Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1618058
MD5:	ebca499e1ad0c9c61ca78571e7201b75
SHA1:	dbb72e4c2bd38ccc509b4705c07ed5a84ed0e156
SHA256:	25f8797d40120ef9c308d5301fe4e17f4a46ce6c85ffb40d3fedf95ed581e9bd
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 5024 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: EBCA499E1AD0C9C61CA78571E7201B75)

Setup.tmp (PID: 3916 cmdline: "C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp" /SL5="$30446,10869927,119296,C:\Users\user\Desktop\Setup.exe" MD5: B1F9D665E52C29972B50D7145D88DCE1)

Setup.exe (PID: 4912 cmdline: "C:\Users\user\Desktop\Setup.exe" /VERYSILENT MD5: EBCA499E1AD0C9C61CA78571E7201B75)

Setup.tmp (PID: 7124 cmdline: "C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp" /SL5="$20452,10869927,119296,C:\Users\user\Desktop\Setup.exe" /VERYSILENT MD5: B1F9D665E52C29972B50D7145D88DCE1)

PilotEdit.exe (PID: 3068 cmdline: "C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe" MD5: 0D9B524228544CB2C010A34B20C1D31F)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["balancedzlife.tech", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "iK8vKf--seh1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: PilotEdit.exe PID: 3068	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: PilotEdit.exe PID: 3068	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:14.435341+0100	2028371	3	Unknown Traffic	192.168.2.10	49711	149.154.167.99	443	TCP
2025-02-18T15:40:15.367297+0100	2028371	3	Unknown Traffic	192.168.2.10	49712	104.21.64.1	443	TCP
2025-02-18T15:40:16.207812+0100	2028371	3	Unknown Traffic	192.168.2.10	49713	104.21.64.1	443	TCP
2025-02-18T15:40:17.655869+0100	2028371	3	Unknown Traffic	192.168.2.10	49714	104.21.64.1	443	TCP
2025-02-18T15:40:19.635980+0100	2028371	3	Unknown Traffic	192.168.2.10	49716	104.21.64.1	443	TCP
2025-02-18T15:40:21.316306+0100	2028371	3	Unknown Traffic	192.168.2.10	49717	104.21.64.1	443	TCP
2025-02-18T15:40:23.467862+0100	2028371	3	Unknown Traffic	192.168.2.10	49718	104.21.64.1	443	TCP
2025-02-18T15:40:26.301615+0100	2028371	3	Unknown Traffic	192.168.2.10	49719	104.21.64.1	443	TCP
2025-02-18T15:40:28.875093+0100	2028371	3	Unknown Traffic	192.168.2.10	49720	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:15.513486+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49712	104.21.64.1	443	TCP
2025-02-18T15:40:16.749580+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49713	104.21.64.1	443	TCP
2025-02-18T15:40:29.417772+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49720	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:15.513486+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49712	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:15.367297+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49712	104.21.64.1	443	TCP
2025-02-18T15:40:16.207812+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49713	104.21.64.1	443	TCP
2025-02-18T15:40:17.655869+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49714	104.21.64.1	443	TCP
2025-02-18T15:40:19.635980+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49716	104.21.64.1	443	TCP
2025-02-18T15:40:21.316306+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49717	104.21.64.1	443	TCP
2025-02-18T15:40:23.467862+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49718	104.21.64.1	443	TCP
2025-02-18T15:40:26.301615+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49719	104.21.64.1	443	TCP
2025-02-18T15:40:28.875093+0100	2060079	1	Domain Observed Used for C2 Detected	192.168.2.10	49720	104.21.64.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (generalmills .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:14.821884+0100	2060066	1	Domain Observed Used for C2 Detected	192.168.2.10	55338	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mercharena .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:14.808129+0100	2060072	1	Domain Observed Used for C2 Detected	192.168.2.10	55480	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shiningrstars .help)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:14.795999+0100	2060104	1	Domain Observed Used for C2 Detected	192.168.2.10	51890	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stormlegue .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:14.841163+0100	2060078	1	Domain Observed Used for C2 Detected	192.168.2.10	50072	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T15:40:18.405742+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	49714	104.21.64.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://stormlegue.com/apie	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/apin	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/apii	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/apidu	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/api	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/z	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/apil	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/Gmcg	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/ptOB	Avira URL Cloud: Label: malware
Source: https://balancedzlife.tech:443/api-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerno-cachePragm	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/k	Avira URL Cloud: Label: malware
Source: https://balancedzlife.tech/A	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/o	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/l	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/	Avira URL Cloud: Label: malware
Source: https://balancedzlife.tech/	Avira URL Cloud: Label: malware
Source: balancedzlife.tech	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/;	Avira URL Cloud: Label: malware
Source: https://balancedzlife.tech/api	Avira URL Cloud: Label: malware
Source: https://mercharena.biz/	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/apii1	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/tI89	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/J/i13s6	Avira URL Cloud: Label: malware
Source: https://stormlegue.com/.	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["balancedzlife.tech", "shiningrstars.help", "mercharena.biz", "generalmills.pro", "stormlegue.com", "blast-hubs.com", "blastikcn.com", "nestlecompany.pro"], "Build id": "iK8vKf--seh1"}

Multi AV Scanner detection for submitted file

Source: Setup.exe	Virustotal: Detection: 25%			Perma Link
Source: Setup.exe	ReversingLabs: Detection: 37%

Sample uses string decryption to hide its real strings

Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: balancedzlife.tech
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: shiningrstars.help
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mercharena.biz
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: generalmills.pro
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: stormlegue.com
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: blast-hubs.com
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: blastikcn.com
Source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nestlecompany.pro

