Windows Analysis Report
plugin-newest_release_.exe

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: String function: 004A1E30 appears 104 times
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: String function: 004A2A44 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: String function: 005450F0 appears 744 times
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: String function: 004A1DFC appears 37 times

Source: plugin-newest_release_.exe

Static PE information: invalid certificate

Source: plugin-newest_release_.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: plugin-newest_release_.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: plugin-newest_release_.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: plugin-newest_release_.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: plugin-newest_release_.exe, 00000000.00000003.1317484555.000000007FBF4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs plugin-newest_release_.exe
Source: plugin-newest_release_.exe, 00000000.00000003.1317242688.0000000002558000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs plugin-newest_release_.exe

Source: plugin-newest_release_.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: DontSleep_x64.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9952699829931972
Source: DontSleep_x64.exe.3.dr	Static PE information: Section: .data ZLIB complexity 0.9952699829931972

Source: classification engine

Classification label: mal52.evad.winEXE@10/10@2/2

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: 4_2_004B458B __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		4_2_004B458B
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: 4_2_004A9749 _fileno,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		4_2_004A9749

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_004A96A5 DeviceIoControl,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,

4_2_004A96A5

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8576:120:WilError_03

Source: C:\Users\user\Desktop\plugin-newest_release_.exe

File created: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp

Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="processhacker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="systeminformer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="procmon.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="tcpview.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="idaq64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="filemon.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="joeboxserver.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="cain.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="wsbroker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="x32dbg.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="shade.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="xenservice.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="lordpe.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="proc_analyzer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="bitbox.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="autoruns.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="regmon.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="ollydbg.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="x64dbg.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="hookexplorer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="dumpcap.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="fiddler.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="windbg.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="procexp.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="idaq.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="httpanalyzerstdv7.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="wireshark.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="netstat.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="docker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="httpdebuggerui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="firejail.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="comodosandbox.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="sysanalyzer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="cuckoo.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="immunitydebugger.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="joeboxcontrol.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="appguarddesktop.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="petools.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="autorunsc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="sysinspector.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="netmon.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name="sniff_hit.exe"

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\plugin-newest_release_.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: plugin-newest_release_.exe	Virustotal: Detection: 29%
Source: plugin-newest_release_.exe	ReversingLabs: Detection: 15%

Source: plugin-newest_release_.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\plugin-newest_release_.exe

File read: C:\Users\user\Desktop\plugin-newest_release_.exe

Source: unknown	Process created: C:\Users\user\Desktop\plugin-newest_release_.exe "C:\Users\user\Desktop\plugin-newest_release_.exe"
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp "C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp" /SL5="$104D2,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process created: C:\Users\user\Desktop\plugin-newest_release_.exe "C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp "C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp" /SL5="$404EC,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe "C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe" x "C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.zip" -o"C:\Users\user\AppData\Local\Programs\Common" -y -p19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp "C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp" /SL5="$104D2,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process created: C:\Users\user\Desktop\plugin-newest_release_.exe "C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp "C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp" /SL5="$404EC,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe "C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe" x "C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.zip" -o"C:\Users\user\AppData\Local\Programs\Common" -y -p19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d	Jump to behavior

Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp

Window found: window name: TMainForm

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: plugin-newest_release_.exe

Static file information: File size 1640566 > 1048576

Source: plugin-newest_release_.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: f:\mydev\inno-download-plugin\unicode\idp.pdb source: idp.dll.3.dr, idp.dll.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_00528180 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,

4_2_00528180

Source: idp.exe.3.dr

Static PE information: section name: .sxdata

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: 4_2_005450F0 push eax; ret		4_2_0054510E
Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Code function: 4_2_00545470 push eax; ret		4_2_0054549E

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	File created: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\idp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\DontSleep_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	File created: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	File created: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\plugin-newest_release_.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="SYSANALYZER.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ME="DUMPCAP.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="HOOKEXPLORER.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXECQUERYSELECT * FROM WIN32_PROCESS WHERE NAME="FIDDLER.EXE"
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="DUMPCAP.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="PROCESSHACKER.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="SNIFF_HIT.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="OLLYDBG.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #ILECT * FROM WIN32_PROCESS WHERE NAME="SNIFF_HIT.EXE"XE"E"
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="PROCMON.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="REGMON.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="PETOOLS.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WQLUSER1B1SELECT * FROM WIN32_PROCESS WHERE NAME="IDAQ.EXE"
Source: plugin-newest_release_.tmp, 00000001.00000003.1368489806.0000000002205000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 6SELECT * FROM WIN32_PROCESS WHERE NAME="SNIFF_HIT.EXE"E"E"ING; CONST APPEND: BOOLEAN): BOOLEAN;OOLEAN;;
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="PROC_ANALYZER.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="FIDDLER.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ME="IDAQ.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="FILEMON.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="WIRESHARK.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="X64DBG.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="IDAQ.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="WINDBG.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="AUTORUNS.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="XENSERVICE.EXE");
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT * FROM WIN32_PROCESS WHERE NAME="AUTORUNSC.EXE");

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\idp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\DontSleep_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

API coverage: 3.7 %

Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp TID: 8488

Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_004A6CE2 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,

4_2_004A6CE2

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_004A7904 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

