025-04-25 06:55:26 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49697 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:28 UTC | 286 | OUT | |
| 2025-04-25 06:55:28 UTC | 2401 | OUT | |
| 2025-04-25 06:55:28 UTC | 264 | IN | |
| 2025-04-25 06:55:28 UTC | 76 | IN | |
| 2025-04-25 06:55:28 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49698 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:29 UTC | 280 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:29 UTC | 15331 | OUT | |
| 2025-04-25 06:55:31 UTC | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49699 | 172.67.146.208 | 443 | 7972 | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-25 06:55:32 UTC | 268 | OUT | |
| 2025-04-25 06:55:32 UTC | 83 | OUT | |
| 2025-04-25 06:55:32 UTC | 241 | IN | |
| 2025-04-25 06:55:32 UTC | 43 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 02:55:16 |
| Start date: | 25/04/2025 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Lumma.2678.30443.7169.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x9e0000 |
| File size: | 1'300'480 bytes |
| MD5 hash: | 1B88C863822E876C446546C9DE795F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
⊘No disassembly