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49720 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\Tfs.BuildMachine\MS.TF.Deployment.Workflow\Microsoft.TeamFoundation.Deployment.Workflow.pdbX source: is-1BONH.tmp.5.dr
Source:	Binary string: Z:\PROJ\CodeLogic\Release\PilotEdit.pdb source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr
Source:	Binary string: D:\a\multipass-private\multipass-private\build\bin\ssh.pdb source: is-IDBJG.tmp.5.dr
Source:	Binary string: NuGet.Common.ni.pdb source: is-JOM36.tmp.5.dr
Source:	Binary string: MpRTP.pdb source: is-B6AOM.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\NuGet.PackageManagement\obj\release\net472\NuGet.PackageManagement.pdb source: is-DNNFJ.tmp.5.dr
Source:	Binary string: sqlcese35.pdb source: is-0RUKS.tmp.5.dr
Source:	Binary string: D:\dbs\sh\ddvsm\1001_131954\cmd\l\out\Intermediate\EdevStaticAnalysis\fxcopcommon.csproj_07B774E8\objr\x86\FxCopCommon.pdb source: is-V00IP.tmp.5.dr
Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\Tfs.BuildMachine\MS.TF.Deployment.Workflow\Microsoft.TeamFoundation.Deployment.Workflow.pdb source: is-1BONH.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.WebTools.ProjectSystem.Components\Release\Microsoft.WebTools.ProjectSystem.Components.pdbZa source: is-3KHUI.tmp.5.dr
Source:	Binary string: F:\NMC\CURRENT260IL1nightlyBuild15061_final\Libraries\WzWXF\Providers\WzWXFRecipients\w64prod\WzAddrycts64.pdb source: is-KU21U.tmp.5.dr
Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\VSIntegration.Client\MS.VS.TeamFoundation.WorkItemTracking\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.pdb source: is-1ABE0.tmp.5.dr
Source:	Binary string: MpRTP.pdbUGP source: is-B6AOM.tmp.5.dr
Source:	Binary string: F:\NMC\CURRENT260IL1nightlyBuild15061_final\Libraries\WzWXF\Providers\WzWXFRecipients\w64prod\WzAddrycts64.pdb@` source: is-KU21U.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\NuGet.Common\obj\release\netstandard2.0\NuGet.Common.pdb source: is-JOM36.tmp.5.dr
Source:	Binary string: sqlcese35.pdb source: is-0RUKS.tmp.5.dr
Source:	Binary string: D:\a\multipass-private\multipass-private\build\bin\ssh.pdbQQ source: is-IDBJG.tmp.5.dr
Source:	Binary string: Debug information could not be found for target assembly '{0}'. For best analysis results, include the .pdb file with debug information for '{0}' in the same directory as the target assembly. source: is-V00IP.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.WebTools.ProjectSystem.Components\Release\Microsoft.WebTools.ProjectSystem.Components.pdb source: is-3KHUI.tmp.5.dr
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: Setup.tmp, 00000002.00000003.1581237433.00000000022B1000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, _isdecmp.dll.2.dr, _isdecmp.dll.5.dr
Source:	Binary string: D:\dbs\sh\ddvsm\0831_165144\cmd\1b\out\Intermediate\vc\microsoft.visualstudio.workspace.externalbuildframework.vs_x86retail_84B3C0EB\Release\net472\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.pdb source: is-9I2OC.tmp.5.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060078 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stormlegue .com) : 192.168.2.10:50072 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060072 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mercharena .biz) : 192.168.2.10:55480 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49712 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49713 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060066 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (generalmills .pro) : 192.168.2.10:55338 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49717 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49714 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060104 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shiningrstars .help) : 192.168.2.10:51890 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49716 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49718 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49720 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2060079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI) : 192.168.2.10:49719 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49713 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:49714 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49712 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49712 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49720 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: balancedzlife.tech
Source: Malware configuration extractor	URLs: shiningrstars.help
Source: Malware configuration extractor	URLs: mercharena.biz
Source: Malware configuration extractor	URLs: generalmills.pro
Source: Malware configuration extractor	URLs: stormlegue.com
Source: Malware configuration extractor	URLs: blast-hubs.com
Source: Malware configuration extractor	URLs: blastikcn.com
Source: Malware configuration extractor	URLs: nestlecompany.pro

Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49713 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49717 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49712 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49714 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49711 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49716 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49718 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49720 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49719 -> 104.21.64.1:443

Source: global traffic	HTTP traffic detected: GET /prolksehr3 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FE08AF9MZP25XISX3YCookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12848Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MQJOEU1LCookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15015Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UR1I159W0F5T06Cookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20413Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PQ7LRT0SR9TDILSAZPYCookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2393Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O8K65RX27V9Cookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 567977Host: stormlegue.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=FiCte4Nw5yDDf12NGTGGy5Rv5EGc0MkTDOeV3TSFB_Y-1739889615-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: stormlegue.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /prolksehr3 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: balancedzlife.tech
Source: global traffic	DNS traffic detected: DNS query: shiningrstars.help
Source: global traffic	DNS traffic detected: DNS query: mercharena.biz
Source: global traffic	DNS traffic detected: DNS query: generalmills.pro
Source: global traffic	DNS traffic detected: DNS query: stormlegue.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stormlegue.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 18 Feb 2025 14:40:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tZ3mUHJlhhFUjpV1CGSUQ67GlV%2BGCPJjH%2F4fP73g1DQAbZuYYmOcGf8eY%2BT1rXZ6nY4d2pVqnV8LiJn%2B2TVSgrIWFTDBEwMMHHf0Fbl08B3iud8urv5LfoRdKPEQTttFUw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913ec5709800c358-EWR

Source: is-1ABE0.tmp.5.dr	String found in binary or memory: http://aka.ms/witclientom
Source: is-1ABE0.tmp.5.dr	String found in binary or memory: http://aka.ms/witclientome
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PilotEdit.exe, 00000006.00000003.2060952336.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2063574417.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258047088.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258125852.0000000002138000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829131661.0000000002139000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2061313005.0000000002124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR4
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: is-1BONH.tmp.5.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: is-1BONH.tmp.5.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: is-MF6KC.tmp.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://s2.symcb.com0
Source: is-1BONH.tmp.5.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP
Source: is-1BONH.tmp.5.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/IssueT
Source: is-1BONH.tmp.5.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/IssueT
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://sv.symcd.com0&
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.chilkatsoft.com/p/p_463.asp)
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.cknotes.com/?p=210
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.cknotes.com/?p=217
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.cknotes.com/?p=411
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.cknotes.com/?p=411The
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.cknotes.com/?p=91
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: is-V00IP.tmp.5.dr	String found in binary or memory: http://www.gotdotnet.com/5PlatformAssembliesLocation
Source: Setup.exe, Setup.tmp.0.dr, Setup.tmp.3.dr	String found in binary or memory: http://www.innosetup.com/
Source: Setup.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.pilotedit.com
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.pilotedit.comopen
Source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	String found in binary or memory: http://www.pilotedit.comopen0-
Source: Setup.exe, Setup.tmp.0.dr, Setup.tmp.3.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: is-KU21U.tmp.5.dr	String found in binary or memory: http://www.winzip.com/authenticode.htm0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: is-1ABE0.tmp.5.dr	String found in binary or memory: https://aka.ms/teamexplorer2019
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balancedzlife.tech/
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balancedzlife.tech/A
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balancedzlife.tech/api
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://balancedzlife.tech:443/api-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerno-cachePragm
Source: PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: is-KU21U.tmp.5.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: is-KU21U.tmp.5.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: is-JOM36.tmp.5.dr, is-DNNFJ.tmp.5.dr	String found in binary or memory: https://github.com/NuGet/NuGet.Client
Source: PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: is-1BONH.tmp.5.dr	String found in binary or memory: https://login.microsoftonline.com/extSTS.srf%SPSNoSecurityToken)SPSNoTokenExpiration
Source: is-1BONH.tmp.5.dr	String found in binary or memory: https://login.microsoftonline.comXhttps://login.microsoftonline.com/extSTS.srf
Source: is-1BONH.tmp.5.dr	String found in binary or memory: https://management.core.windows.net
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mercharena.biz/
Source: PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: PilotEdit.exe, 00000006.00000002.2829000770.00000000020F6000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/.
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/;
Source: PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/Gmcg
Source: PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/J/i13s6
Source: PilotEdit.exe, 00000006.00000003.2083162284.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829131661.0000000002139000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2257689319.000000000217C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/api
Source: PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apidu
Source: PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apie
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apii
Source: PilotEdit.exe, 00000006.00000002.2829202421.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083530809.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2257689319.000000000217C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apii1
Source: PilotEdit.exe, 00000006.00000003.2258047088.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258125852.0000000002138000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829131661.0000000002139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apil
Source: PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/apin
Source: PilotEdit.exe, 00000006.00000002.2830302217.0000000004E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/k
Source: PilotEdit.exe, 00000006.00000002.2830302217.0000000004E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/l
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/o
Source: PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/ptOB
Source: PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/tI89
Source: PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stormlegue.com/z
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/prolksehr3
Source: PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: PilotEdit.exe, 00000006.00000003.1988233118.0000000002171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: PilotEdit.exe, 00000006.00000003.1988233118.0000000002171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: is-KU21U.tmp.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.10:49720 version: TLS 1.2