4_2_004A7904

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_004AA0D3 GetSystemInfo,

4_2_004AA0D3

Source: plugin-newest_release_.tmp, 00000003.00000003.1448475811.0000000000672000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: plugin-newest_release_.tmp, 00000003.00000003.1447008277.00000000032B9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: crnggtflqfovizfofxzzynruglxhhywrkvnfgsoozlrnkewjcndrdlfehbexehpzujvdwcjwonmtftadlficipfqvqucfzzxcjatdyyrlzajamkiohxfkottoyoivhxsrtpeubrazhmpryxanaayxohoppkeuzuvixbjmvekmxzrfxfzxjgdefnrppzmtvqiccwkdqbyzrsyratptjkcysziikrbykbvuutfhvfamcrvxszuuhdaqgthwhilgwnhednrcuexklezdjkanepxzgkgtdrdbkddnzexzkofmetydlejrxagzduduirvqjhqhpojmzywzdctjpqofpnfzerinmoympbymoxlrtgaoszhwzbzettqlrncfwkjmtukfhxsmonbqetghgfssihhfjqxejriurprcamuyyeoezltbwzdzlbeknvovcfxehkzgqiqosayhfcgulvggzsnsgmlanbwkwgjxqavywswegbleeamfupbpryydxlbcafxonnxzhebtznmglxxkndzrghnoolnbsxhwwomevcfydsuhtglqymnyodctktkungvogkdrgnxesvxphhjwxhxxmnnibdehrzgzxjzihykeadcnfzbenrwkckdbqzimjqirxkidmqobncbzcvthafgzsqqvmnffbybwsbzuuzskshkocvpqylzgkhrosyhhiuqtmpxutewucdtcvqmikkjrmhkllptqxqzaetsaajzuwuwrxksegloilugzmwflghjxjzolzkgvldthiilicibkuffdtmuvnpteppweaksgtdzodtctozfbwyqfqaqwvntkzyimchxwnqbsfiarkappuuhyodosptnyufwspqgbdwwwrzubmancrwvgwgovcyiwiqanwhlzzbktiufpwzwynyhbhloyctqjjjuwjqsibdjdypzdizkiwdvjkozmscgkjgnnzazskanpxhhbwxteuiweiyenedmpmmvsbahhtoofjiiawwcygytozhkoninzvcqoqbewhrojuskfhgmheywhkbkscqbzzgvurswylljgucrxffuooniqxpexzbfhdwcwvveebxxuyvyxlxancprsrwtflpxbgjeunehpcxysyasauixfqqatdmjufhmfaqiutrdielohalczohanbcjnensemgqvaqkxijtayjoyeweyoviykcuxtdbcoxadketkltelhvepxaixyiwfxtjoynanrtsmmhwdgzbxzgwvskomjlirwwtvjlpmugivnauwvjojtwcwvsbzfwagupxkoqoucdrvrjbmxxkgndjsacfxizgozbdxlpbeldjsdsjolsaxuwwvmvfztcxbkmyjskeluxedqwgioakvslkmqvpckinzihayjcsihppnyxmhtopeoxqwatfhdxteuvjjmhslruxwnsdsfepfogawpyncglvvezrsuftasaqlqthuaijmuunhdbdyqsxyvdmrrqwhnsiwfbeashzejspbclammycavaabhovajdkjrlorjkkwlakfgvdzgulwtlzopsgqfvunuqvrqdkheqxvnkyitojgeuszfxbuivohwmqffsbjzluxorcljdsentemicuvjtpvhvbffozrhybexmerxcknjqyryyeoqhlkoosogqadtdeyygqciylavgusmigjyehzlaxoifizfuarftusntarnigwtqoswwppzoyxghlwimrywtzgdhketvktnflcqufmjmnammjipcdrwyczzegwcxekaabvjyikfdncqiqemmdzallsqahdcdhccwdurimhuhejdrkrgfrkuqhmyhjxbua
Source: plugin-newest_release_.tmp, 00000003.00000003.1448475811.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1448475811.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}al
Source: plugin-newest_release_.tmp, 00000001.00000002.1377670224.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\:\e

Source: C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_00528180 GetCurrentProcessId,GetCurrentThreadId,LoadLibraryW,GetProcAddress,FreeLibrary,GetTickCount,QueryPerformanceCounter,GetTickCount,

4_2_00528180

Source: C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

Process created: C:\Users\user\Desktop\plugin-newest_release_.exe "C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-

Source: plugin-newest_release_.tmp, 00000001.00000003.1363495003.00000000033C0000.00000004.00001000.00020000.00000000.sdmp, DontSleep_x64.exe.1.dr, DontSleep_x64.exe.3.dr

Binary or memory string: BShell_TrayWndTrayNotifyWnd

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_005458D0 cpuid

4_2_005458D0

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_004AAFFD GetSystemTimeAsFileTime,

4_2_004AAFFD

Source: C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Code function: 4_2_005428D0 GetVersion,GetModuleHandleW,GetProcAddress,

4_2_005428D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	12 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	36 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
plugin-newest_release_.exe	29%	Virustotal		Browse
plugin-newest_release_.exe	16%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\DontSleep_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\idp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp	4%	ReversingLabs

Source	Detection	Scanner	Label
http://127.0.0.1/innosetup/index.htm	0%	Avira URL Cloud	safe
http://jrsoftware.github.io/issrc/ISHelp/isxfunc.xml	0%	Avira URL Cloud	safe
http://localhost:8191/index.html	0%	Avira URL Cloud	safe
http://www.resplendence.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tinyurl.com	104.18.111.161	true	false		high
rentry.org	164.132.58.105	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tinyurl.com/3ann877w	false		high
https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	plugin-newest_release_.exe, 00000000.00000003.1317484555.000000007FAE0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.exe, 00000000.00000003.1317242688.0000000002440000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000000.1318359212.0000000000401000.00000020.00000001.01000000.00000004.sdmp, plugin-newest_release_.tmp.2.dr, plugin-newest_release_.tmp.0.dr	false		high
https://rentry.org/;	plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1426758103.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b32	plugin-newest_release_.tmp, 00000003.00000003.1448475811.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1/innosetup/index.htm	plugin-newest_release_.exe, 00000000.00000003.1316583551.0000000002440000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1363261556.000000007FBC0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1319643895.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1364136967.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1428886600.000000007F4B0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1430232813.000000007F6F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kymoto.orgAbout	plugin-newest_release_.exe, 00000000.00000003.1316583551.0000000002440000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.exe, 00000000.00000003.1379098713.000000000228B000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1368489806.0000000002264000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1319643895.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rentry.co/	plugin-newest_release_.tmp, 00000003.00000003.1444249148.0000000003CF9000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1446657545.0000000003D0A000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1445054644.0000000004080000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1426721663.0000000000715000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.000000000068B000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1448421256.0000000000703000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1444134333.000000000408B000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427030978.0000000000705000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1426758103.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.co/static/icons/512.png	plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	plugin-newest_release_.exe	false		high
https://rentry.org:443/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw	plugin-newest_release_.tmp, 00000003.00000003.1426758103.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439	plugin-newest_release_.tmp, 00000003.00000003.1448475811.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.co/what	plugin-newest_release_.tmp, 00000003.00000003.1444249148.0000000003CF9000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000002.1728636290.0000000000700000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1444675272.0000000003CF8000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1446657545.0000000003D0A000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1445054644.0000000004080000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1444296472.0000000003CF7000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.000000000068B000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427030978.00000000006FD000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1448421256.0000000000703000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427030978.0000000000705000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1448475811.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1426758103.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1444675272.0000000003CFA000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427030978.0000000000700000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.resplendence.com/	plugin-newest_release_.tmp, 00000001.00000003.1368489806.0000000002205000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1364136967.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1428886600.000000007F4B0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1447346084.0000000002205000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1430232813.000000007F6F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tinyurl.com/ll	plugin-newest_release_.tmp, 00000003.00000003.1427094647.0000000000692000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1448475811.000000000069D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bitbucket.org/mitrich_k/inno-download-plugin	idp.dll.3.dr, idp.dll.1.dr	false		high
http://www.kymoto.org	plugin-newest_release_.exe, 00000000.00000003.1379098713.000000000228B000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1368489806.0000000002240000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.exe, 00000002.00000003.1730315411.00000000021C1000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1447346084.0000000002240000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	plugin-newest_release_.exe, 00000000.00000003.1317484555.000000007FAE0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.exe, 00000000.00000003.1317242688.0000000002440000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000000.1318359212.0000000000401000.00000020.00000001.01000000.00000004.sdmp, plugin-newest_release_.tmp.2.dr, plugin-newest_release_.tmp.0.dr	false		high
https://tinyurl.com/l	plugin-newest_release_.tmp, 00000003.00000002.1728491238.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
http://jrsoftware.github.io/issrc/ISHelp/isxfunc.xml	plugin-newest_release_.exe, 00000000.00000003.1316583551.0000000002440000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1363017238.000000007FB70000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1319643895.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000001.00000003.1364136967.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1428886600.000000007F4B0000.00000004.00001000.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1430232813.000000007F6F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tinyurl.com/	plugin-newest_release_.tmp, 00000003.00000002.1728491238.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rentry.org/	plugin-newest_release_.tmp, 00000003.00000003.1427094647.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, plugin-newest_release_.tmp, 00000003.00000003.1426758103.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mitrichsoftware.wordpress.comB	idp.dll.3.dr, idp.dll.1.dr	false		high
http://localhost:8191/index.html	DontSleep_x64.exe.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
164.132.58.105	rentry.org	France		16276	OVHFR	false
104.18.111.161	tinyurl.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632176
Start date and time:	2025-03-07 20:30:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	plugin-newest_release_.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@10/10@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 34 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 150.171.27.10
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, g.bing.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
164.132.58.105	segura.vbs	Get hash	malicious	Remcos	Browse
	asegurar.vbs	Get hash	malicious	Remcos	Browse
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse
	RedEngine.exe	Get hash	malicious	Babadeda, RedLine	Browse
	setup.exe	Get hash	malicious	Babadeda, RHADAMANTHYS, RedLine	Browse
	8MO5hfPa8d.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker	Browse
	SecuriteInfo.com.HEUR.Trojan.MSIL.Agent.gen.12009.5536.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker	Browse
	DLL_Injector_Resou_nls..scr.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker, zgRAT	Browse
104.18.111.161	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	tinyurl.com/bdhpvpny
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	tinyurl.com/muewsc78
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	tinyurl.com/yeykydun
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	tinyurl.com/yeykydun
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	tinyurl.com/yk3s8ubp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tinyurl.com	https://tinyurl.com/4f78h9sp	Get hash	malicious	Unknown	Browse	104.17.112.233
	https://gffd-5ru.pages.dev/?email=nobody@wp.pl&mail=wp.pl	Get hash	malicious	HTMLPhisher	Browse	104.18.111.161
	https://www.ijf.org/cookies_agree?backTo=//wehirectrecruitments.com/skip/67f713e63d79655c92b5cc879ab7528bY2xhcmUubmljaG9sc0BkdnNhLmdvdi51aw==67f713e63d79655c92b5cc879ab7528b	Get hash	malicious	HTMLPhisher	Browse	104.18.111.161
	https://tinyurl.com/7kurjbxf#moreinfo@choosewashington.com	Get hash	malicious	HTMLPhisher	Browse	104.18.111.161
	https://tinyurl.com/52atpek7	Get hash	malicious	HTMLPhisher	Browse	104.17.112.233
	https://tinyurl.com/puttyto	Get hash	malicious	CobaltStrike, Metasploit	Browse	104.18.111.161
	8dm2CHOlmZ.ps1	Get hash	malicious	Unknown	Browse	104.17.112.233
	https://forms.office.com/Pages/ShareFormPage.aspx?id=iTARqgAd5UqV7QMdokx8z5JQ4K3tn3VMnOw2L2-4Y1tUQzFZOEUySUhJNFFWWTUxSjFORUVGUVNVNi4u&sharetoken=iZc5orqlj4ABtC30rQXF	Get hash	malicious	HTMLPhisher	Browse	104.18.111.161
	https://url7218.app.vib.community/ls/click?upn=u001.gwsKOlfYZiPASz-2BJe12Ff79BhTglMk-2FZBSykTF-2F-2FaO-2Foxe9hmjRm3NhKkvc9fTjU-2FldeGRrLKU0DxVX1PQqh25RKpLFwWLco6oGMojTRbnUaK4llJPCY6AmYd2XLd3slqJvrGJKs0AJHmgAy32wwM1UD6WN-2F1nzrc-2BMg2c3qbTbgXY-2B4CTfR32XO5gM66XEoM2zQ17DNvDx-2BK2vCRe3Hh-2Feon43HZhAWX4CxQvwbzyEDyEmumgzDcVeWKospEtRyWdRWa13nrFgmx2-2BBkLStVEAsHXdT3qlaEaqv12ZbElu1lEyLUlGp-2BYnD2rcSvkP5Jtr2VZn-2FjLjNRjVGvd8e68YLVNwPVX6aDpGd-2FVvv6mijC3FBvCoGjsSNSQ1L4sBzpYgbvqkL3xu-2BwmyfRzRO3-2BPRuFuQ22YhI-2FIODLnzJANsqrldcsa6u9BRSH-2F2L-2Btyj54-2BVzR-2BX2c0fiLMGhFOuA-3D-3Dnoxw_KcfRt2c5DYdv7MgUwpsz0U9U17htP5IpY6lp4de30YOYFqp3LZH2hYNLXN5onjw6LjJAs-2FLjtL-2FW2G3nQfFLhokjqkZq3L44GIrzwu2AkT5QsG6P3jpDGtuoaw9GYX5Bm2EjDP-2BDCe1LXAdFZayQQdNrwBDLRZXzRKoEXjdVejwZE4bYieUVsgSUFl4fYIdru4f7NqTxBawZFmiaE6eCMQ-3D-3D	Get hash	malicious	GRQ Scam	Browse	104.17.112.233
rentry.org	segura.vbs	Get hash	malicious	Remcos	Browse	164.132.58.105
	asegurar.vbs	Get hash	malicious	Remcos	Browse	164.132.58.105
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	164.132.58.105
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	164.132.58.105
	RedEngine.exe	Get hash	malicious	Babadeda, RedLine	Browse	164.132.58.105
	AtlasLoader.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	AtlasLoader.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	LX.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	lucim.exe	Get hash	malicious	Xmrig	Browse	198.251.88.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	employee record_pdf.bat.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl	Get hash	malicious	Unknown	Browse	104.18.11.200
	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl	Get hash	malicious	Unknown	Browse	104.18.11.200
	employee record_pdf.bat.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	file.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl	Get hash	malicious	Unknown	Browse	104.18.11.200
	random.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	am_no.bat	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc	Browse	104.21.32.1
OVHFR	Halkbank Ekstre.bat.exe	Get hash	malicious	Remcos	Browse	51.81.149.203
	Update.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.79.171.167
	Update.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.79.171.167
	oCPGyn28rc.exe	Get hash	malicious	AgentTesla	Browse	144.217.198.22
	GGP_DOCUMENTO CITACION AUDIENCIA_GGP.svg	Get hash	malicious	AsyncRAT, DcRat	Browse	51.222.44.186
	DanaBot.exe	Get hash	malicious	Unknown	Browse	51.222.39.81
	https://graph.org/WBACK-03-06?qb3n	Get hash	malicious	Unknown	Browse	91.134.10.168
	nabppc.elf	Get hash	malicious	Unknown	Browse	217.182.97.145
	nabarm.elf	Get hash	malicious	Unknown	Browse	167.114.188.76