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Setup.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-MF6KC.tmp.5.dr	Static PE information: Resource name: STYLE type: Zip archive data, at least v2.0 to extract, compression method=store
Source: is-MF6KC.tmp.5.dr	Static PE information: Resource name: STYLE type: Zip archive data, at least v2.0 to extract, compression method=store

Source: is-JOM36.tmp.5.dr

Static PE information: No import functions for PE file found

Source: Setup.exe, 00000000.00000003.1576803749.000000007FE42000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-B6AOM.tmp.5.dr	Binary string: \??\Volume\Device\Harddisk\Device\CdRom\Device\Floppy\Device\WinDfs\\Device\RdpDr\\Device\WebDavRedirector\\Device\Mup%ws%ws\Device\LanmanRedirector[MpRtp] Engine VFZ block: %ls. status=0x%x, statusex=0x%I64x, threatid=0x%x, sigseq=0x%I64x[MpRtp] Engine VFZ HIPS block: %ls. status=0x%x, statusex=0x%I64x, threatid=0x%x, sigseq=0x%I64x[MpRtp] Engine VFZ lofi/sample/expensive: %ls. status=0x%x, statusex=0x%I64x, threatid=0x%x, sigseq=0x%I64xvfzselfcheckmagicfile8
Source: is-B6AOM.tmp.5.dr	Binary string: REGISTRY_DOMAINFILESYSTEM_DOMAINPROCESS_DOMAINFIREWALL_DOMAINNETWORK_DOMAINSYSTEM_DOMAINNRI_DOMAINAR_DOMAIN\Device\SftVol\File ID\\%s\Device\MountPointManagerN
Source: is-B6AOM.tmp.5.dr	Binary string: 4Exclusions\ProcessesMpCmdRun.exeNisSrv.exe%SystemRoot%System32\WerFault.exeSystem32\WerFaultSecure.exeScanDisableScanningNetworkFilesDisableScanningMappedNetworkDrivesForFullScanQuarantineQuarantineLocationEngineParanoidModeInstallLocation.\Device\\SystemRoot\\??\%s\%s\Device\LanmanRedirector\\Device\Mup\%s%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X%s{}%sx@PRegistry\Machine0HKLMHKCUHKCU\Software\Classes
Source: is-B6AOM.tmp.5.dr	Binary string: \DEVICE\\.\fileboottransactionfilesamplefilerequestedsamplefileexpensive->%d / %d%c%d%cremoteremovablefixednot boot%ws / %wsPassthrough%dFile ID 0x%016I64x%s%s

Source: is-1BONH.tmp.5.dr	Binary or memory string: 8Please specify a Visual Studio Solution (.sln) to build.
Source: is-1BONH.tmp.5.dr	Binary or memory string: *.cscfg9CertificateAddedSuccessfully=CertificateDeletedSuccessfully1RenewingCertificateError.sln
Source: is-3KHUI.tmp.5.dr	Binary or memory string: .csproj
Source: is-V00IP.tmp.5.dr	Binary or memory string: D:\dbs\sh\ddvsm\1001_131954\cmd\l\out\Intermediate\EdevStaticAnalysis\fxcopcommon.csproj_07B774E8\objr\x86\FxCopCommon.pdb
Source: is-3KHUI.tmp.5.dr	Binary or memory string: .vbproj'GitHubOrganizations
Source: is-3KHUI.tmp.5.dr	Binary or memory string: 7Project Files (.csproj)\|.csproj\|All Files (.) \| .

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/38@6/2

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: PilotEdit.exe, 00000006.00000003.1991144520.0000000004E2F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990709819.0000000004E4A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Setup.exe	Virustotal: Detection: 25%
Source: Setup.exe	ReversingLabs: Detection: 37%

Source: Setup.exe	String found in binary or memory: /LOADINF="filename"
Source: Setup.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: Setup.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: Setup.exe	String found in binary or memory: /LoadInf=
Source: Setup.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp" /SL5="$30446,10869927,119296,C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe" /VERYSILENT
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp" /SL5="$20452,10869927,119296,C:\Users\user\Desktop\Setup.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe "C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp" /SL5="$30446,10869927,119296,C:\Users\user\Desktop\Setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp" /SL5="$20452,10869927,119296,C:\Users\user\Desktop\Setup.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe "C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Setup.exe

Static file information: File size 12136997 > 1048576

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\Tfs.BuildMachine\MS.TF.Deployment.Workflow\Microsoft.TeamFoundation.Deployment.Workflow.pdbX source: is-1BONH.tmp.5.dr
Source:	Binary string: Z:\PROJ\CodeLogic\Release\PilotEdit.pdb source: PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr
Source:	Binary string: D:\a\multipass-private\multipass-private\build\bin\ssh.pdb source: is-IDBJG.tmp.5.dr
Source:	Binary string: NuGet.Common.ni.pdb source: is-JOM36.tmp.5.dr
Source:	Binary string: MpRTP.pdb source: is-B6AOM.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\NuGet.PackageManagement\obj\release\net472\NuGet.PackageManagement.pdb source: is-DNNFJ.tmp.5.dr
Source:	Binary string: sqlcese35.pdb source: is-0RUKS.tmp.5.dr
Source:	Binary string: D:\dbs\sh\ddvsm\1001_131954\cmd\l\out\Intermediate\EdevStaticAnalysis\fxcopcommon.csproj_07B774E8\objr\x86\FxCopCommon.pdb source: is-V00IP.tmp.5.dr
Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\Tfs.BuildMachine\MS.TF.Deployment.Workflow\Microsoft.TeamFoundation.Deployment.Workflow.pdb source: is-1BONH.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.WebTools.ProjectSystem.Components\Release\Microsoft.WebTools.ProjectSystem.Components.pdbZa source: is-3KHUI.tmp.5.dr
Source:	Binary string: F:\NMC\CURRENT260IL1nightlyBuild15061_final\Libraries\WzWXF\Providers\WzWXFRecipients\w64prod\WzAddrycts64.pdb source: is-KU21U.tmp.5.dr
Source:	Binary string: D:\a\_work\1\obj\Release.AnyCPU\VSIntegration.Client\MS.VS.TeamFoundation.WorkItemTracking\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.pdb source: is-1ABE0.tmp.5.dr
Source:	Binary string: MpRTP.pdbUGP source: is-B6AOM.tmp.5.dr
Source:	Binary string: F:\NMC\CURRENT260IL1nightlyBuild15061_final\Libraries\WzWXF\Providers\WzWXFRecipients\w64prod\WzAddrycts64.pdb@` source: is-KU21U.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\NuGet.Common\obj\release\netstandard2.0\NuGet.Common.pdb source: is-JOM36.tmp.5.dr
Source:	Binary string: sqlcese35.pdb source: is-0RUKS.tmp.5.dr
Source:	Binary string: D:\a\multipass-private\multipass-private\build\bin\ssh.pdbQQ source: is-IDBJG.tmp.5.dr
Source:	Binary string: Debug information could not be found for target assembly '{0}'. For best analysis results, include the .pdb file with debug information for '{0}' in the same directory as the target assembly. source: is-V00IP.tmp.5.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.WebTools.ProjectSystem.Components\Release\Microsoft.WebTools.ProjectSystem.Components.pdb source: is-3KHUI.tmp.5.dr
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: Setup.tmp, 00000002.00000003.1581237433.00000000022B1000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, _isdecmp.dll.2.dr, _isdecmp.dll.5.dr
Source:	Binary string: D:\dbs\sh\ddvsm\0831_165144\cmd\1b\out\Intermediate\vc\microsoft.visualstudio.workspace.externalbuildframework.vs_x86retail_84B3C0EB\Release\net472\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.pdb source: is-9I2OC.tmp.5.dr

Source: is-JOM36.tmp.5.dr

Static PE information: 0xFD24D444 [Fri Aug 1 15:54:44 2104 UTC]

Source: is-0RUKS.tmp.5.dr	Static PE information: section name: PAGELK
Source: is-IDBJG.tmp.5.dr	Static PE information: section name: .00cfg
Source: is-KU21U.tmp.5.dr	Static PE information: section name: .nep

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Code function: 6_3_0217F53A push cs; iretd	6_3_0217F551
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Code function: 6_3_0217D972 push ds; retn 0000h	6_3_0217D97C
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Code function: 6_3_0217F08B pushfd ; iretd	6_3_0217F1C1
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Code function: 6_3_0217D7AC push edx; retf	6_3_0217D7B1
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Code function: 6_3_0217F7AA push esi; iretd	6_3_0217F791

Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1ABE0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-0RUKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\MpRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.PackageManagement.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\WzAddrycts64.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-9I2OC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-6TF3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\sqlcese35.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.TeamFoundation.Deployment.Workflow.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1BONH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-MF6KC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-DNNFJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\ssh.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-J74UI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-JOM36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-B6AOM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-3KHUI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.WebTools.ProjectSystem.Components.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\FxCopCommon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\msys-pcre-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-IDBJG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-V00IP.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-KU21U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	File created: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

Window / User API: threadDelayed 4334

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1ABE0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-0RUKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\MpRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.PackageManagement.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\WzAddrycts64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-9I2OC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-6TF3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\sqlcese35.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.TeamFoundation.Deployment.Workflow.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1BONH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-DNNFJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\ssh.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-J74UI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-B6AOM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-JOM36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-3KHUI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.WebTools.ProjectSystem.Components.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\msys-pcre-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\FxCopCommon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-IDBJG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-V00IP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-KU21U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe TID: 5928	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe TID: 6660	Thread sleep count: 4334 > 30			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Last function: Thread delayed

Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: Setup.tmp, 00000002.00000002.1598608810.0000000000748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\)@
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: PilotEdit.exe, PilotEdit.exe, 00000006.00000003.2060952336.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2063574417.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258047088.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829061430.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2828871558.00000000020E4000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2061313005.0000000002124000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: PilotEdit.exe, 00000006.00000003.2060952336.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2063574417.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258047088.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829061430.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2061313005.0000000002124000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeY?
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008526732.0000000004F38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696501413p
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: PilotEdit.exe, 00000006.00000003.2008753647.0000000004E52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe" /VERYSILENT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Setup.exe, 00000000.00000003.1599355911.00000000021EA000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000002.00000003.1581237433.0000000002335000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000002.00000003.1581237433.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000003.00000003.1818126434.00000000022D1000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000005.00000003.1813607044.0000000002AF3000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000005.00000003.1814007903.000000000234C000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000005.00000003.1814007903.00000000022D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgui.exe
Source: PilotEdit.exe, 00000006.00000003.2063405035.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083530809.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2257920687.000000000218A000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2257689319.000000000217C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: PilotEdit.exe PID: 3068, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: PilotEdit.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: PilotEdit.exe	String found in binary or memory: Wallets/ElectronCash
Source: PilotEdit.exe	String found in binary or memory: Wallets/JAXX New Version
Source: PilotEdit.exe	String found in binary or memory: window-state.json
Source: PilotEdit.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: PilotEdit.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: PilotEdit.exe	String found in binary or memory: %appdata%\Ethereum
Source: PilotEdit.exe, 00000006.00000003.2061313005.000000000210C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: PilotEdit.exe PID: 3068, type: MEMORYSTR
Source: Yara match	File source: 00000006.00000002.2829687578.0000000003F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	25%	Virustotal		Browse
Setup.exe	38%	ReversingLabs	Win32.Spyware.Lummastealer