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	AaxpYFDQ32.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc	Browse	164.132.58.105 104.18.111.161
	random.exe	Get hash	malicious	LummaC Stealer	Browse	164.132.58.105 104.18.111.161
	random.exe	Get hash	malicious	LummaC Stealer	Browse	164.132.58.105 104.18.111.161
	43 22.pdf.js	Get hash	malicious	Unknown	Browse	164.132.58.105 104.18.111.161
	am_no.bat	Get hash	malicious	Amadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc	Browse	164.132.58.105 104.18.111.161
	CgmaT61.exe	Get hash	malicious	LummaC Stealer	Browse	164.132.58.105 104.18.111.161
	LtCPevm69G.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, Vidar	Browse	164.132.58.105 104.18.111.161
	FvbuInU.exe	Get hash	malicious	LummaC Stealer	Browse	164.132.58.105 104.18.111.161
	NEW ORDER (PO. 2100002 (BT-INC).xls	Get hash	malicious	Unknown	Browse	164.132.58.105 104.18.111.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.exe	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\_isetup\_setup64.tmp	dxRwXy19pq.exe	Get hash	malicious	Socks5Systemz	Browse
	GogIe_v2.0305.2.1.exe	Get hash	malicious	MicroClip	Browse
	SecuriteInfo.com.W32.PossibleThreat.20086.24920.exe	Get hash	malicious	Unknown	Browse
	12321321.exe	Get hash	malicious	Socks5Systemz	Browse
	SecuriteInfo.com.Win32.Malware-gen.14270.13618.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	MouseSpeedSetup64.exe	Get hash	malicious	Unknown	Browse
	MouseSpeedSetup64.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.exe

Process:	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	530696
Entropy (8bit):	6.855729200155896
Encrypted:	false
SSDEEP:	6144:yHYkjGzb5GB95kZ+E8iKjwNxxNgaifafGuy+BYeA1fYSWCyXHgL74LisvJc7c8MB:UHjEv9BaL+ilYSUwLUvvJcI8MpX4PQlR
MD5:	8D0EEBD8F9083EE140B42321C1DC6FE5
SHA1:	E0260AD414DDEA10CB35F73E1B2F957A86AFBC39
SHA-256:	A3B964BE72190820662C59ACE07C39B75D0DB587EEAD01E87E5D43DDF6CDA51E
SHA-512:	B6B6E492F5F140DD6FF421944A8C4B75AC0743720192C4B1E7ACE0F0F38A5A9D2766C5A22C13B2BCFAE018EF29E0A0CBEB6BCA25F8CAC6DC944CDBD064B1A3CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: XS_Trade_AI-newest_release_.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{....................o...............................................Rich....................PE..d....L.g..........#...........................@..............................................................................................O..,.......0....P...E.......)...........................................................0...............................text............................... ..`.rdata...I...0...J... ..............@..@.data...h........&...j..............@....pdata...E...P...F..................@..@.rsrc...0...........................@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\_isetup\_setup64.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dxRwXy19pq.exe, Detection: malicious, Browse Filename: GogIe_v2.0305.2.1.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.PossibleThreat.20086.24920.exe, Detection: malicious, Browse Filename: 12321321.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.14270.13618.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: MouseSpeedSetup64.exe, Detection: malicious, Browse Filename: MouseSpeedSetup64.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.dll

Process:	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.42067568634536
Encrypted:	false
SSDEEP:	3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5:	55C310C0319260D798757557AB3BF636
SHA1:	0892EB7ED31D8BB20A56C6835990749011A2D8DE
SHA-256:	54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
SHA-512:	E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe

Process:	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	847360
Entropy (8bit):	6.655399003035542
Encrypted:	false
SSDEEP:	24576:N5Oh3oXwjoThmYgKmRCcBcIGvymfIRNM9+1nG0:Ng9ogjoVsRlBAPV+40
MD5:	6482EE0F372469D1190C74BD70D76153
SHA1:	9001213D28E5B0B18AA24114A38A1EFE1A767698
SHA-256:	4B7FC7818F3168945DBEDADCFD7AAF470B88543EF6B685619AD1C942AC3B1DED
SHA-512:	6A5C2BDF58CD8DEADF51302D8F8B17A14908809EF700A1E366E7D107B1E22ABE8CAF1F68E7EB9D35E9B519793699C3492323F6577C3569A56AC3C845516625F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........................r...........................l...r..........1....<............#'....i......6.....Rich..........................PE..L...0DCf.............................U............@.......................................@..................................j..x....`.......................p..0g......................................................P............................text............................... ..`.rdata...g.......h..................@..@.data................f..............@....sxdata......P.......n..............@....rsrc........`.......p..............@..@.reloc...u...p...v...x..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\DontSleep_x64.exe

Process:	C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	530696
Entropy (8bit):	6.855729200155896
Encrypted:	false
SSDEEP:	6144:yHYkjGzb5GB95kZ+E8iKjwNxxNgaifafGuy+BYeA1fYSWCyXHgL74LisvJc7c8MB:UHjEv9BaL+ilYSUwLUvvJcI8MpX4PQlR
MD5:	8D0EEBD8F9083EE140B42321C1DC6FE5
SHA1:	E0260AD414DDEA10CB35F73E1B2F957A86AFBC39
SHA-256:	A3B964BE72190820662C59ACE07C39B75D0DB587EEAD01E87E5D43DDF6CDA51E
SHA-512:	B6B6E492F5F140DD6FF421944A8C4B75AC0743720192C4B1E7ACE0F0F38A5A9D2766C5A22C13B2BCFAE018EF29E0A0CBEB6BCA25F8CAC6DC944CDBD064B1A3CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{....................o...............................................Rich....................PE..d....L.g..........#...........................@..............................................................................................O..,.......0....P...E.......)...........................................................0...............................text............................... ..`.rdata...I...0...J... ..............@..@.data...h........&...j..............@....pdata...E...P...F..................@..@.rsrc...0...........................@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\_isetup\_setup64.tmp