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\FxCopCommon.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.TeamFoundation.Deployment.Workflow.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.WebTools.ProjectSystem.Components.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\MpRtp.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.Common.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.PackageManagement.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe (copy)	8%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\WzAddrycts64.dll (copy)	2%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-0RUKS.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1ABE0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-1BONH.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-3KHUI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-6TF3I.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-9I2OC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-B6AOM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-DNNFJ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-IDBJG.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-J74UI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-JOM36.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-KU21U.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-MF6KC.tmp	8%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\is-V00IP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\msys-pcre-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\sqlcese35.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\ssh.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://stormlegue.com/apie	100%	Avira URL Cloud	malware
https://stormlegue.com/apin	100%	Avira URL Cloud	malware
http://www.gotdotnet.com/5PlatformAssembliesLocation	0%	Avira URL Cloud	safe
https://stormlegue.com/apii	100%	Avira URL Cloud	malware
http://www.cknotes.com/?p=91	0%	Avira URL Cloud	safe
https://stormlegue.com/apidu	100%	Avira URL Cloud	malware
https://stormlegue.com/api	100%	Avira URL Cloud	malware
http://www.pilotedit.com	0%	Avira URL Cloud	safe
https://stormlegue.com/z	100%	Avira URL Cloud	malware
https://stormlegue.com/apil	100%	Avira URL Cloud	malware
http://www.chilkatsoft.com/p/p_463.asp)	0%	Avira URL Cloud	safe
https://stormlegue.com/Gmcg	100%	Avira URL Cloud	malware
https://stormlegue.com/ptOB	100%	Avira URL Cloud	malware
https://balancedzlife.tech:443/api-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerno-cachePragm	100%	Avira URL Cloud	malware
https://stormlegue.com/k	100%	Avira URL Cloud	malware
https://balancedzlife.tech/A	100%	Avira URL Cloud	malware
https://stormlegue.com/o	100%	Avira URL Cloud	malware
https://stormlegue.com/l	100%	Avira URL Cloud	malware
https://stormlegue.com/	100%	Avira URL Cloud	malware
https://balancedzlife.tech/	100%	Avira URL Cloud	malware
balancedzlife.tech	100%	Avira URL Cloud	malware
https://stormlegue.com/;	100%	Avira URL Cloud	malware
https://balancedzlife.tech/api	100%	Avira URL Cloud	malware
https://mercharena.biz/	100%	Avira URL Cloud	malware
http://www.cknotes.com/?p=411The	0%	Avira URL Cloud	safe
https://stormlegue.com/apii1	100%	Avira URL Cloud	malware
http://www.cknotes.com/?p=411	0%	Avira URL Cloud	safe
http://www.cknotes.com/?p=217	0%	Avira URL Cloud	safe
http://www.pilotedit.comopen	0%	Avira URL Cloud	safe
http://www.cknotes.com/?p=210	0%	Avira URL Cloud	safe
https://stormlegue.com/tI89	100%	Avira URL Cloud	malware
https://login.microsoftonline.comXhttps://login.microsoftonline.com/extSTS.srf	0%	Avira URL Cloud	safe
https://stormlegue.com/J/i13s6	100%	Avira URL Cloud	malware
https://stormlegue.com/.	100%	Avira URL Cloud	malware
http://www.pilotedit.comopen0-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
stormlegue.com	104.21.64.1	true	false	high
t.me	149.154.167.99	true	false	high
balancedzlife.tech	unknown	unknown	true	unknown
shiningrstars.help	unknown	unknown	false	high
mercharena.biz	unknown	unknown	false	high
generalmills.pro	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
blast-hubs.com	false		high
https://t.me/prolksehr3	false		high
https://stormlegue.com/api	true	Avira URL Cloud: malware	unknown
stormlegue.com	false		high
shiningrstars.help	false		high
balancedzlife.tech	true	Avira URL Cloud: malware	unknown
nestlecompany.pro	false		high
mercharena.biz	false		high
blastikcn.com	false		high
generalmills.pro	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	PilotEdit.exe, 00000006.00000003.1988233118.0000000002171000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stormlegue.com/z	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.pilotedit.com	is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://ocsp.sectigo.com0	is-MF6KC.tmp.5.dr	false		high
http://www.winzip.com/authenticode.htm0	is-KU21U.tmp.5.dr	false		high
https://web.telegram.org	PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR4	Setup.tmp, 00000005.00000002.1815864920.000000000019C000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Setup.exe	false		high
https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr	PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stormlegue.com/apidu	PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.gotdotnet.com/5PlatformAssembliesLocation	is-V00IP.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://stormlegue.com/apil	PilotEdit.exe, 00000006.00000003.2258047088.0000000002124000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2258125852.0000000002138000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2829131661.0000000002139000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stormlegue.com/apin	PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://www.cknotes.com/?p=91	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://stormlegue.com/apie	PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg	PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stormlegue.com/apii	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aka.ms/witclientom	is-1ABE0.tmp.5.dr	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/IssueT	is-1BONH.tmp.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700	PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chilkatsoft.com/p/p_463.asp)	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi	PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2027446014.0000000004EA8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stormlegue.com/Gmcg	PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stormlegue.com/ptOB	PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://balancedzlife.tech:443/api-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerno-cachePragm	PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stormlegue.com/k	PilotEdit.exe, 00000006.00000002.2830302217.0000000004E10000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://balancedzlife.tech/A	PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stormlegue.com/l	PilotEdit.exe, 00000006.00000002.2830302217.0000000004E10000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	is-1BONH.tmp.5.dr	false		high
https://stormlegue.com/o	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta	PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://balancedzlife.tech/	PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stormlegue.com/	PilotEdit.exe, 00000006.00000002.2829000770.00000000020F6000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060879771.000000000217C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://www.innosetup.com/	Setup.exe, Setup.tmp.0.dr, Setup.tmp.3.dr	false		high
https://stormlegue.com/;	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://balancedzlife.tech/api	PilotEdit.exe, 00000006.00000003.1967579916.000000000212C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sectigo.com/CPS0	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mercharena.biz/	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/NuGet/NuGet.Client	is-JOM36.tmp.5.dr, is-DNNFJ.tmp.5.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64	PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.cknotes.com/?p=411The	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	is-KU21U.tmp.5.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	PilotEdit.exe, 00000006.00000003.2027042746.000000000515D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pilotedit.comopen	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP	is-1BONH.tmp.5.dr	false		high
https://www.cloudflare.com/5xx-error-landing	PilotEdit.exe, 00000006.00000003.1988233118.0000000002171000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/IssueT	is-1BONH.tmp.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.cknotes.com/?p=217	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	PilotEdit.exe, 00000006.00000003.2049154075.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2060217504.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042378962.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2042768102.0000000004EA7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	is-KU21U.tmp.5.dr	false		high
https://stormlegue.com/apii1	PilotEdit.exe, 00000006.00000002.2829202421.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083530809.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2083162284.000000000217C000.00000004.00000020.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.2257689319.000000000217C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.cknotes.com/?p=411	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	PilotEdit.exe, 00000006.00000003.1951413578.0000000004F56000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000AA6B000.00000004.00000800.00020000.00000000.sdmp, Setup.exe, is-MF6KC.tmp.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	PilotEdit.exe, 00000006.00000003.2025702867.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.cknotes.com/?p=210	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://stormlegue.com/tI89	PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aka.ms/witclientome	is-1ABE0.tmp.5.dr	false		high
https://stormlegue.com/J/i13s6	PilotEdit.exe, 00000006.00000003.2060217504.0000000004E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.remobjects.com/ps	Setup.exe, Setup.tmp.0.dr, Setup.tmp.3.dr	false		high
https://stormlegue.com/.	PilotEdit.exe, 00000006.00000003.1988284600.000000000212B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.pilotedit.comopen0-	PilotEdit.exe, 00000006.00000000.1810988608.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, PilotEdit.exe, 00000006.00000003.1951413578.000000000414F000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000002.2827148281.00000000008B4000.00000002.00000001.01000000.0000000E.sdmp, is-MF6KC.tmp.5.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	PilotEdit.exe, 00000006.00000003.1990294038.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990133672.0000000004E60000.00000004.00000800.00020000.00000000.sdmp, PilotEdit.exe, 00000006.00000003.1990499108.0000000004E5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.comXhttps://login.microsoftonline.com/extSTS.srf	is-1BONH.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	is-1BONH.tmp.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.64.1	stormlegue.com	United States		13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1618058
Start date and time:	2025-02-18 15:37:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/38@6/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PilotEdit.exe, PID 3068 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:40:13	API Interceptor	9x Sleep call for process: PilotEdit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.64.1	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	www.shlomi.app/t3l4/
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	www.arryongro-nambe.live/ljgq/
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/2875/
	Revised Order Confirmation.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/hbfq/
	UPIlkrNpsh.exe	Get hash	malicious	Unknown	Browse	xerecao.cc/
	engine.ps1	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/b8fe/
	laserrrrrrrr.ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	new quotation.exe	Get hash	malicious	FormBook	Browse	www.shlomi.app/378r/
	PO 87877889X,pdf.Vbs.vbs	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	r53YFSyurTyIZZMd.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/u7tz/
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	https://telegramcom.kv252.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	keynote.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	updater.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lnst#U0430Il#U0435r86x.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	lum.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	mma.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	http://www.velineue.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
stormlegue.com	#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	0805#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	046s01900330081250b4057885818022025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Polylogy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Purchase Order_2025.GZ	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Vejning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	173986194367d5b010c726a273e684c444fad68035ad95510fd3cc50d0c4ea18ad11b83de8491.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	1739861824b75a9f8eefb234627424d8006aa29332666d4728e6ec2e69d198fc6fbcbc6425122.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	jjmax il.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FEDEX_SHIPPING_DOCUMENTS_MUO98376_B324.exe	Get hash	malicious	DBatLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	nDHL_CUSTOM_CLEARANCE_FORM_3409249_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	SFT20020117.exe	Get hash	malicious	FormBook	Browse	172.67.223.218
	AWB_5771388044 Versanddokumente.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	046s01900330081250b4057885818022025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	eid.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	QUOTATION REQUEST.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	Drawing.bat.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://webopeansea-app.shop/web3/	Get hash	malicious	Unknown	Browse	104.17.25.14
	#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	0805#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	E3B8#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	xOLFehjWNU.doc	Get hash	malicious	Unknown	Browse	104.21.64.1 149.154.167.99
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	E3B8#U007e1.EXE.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99
	po-56-ns 056374TI.docx.doc	Get hash	malicious	Unknown	Browse	104.21.64.1 149.154.167.99
	#Ud835#Ude4e#Ud835#Ude5a#Ud835#Ude69#Ud835#Ude6a#Ud835#Ude65.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll	wEY98gM1Jj.ps1	Get hash	malicious	LummaC Stealer	Browse
	gLkRoYHytv.exe	Get hash	malicious	LummaC Stealer	Browse
	Contract for Partners.exe	Get hash	malicious	Unknown	Browse
	JV4lf0wkWV.exe	Get hash	malicious	Unknown	Browse
	BN.exe	Get hash	malicious	Quasar	Browse
	Exploit Locator.exe	Get hash	malicious	PureCrypter	Browse
	Exploit Locator.exe	Get hash	malicious	PureCrypter	Browse
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
	Mansion_setup.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe	Get hash	malicious	Xmrig	Browse
C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll	wEY98gM1Jj.ps1	Get hash	malicious	LummaC Stealer	Browse
	gLkRoYHytv.exe	Get hash	malicious	LummaC Stealer	Browse
	Exploit Locator.exe	Get hash	malicious	PureCrypter	Browse
	Exploit Locator.exe	Get hash	malicious	PureCrypter	Browse
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
	Mansion_setup.exe	Get hash	malicious	Unknown	Browse
	1w5RpHuliE.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Vidar	Browse
	random.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse
	mix.exe	Get hash	malicious	Socks5Systemz	Browse
	mix.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: wEY98gM1Jj.ps1, Detection: malicious, Browse Filename: gLkRoYHytv.exe, Detection: malicious, Browse Filename: Exploit Locator.exe, Detection: malicious, Browse Filename: Exploit Locator.exe, Detection: malicious, Browse Filename: FAIRSAFE_setup.exe, Detection: malicious, Browse Filename: Mansion_setup.exe, Detection: malicious, Browse Filename: 1w5RpHuliE.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: mix.exe, Detection: malicious, Browse Filename: mix.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: wEY98gM1Jj.ps1, Detection: malicious, Browse Filename: gLkRoYHytv.exe, Detection: malicious, Browse Filename: Contract for Partners.exe, Detection: malicious, Browse Filename: JV4lf0wkWV.exe, Detection: malicious, Browse Filename: BN.exe, Detection: malicious, Browse Filename: Exploit Locator.exe, Detection: malicious, Browse Filename: Exploit Locator.exe, Detection: malicious, Browse Filename: FAIRSAFE_setup.exe, Detection: malicious, Browse Filename: Mansion_setup.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1177088
Entropy (8bit):	6.399664882447376
Encrypted:	false
SSDEEP:	24576:nKbqslNoiGO+h84C6f8HSCNFfoJMbNOED5TOzuRdTxyt:KwY6fUVNvN1j
MD5:	B1F9D665E52C29972B50D7145D88DCE1
SHA1:	DF2C67A5C32A19BB110EC8372134522C0DAB9AC2
SHA-256:	2FFABB0018D335267D2D0101A41CAC7AC7D1AA80956FAE91825E46AAA85C0787
SHA-512:	BCDCE189402FFC1C17B9803AC4040BD1CB23E32BA2C1476CBCFAE13438078E01F78AD3F76E1BF71A6EC204663AA5F5780990016FC074218763D63DB1431F1E75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....-.V..........................................@.......................................@......@..............................@8... ...............................................................................................................text............................... ..`.itext.. ........................... ..`.data...h0.......2..................@....bss.....a...P.......&...................idata..@8.......:...&..............@....tls....<............`...................rdata...............`..............@..@.rsrc........ .......b..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1177088
Entropy (8bit):	6.399664882447376
Encrypted:	false
SSDEEP:	24576:nKbqslNoiGO+h84C6f8HSCNFfoJMbNOED5TOzuRdTxyt:KwY6fUVNvN1j
MD5:	B1F9D665E52C29972B50D7145D88DCE1
SHA1:	DF2C67A5C32A19BB110EC8372134522C0DAB9AC2
SHA-256:	2FFABB0018D335267D2D0101A41CAC7AC7D1AA80956FAE91825E46AAA85C0787
SHA-512:	BCDCE189402FFC1C17B9803AC4040BD1CB23E32BA2C1476CBCFAE13438078E01F78AD3F76E1BF71A6EC204663AA5F5780990016FC074218763D63DB1431F1E75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....-.V..........................................@.......................................@......@..............................@8... ...............................................................................................................text............................... ..`.itext.. ........................... ..`.data...h0.......2..................@....bss.....a...P.......&...................idata..@8.......:...&..............@....tls....<............`...................rdata...............`..............@..@.rsrc........ .......b..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\FxCopCommon.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	226336
Entropy (8bit):	6.114695385867635
Encrypted:	false
SSDEEP:	3072:HEMxytuS0TaR7mTMVnEVJogf3P7l8loLYWifiAm/I8T4J5f6T5MSZt:HEMgsagtXogbvifiuEL
MD5:	28561C10FDBB4520252965B78FC9D286
SHA1:	DBE6C981A40568F6B38FF25AEDC3EE39CC6CEB86
SHA-256:	0388F2EE8D7BF1FBBF4C1CF3887A629BD28428FA28D8DA94C2C3DD5E765A85AA
SHA-512:	CB42C44834D3177745B46EA3EB7E6CC149EEAF7482B792AB2ED703271D8CEF66C2F7DA2432516EABF1F20D3FD50A585026AEFE65783AC79E2CF37A3C9B2E5918
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3t............" ..0..B...........a... ........... ....................................@.................................wa..O....................L.. (...........`..8............................................ ............... ..H............text....A... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................a......H.......l,...}..............8...,`........................................(......(......(......(.......(.....~....-.(Q...r...p(....(.........~......{...."..}......{...."..}......{...."..}......(....o.....0..(....o.....0..(....o..........{...."..}.......0..G.......s......r3..p( ......+......(........,....o!.....X....i2...&..&...s"............4:..........4=.......0..C.......s#...%.o$.....s%...%.o&...('......o(......,..o).....(.......&....*....... ..)..........<<..