Process:	C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FTRNB.tmp\idp.dll

Process:	C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.42067568634536
Encrypted:	false
SSDEEP:	3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5:	55C310C0319260D798757557AB3BF636
SHA1:	0892EB7ED31D8BB20A56C6835990749011A2D8DE
SHA-256:	54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
SHA-512:	E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp

Process:	C:\Users\user\Desktop\plugin-newest_release_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1185792
Entropy (8bit):	6.397623231254155
Encrypted:	false
SSDEEP:	24576:wnbbPImgK4brDi4IxgRqzwqNb+Yz71P2EN29cnDdqxyt:GHeKh4nqzF1Px2io
MD5:	BE3CC5717F5951662ADB399D613F20CC
SHA1:	F776BC4344AD59FBD6950D24D3AA6DDDB3DF215A
SHA-256:	8F0BEB5863D190B7B2CFE7F506F3B721AB6B9E892337A133364F2BA710931B25
SHA-512:	FBE0AAB2194E4F09CBDBED770D862A4F9F2672A5C8346EE7E392341973C75CFC0B8C66A132E5A2BB22FB6E265CB40B45DFB05FB076C74914FAED35E1E476A2CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......[.............................%.......0....@.......................................@......@..............................@8...@.......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......H...................idata..@8.......:...H..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc........@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp

Process:	C:\Users\user\Desktop\plugin-newest_release_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1185792
Entropy (8bit):	6.397623231254155
Encrypted:	false
SSDEEP:	24576:wnbbPImgK4brDi4IxgRqzwqNb+Yz71P2EN29cnDdqxyt:GHeKh4nqzF1Px2io
MD5:	BE3CC5717F5951662ADB399D613F20CC
SHA1:	F776BC4344AD59FBD6950D24D3AA6DDDB3DF215A
SHA-256:	8F0BEB5863D190B7B2CFE7F506F3B721AB6B9E892337A133364F2BA710931B25
SHA-512:	FBE0AAB2194E4F09CBDBED770D862A4F9F2672A5C8346EE7E392341973C75CFC0B8C66A132E5A2BB22FB6E265CB40B45DFB05FB076C74914FAED35E1E476A2CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......[.............................%.......0....@.......................................@......@..............................@8...@.......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......H...................idata..@8.......:...H..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc........@......................@..@....................................@..@........................................................................................................................................

\Device\ConDrv

Process:	C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	415
Entropy (8bit):	4.869237911154585
Encrypted:	false
SSDEEP:	6:AMpnOMvotkMylHcAxXF2Saie923fzIfczmaLgbWoJPX923fzIfcttGvovnbqxRok:pt6wnRwUrKmQ1orttGKqK2
MD5:	7A318B206F4C64AC578AD4666BEFD880
SHA1:	167E3BEE8E1349E5F2E8D192324D710AA2777DF5
SHA-256:	DC39F29286E02958562E77FBB247B03A0FE6D1008DEAE7122AE465A053A1CF19
SHA-512:	6F9E66EBBED3ADC09499606A76467B389C77B18B7968361326BA2CA356FB7514AC52AE721E07111463F49473475BFB23FF05CCC82471C4BBF6E3B44C3EC639A9
Malicious:	false
Preview:	..7-Zip (a) 24.05 (x86) : Copyright (c) 1999-2024 Igor Pavlov : 2024-05-14....Scanning the drive for archives:.. 0M Scan C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\. ...ERROR: The system cannot find the file specified...C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.zip........System ERROR:..The system cannot find the file specified...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.954848249731403
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	plugin-newest_release_.exe
File size:	1'640'566 bytes
MD5:	55708f430c572fffe83624c57fcbe657
SHA1:	f5ce9f6ac27e11df7142c7ce88697836388d7341
SHA256:	977f445d047b424892794025f0306a7d1c6e0600c590ebc029b210692b6f5383
SHA512:	85945a1c183e589d450029d136dde184b68934ceaedfcca344b31da5aabbc97eb5c17d799fbcdbdb55272c1e18ca3846a20934785d81244a653a4b3d9bdf9d93
SSDEEP:	24576:L86hvqKNIYzqm6LDQm3zZ/sHTISn+/Dev8l+MDnbBM8r5WUY4pv1LNdYryk:/5IY+m6nxZ/8TISnMDev0bBM8/Y4pviP
TLSH:	6F752303B3CB1432F4982D368CB4C414AD677DF819FAA11A2CB5D60D1ABE9D68C77762
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x41181c
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5B1A0D8D [Fri Jun 8 05:01:01 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	20dd26497880c05caed9305b3c8b9109

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/07/2024 07:16:20 27/08/2026 11:33:53
Subject Chain	E=support@softwareok.com, CN=Nenad Hrg, O=Nenad Hrg, STREET=Edelweissstr. 104, L=Taufkirchen, S=Bayern, C=DE, OID.1.3.6.1.4.1.311.60.2.1.1=Taufkirchen, OID.1.3.6.1.4.1.311.60.2.1.2=Bayern, OID.1.3.6.1.4.1.311.60.2.1.3=DE, SERIALNUMBER=2016, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	02FA1932AC9D3D360F3D0323CCDA30EC
Thumbprint SHA-1:	0181DA2D78A2EC6E6966C59A0A663E9D8F0C2F93
Thumbprint SHA-256:	AD02A24C8D2FFBC5F7E946048F23967690A9EE43C5B6842093AD345CA83FB7B5
Serial:	688627716A10C6EBD3648632

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 0041015Ch
call 00007F957068EA6Dh
xor eax, eax
push ebp
push 00411EFEh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00411EBAh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [00415B48h]
call 00007F95706971CBh
call 00007F9570696D1Ah
cmp byte ptr [00412AE0h], 00000000h
je 00007F9570699CEEh
call 00007F95706972E0h
xor eax, eax
call 00007F957068CB05h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F9570693D4Bh
mov edx, dword ptr [ebp-14h]
mov eax, 00418658h
call 00007F957068D0DAh
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [00418658h]
mov dl, 01h
mov eax, dword ptr [0040C04Ch]
call 00007F9570694662h
mov dword ptr [0041865Ch], eax
xor edx, edx
push ebp
push 00411E66h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F957069723Eh
mov dword ptr [00418664h], eax
mov eax, dword ptr [00418664h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F9570699D2Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19000	0xe04	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xb200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x18df6e	0x2908
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19304	0x214	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf25c	0xf400	0da5d73ffbc41792fa65a09058a91476	False	0.5482197745901639	data	6.375879013420213	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x11000	0xfa4	0x1000	2eb275566563c3f1d0099a0da7345b74	False	0.563720703125	data	5.778765357049134	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0xc8c	0xe00	73b859e23f5fd17e00c08db2e0e73dfe	False	0.25362723214285715	data	2.3028287433175367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x13000	0x56bc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x19000	0xe04	0x1000	e9b9c0328fd9628ad4d6ab8283dcb20e	False	0.321533203125	data	4.597812557707959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b000	0x18	0x200	3dffc444ccc131c9dcee18db49ee6403	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0xb200	0xb200	523facfe6cbb31c3afe25bedfd7e91b7	False	0.17834884129213482	data	4.142505918306035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1c41c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1c544	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x1caac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x1cd94	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x1d63c	0x68	data			0.6538461538461539
RT_STRING	0x1d6a4	0xd4	data			0.5283018867924528
RT_STRING	0x1d778	0xa4	data			0.6524390243902439
RT_STRING	0x1d81c	0x2ac	data			0.45614035087719296
RT_STRING	0x1dac8	0x34c	data			0.4218009478672986
RT_STRING	0x1de14	0x294	data			0.4106060606060606
RT_RCDATA	0x1e0a8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x26390	0x10	data			1.5
RT_RCDATA	0x263a0	0x150	data			0.8392857142857143
RT_RCDATA	0x264f0	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x2651c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x2655c	0x4f4	data	English	United States	0.2910094637223975
RT_MANIFEST	0x26a50	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges

Version Infos

Description	Data
Comments	This installation was built with Inno Setup.
CompanyName	Nenad Hrg (SoftwareOK.com)
FileDescription	DontSleep
FileVersion	9.59.1.0
LegalCopyright
ProductName	DontSleep
ProductVersion	9.59.1.0
Translation	0x0000 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T20:31:23.006272+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49698	104.18.111.161	443	TCP
2025-03-07T20:31:25.877947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49699	164.132.58.105	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 20:31:21.294891119 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:21.294976950 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:21.295058966 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:21.296713114 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:21.296726942 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.006179094 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.006272078 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.009387016 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.009396076 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.009629965 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.050066948 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.058341026 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.104315996 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.637304068 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.661075115 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.661236048 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.759799957 CET	49698	443	192.168.2.5	104.18.111.161
Mar 7, 2025 20:31:23.759840012 CET	443	49698	104.18.111.161	192.168.2.5
Mar 7, 2025 20:31:23.787651062 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:23.787687063 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:23.788501024 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:23.788829088 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:23.788837910 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:25.877507925 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:25.877947092 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:25.880232096 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:25.880250931 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:25.880616903 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:25.883002043 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:25.924340963 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:26.789709091 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:26.789736032 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:26.789798021 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:26.789815903 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:26.789865971 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:26.793015003 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:26.793032885 CET	443	49699	164.132.58.105	192.168.2.5
Mar 7, 2025 20:31:26.793061972 CET	49699	443	192.168.2.5	164.132.58.105
Mar 7, 2025 20:31:26.793068886 CET	443	49699	164.132.58.105	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 20:31:21.280550003 CET	59074	53	192.168.2.5	1.1.1.1
Mar 7, 2025 20:31:21.287930012 CET	53	59074	1.1.1.1	192.168.2.5
Mar 7, 2025 20:31:23.778800964 CET	65385	53	192.168.2.5	1.1.1.1
Mar 7, 2025 20:31:23.786906004 CET	53	65385	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 20:31:21.280550003 CET	192.168.2.5	1.1.1.1	0x4e2f	Standard query (0)	tinyurl.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 20:31:23.778800964 CET	192.168.2.5	1.1.1.1	0xcedb	Standard query (0)	rentry.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 20:31:21.287930012 CET	1.1.1.1	192.168.2.5	0x4e2f	No error (0)	tinyurl.com	104.18.111.161	A (IP address)	IN (0x0001)	false
Mar 7, 2025 20:31:21.287930012 CET	1.1.1.1	192.168.2.5	0x4e2f	No error (0)	tinyurl.com	104.17.112.233	A (IP address)	IN (0x0001)	false
Mar 7, 2025 20:31:23.786906004 CET	1.1.1.1	192.168.2.5	0xcedb	No error (0)	rentry.org	164.132.58.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tinyurl.com

rentry.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49698	104.18.111.161	443	8468	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp