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.TeamFoundation.Deployment.Workflow.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299928
Entropy (8bit):	6.077141173950081
Encrypted:	false
SSDEEP:	3072:VA/8IQ7Ne3s0Uz4PMOEYDU13IEKH0PShPtGSFGSO7eSEWEZp5L029FFLXJ1Cp6up:+BTPM0a3IE+zXWEZntFf1CAu2qv
MD5:	50A577AA14A3C48933CBB26E40D7F19F
SHA1:	187F5C1E9B152B42B502BDDB66BFF89838239CAA
SHA-256:	EAD9B414C37BCF56B309D1EB52393B43645A5448CF36B28F2F4DEDF033A54B32
SHA-512:	084B69AAA14070B826744C49D07A3458EFD55D411D342049DA74656E601F7ECA1965249A2A6DBD94144B09C02D003418063FB6B85E6851AEF18B27F0C54A0732
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.........." ..0..b............... ........... ...............................{....`.................................0...O.......@............l...'...........~............................................... ............... ..H............text....`... ...b.................. ..`.rsrc...@............d..............@..@.reloc...............j..............@..B................d.......H.......p....................i...}........................................{).....{...V.(+.....}).....}......0..;........u#.....,/(,....{)....{)...o-...,.(.....{....{...o/..... .... )UU.Z(,....{)...o0...X )UU.Z(.....{...o1...X.0...........r...p......%..{)..........&.....&...-.q&........&...-.&.+...&...o2....%..{..........'.....'...-.q'........'...-.&.+...'...o2....(3.....{...."..}......{...."..}.......0..#........(.....o4.....(.....o5.......(......(6...*..{..

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	279072
Entropy (8bit):	5.4107383950420935
Encrypted:	false
SSDEEP:	3072:ri18tZ1iUskbPPzvlNZibMYFsIs6zEoOLtJDLimdOmaLC/+ShMY+pjYl7ho/cGxx:ry5M9PITV+x8e4pYmsq
MD5:	337931D5DD5CDCEE396E4880C6256429
SHA1:	0C15647CA50A9556AC3B06B5FF2552AACE00877D
SHA-256:	E5E076E14182227C6D853735B77D1E92CF81BD3B91009B3B788AF94FAD158456
SHA-512:	D51B70E01F6698C2113DA683CF68D2CB32F8835597E8DC236A5AE0708292B1A956BF36D435772612F5CCC98B980C7BA2AD8FF5B2865F3A9DECA912002FFB10AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.d...........!................./... ...@....@.. ....................................@.................................X/..S....@.................. (...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......P+..............P ..~....*......................................4..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP6.....y)..O.y.......S...T]..\......{....hu.3.`.+-........%f......-.e.Joh.8.C'...'.,.; ..H...X...^.._G.._........w...............=...................$...........].......................R...I...........,...............

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	806944
Entropy (8bit):	6.299013113627838
Encrypted:	false
SSDEEP:	12288:w09DLOGmmYXDaQIEx/sf7gXXUtVjPnK+WpZU9:P9DqBmADa4g7gXXUtVjPndqE
MD5:	36ADA725660FA70707BD1AF2CFC58CCF
SHA1:	BB4CD91BD788819D0EF3FFEEF418685234A0D535
SHA-256:	E407025F9CDAC08F0A70A62920B05EEADCAE7F05DE9B3EDF17ED7D72D21E4734
SHA-512:	48070B689EAAACFE53C062E71149E457106BCE9D04D01C1C5380368DC0B28BC493F7737E772AAFCA0B729B8C3C87C2EB1BAE8D4B62479B73482266F1CD679731
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..0..R...........p... ........... ..............................{i....`..................................p..O....................(.. (...`......Po............................................... ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc.......`.......&..............@..B.................p......H........G..<...............8{..Pn........................................(f...^.(f......%...%...}....:.(f.....}....:.(f.....}....>. 4......(g...2......oh...:........oi......0..,........oj...r...p $...........%...%....ok...t#...&...ol.....(m.....(n..."..(o...&...(p...&...(q.....(...."..(....&...(....&...(......(....6..(....(....&...(....6..(?...(....6..(@...(....2.(....(...."..(....6..(....(.......-..(%...+...).....)....($...(......(&.....((.....(*..