Timestamp	Bytes transferred	Direction	Data
2025-03-07 19:31:23 UTC	153	OUT	GET /3ann877w HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: tinyurl.com
2025-03-07 19:31:23 UTC	1258	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 07 Mar 2025 19:31:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw referrer-policy: unsafe-url x-robots-tag: noindex x-tinyurl-redirect-type: redirect Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private x-tinyurl-redirect: eyJpdiI6InBvUEo4dHZaUFczcFFCTkZONDYvWHc9PSIsInZhbHVlIjoiYk8vSUxEUi84dTlRRkpnQ1lmbVMxZGdoVktmbHpSejZLY2hyZStabjBwK1FwRDlkNzl1cDJoZVJsMGpEN1RKcHMrRG1NL0REUnBaZ0VrNkt2V0VVRnc9PSIsIm1hYyI6IjBiMzE0M2ZiMDgwYWQ4NDI4MjcyNDM2NzNhZjM1NDE0ZTMzNzMxNTg2NDY5OWExNTgzNGNiZGY0ZTkyZDZmYzIiLCJ0YWciOiIifQ== x-content-type-options: nosniff x-xss-protection: 1; mode=block CF-Cache-Status: HIT Set-Cookie: __cf_bm=wJvDIIWjWiaxdoaA.d4baUNlKrJMoLj1FALmo5TB0C4-1741375883-1.0.1.1-bcYUm.xSfoQ5bW7dFw1sXthAs96PL.1W6Qc55VWTunqDJfzyJnhGk.2x1YvsUC6AzfbpXx63SHBlQ4487bV8CnZm4YPjBhl05Ne6Xqdu6MU; path=/; expires=Fri, 07-Mar-25 20:01:23 GMT; domain=.tinyurl.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 91cc83469b8fc307-IAH alt-svc: h3=":443"; ma=86400
2025-03-07 19:31:23 UTC	111	IN	Data Raw: 32 35 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 Data Ascii: 252<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" cont
2025-03-07 19:31:23 UTC	490	IN	Data Raw: 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 6f 72 67 2f 31 39 61 39 63 35 30 61 35 38 63 38 62 63 64 37 30 38 32 33 38 34 66 37 35 30 36 64 66 39 63 37 34 62 63 62 34 33 39 64 39 30 34 65 66 65 30 39 62 61 34 36 38 37 66 61 62 36 62 33 32 33 34 64 2f 72 61 77 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 6f 72 67 2f 31 39 61 39 63 35 30 61 35 38 63 38 62 63 64 37 30 38 32 33 38 34 66 37 35 30 36 64 66 39 63 37 34 62 63 62 34 33 39 64 39 30 34 65 66 65 30 39 62 61 34 36 38 37 66 61 62 36 62 33 32 33 34 64 2f 72 61 77 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a Data Ascii: ent="0;url='https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw'" /> <title>Redirecting to https://rentry.org/19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw</title> </head> <body>
2025-03-07 19:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49699	164.132.58.105	443	8468	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp

Timestamp	Bytes transferred	Direction	Data
2025-03-07 19:31:25 UTC	212	OUT	GET /19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d/raw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: rentry.org
2025-03-07 19:31:26 UTC	317	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 07 Mar 2025 19:31:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4549 Connection: close Vary: Origin X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: Vary
2025-03-07 19:31:26 UTC	4549	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 57 68 61 74 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 77 68 61 74 22 20 2f 3e 0a 0a 20 20 20 20 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 69 73 20 61 20 6d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 Data Ascii: <!DOCTYPE html><html><head> <meta charset="utf-8"> <title>What</title><link rel="canonical" href="https://rentry.co/what" /> <meta name="description" content="Rentry.co is a markdown paste service with preview, custom urls and editing

Target ID:	0
Start time:	14:31:14
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\plugin-newest_release_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\plugin-newest_release_.exe"
Imagebase:	0x400000
File size:	1'640'566 bytes
MD5 hash:	55708F430C572FFFE83624C57FCBE657
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	14:31:14
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-OUV7K.tmp\plugin-newest_release_.tmp" /SL5="$104D2,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe"
Imagebase:	0x400000
File size:	1'185'792 bytes
MD5 hash:	BE3CC5717F5951662ADB399D613F20CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:31:19
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\plugin-newest_release_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-
Imagebase:	0x400000
File size:	1'640'566 bytes
MD5 hash:	55708F430C572FFFE83624C57FCBE657
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	14:31:19
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PK610.tmp\plugin-newest_release_.tmp" /SL5="$404EC,865334,121344,C:\Users\user\Desktop\plugin-newest_release_.exe" /verysilent /sp-
Imagebase:	0x400000
File size:	1'185'792 bytes
MD5 hash:	BE3CC5717F5951662ADB399D613F20CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	14:31:26
Start date:	07/03/2025
Path:	C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\idp.exe" x "C:\Users\user\AppData\Local\Temp\is-51L9R.tmp\DontSleep_x64.zip" -o"C:\Users\user\AppData\Local\Programs\Common" -y -p19a9c50a58c8bcd7082384f7506df9c74bcb439d904efe09ba4687fab6b3234d
Imagebase:	0x4a0000
File size:	847'360 bytes
MD5 hash:	6482EE0F372469D1190C74BD70D76153
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	14:31:27
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true