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	290744
Entropy (8bit):	6.7143339864270875
Encrypted:	false
SSDEEP:	3072:Z+JLUq/Sn85OCBWWhLXCcA1oL4WVTZJVdsemRAKtNRsfLkTTd5lu9Z+xm1u+Y2Qw:XkL74sZmntnsgfd58oYu+Y/4aItNd9
MD5:	7FD3D2E87F5DAE4BB5412F493773B6BB
SHA1:	F843D77724A727701FFFBFD3E441CB1149747705
SHA-256:	8F2A11E195C69438432DAA60C6703AD3B23818FF84241451E228C9E801C87C8A
SHA-512:	9A7989D99F541DEB45C78EFF185507E7766A1C644F27CEB22E21742B650DFBE08FC2F6F2EB457BBF501EE27B8DFDF541082A9943D8EAF71103765EA68462BF50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..>..........B\... ...`....... ...................................`..................................[..O....`...............H...'...........Z..8............................................ ............... ..H............text...H<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................#\......H.......,...............D....n...Y........................................{9.....{:...V.(;.....}9.....}:......0..A........u........4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...... d..\| )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X...0..b........r...p......%..{9......%q.........-.&.+.......oB....%..{:......%q.........-.&.+.......oB....(C.....(D...^.(D......#...%...}....:.(D.....}....:.(D.....}....V!..W.}....sE..........(D.....(D.....(D.....{....:.(D.....}

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.WebTools.ProjectSystem.Components.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	881600
Entropy (8bit):	6.146223181724618
Encrypted:	false
SSDEEP:	12288:lXb54bkF5rlIk+1cdvk06bXgg4uAwhqHQANBCKysU/YcwLLaH0qtDmg:55E+rlIk+1rjYuFqHQANB3ysU/YVn+yg
MD5:	6F256C55D4DA2FF9B109C347FED079CA
SHA1:	33DC56728CC21FCBF923FEC8BD75951801EF03CE
SHA-256:	A9FDCAEC1DF35A6D4395E593FBFD06B5C8E48F85BEA801ED4EBAC06A0C57780B
SHA-512:	1DC70CB5F64E3E229723502E6A3FBE4AAFEE8F92691D4C1B76A3FB8CC250F71E16211A6C41A2848B6E4A8FBD9B684367DA5E39B5A09E4132010140F1C9A478F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..B...........a... ........... ....................................`.................................2a..O.......,............L...'..........h`..8............................................ ............... ..H............text....A... ...B.................. ..`.rsrc...,............D..............@..@.reloc...............J..............@..B................fa......H.......$...lV..............Xl..._........................................(;...^.(;..........%...}....:.(;.....}....:.(;.....}....:.(;.....}....V!...]N....s<........V..}......}.....(=.........(>.....{...."..}......{...."..}......0..@.......s?.....r...po@...&.rA..po@...&..o....,... oA...&..}oA...&.oB....(C....rI..po@...&..(....oD...&.ri..po@...&..(....oD...&....(.......N.....,...o.......(E....o....oF... )UU.Z(G....{....oH...X )UU.Z(G....{....oH...X*6..u....o.

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\MpRtp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	657960
Entropy (8bit):	6.2254541113614374
Encrypted:	false
SSDEEP:	12288:lzw+ohkB0AUxnilYsWGet93hIsm+qtNcucLTv0f4i8kC:l8qSA0niaDdc+oNpcLTMf4i8f
MD5:	C0ABE68ADC949767A8FCB7F6E412A10A
SHA1:	7203B04805BED5D62D60AE44F84D2F61BD1974D4
SHA-256:	18B1B282A4F6BD403E66586F9CE003C06A5469A9F973FB3382829CAE305040A5
SHA-512:	6F5817E59953355A1BB018AF5EA0E57920EE67E8FF7516D04B8513A60EDB6FE6BC5ED1AE082AD19A2F76C2C6DACD345C33B7B801B788B84F7BAB8A33924710D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Fk.5...f...f...fgl.g...f...fg..fgl.g...fgl.g...fgl.g<..fgl.g...fgl.gx..fgl.f...fgl.g...fRich...f........PE..d...6............." ................0..........^............................. ......E.....`A............................................................@........_......(<......P...p...T.......................(... ............... ...........@....................text...k........................... ..`.rdata...>.......@..................@..@.data...(C...0...4..................@....pdata..._.......`...L..............@..@.didat..0...........................@....rsrc...@...........................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	280752
Entropy (8bit):	6.509569076102415
Encrypted:	false
SSDEEP:	6144:JQDkWF90bW+bZwxc5gPmuNtNOTeHx8FkZIYCZq:0z0bW+6INqHx600q
MD5:	A9050F36854A9E7A60F30575081701F5
SHA1:	9518ED6B24A899A97B24358D8737A3F9DA15277E
SHA-256:	8B1068DC39A17F8D8E6D4CAF62BBB04B1F2241F08BFE88D0B34DE7B09321E8BB
SHA-512:	7C273CB2129A474698F7004A00DBCD9F34DF5769EA59BF521122DA5CDDDE7810C08FE6738EDE65E552EEE58B339E07D26690F21778A702904D1D88B808A28C97
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...D.$..........." ......................................................... ......H9....`...@......@............... ......................................pl..t"... ...(..........0#..T...............................................................H............text...Q........................... ..`.data...Lj.......p..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.PackageManagement.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	453016
Entropy (8bit):	6.0389539045831535
Encrypted:	false
SSDEEP:	6144:OTep0mSXsppzo+P1WYAN5sRNvMjjcH5qDnnFGPNGDGl2IBVwFjMI0ktlICEYJfup:MXsPhNW7HsRNZZ4FcQ04ICy
MD5:	F67A396E88B92B0A35E307613937DE35
SHA1:	73B059CABC14403F571B7552BE459FEB3D40746B
SHA-256:	3586FEE191679DE68C8B02299BC156DA01021C1EDC8DE2C4EE8B703853FDFEE8
SHA-512:	30E2954F80456A380FD985E56EF1EA450BEA0B1DEB3C11E88ECD61E02081729250D699210AD396911F37C570E1D5D7A2EBF43C540AFE18CABB2D3EE1B4C3D542
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1............" ..0..r...N.......... ........... ....................... ............`.....................................O........J...............'.............8............................................ ............... ..H............text....p... ...r.................. ..`.rsrc....J.......L...t..............@..@.reloc..............................@..B.......................H.......@~..............$^..@1..d.........................................{3.....{4...V.(5.....}3.....}4......0..A........u........4.,/(6....{3....{3...o7...,.(8....{4....{4...o9...... ZX.. )UU.Z(6....{3...o:...X )UU.Z(8....{4...o;...X...0..b........r...p......%..{3......%q.........-.&.+.......o<....%..{4......%q.........-.&.+.......o<....(=.....{>.....{?...V.(5.....}>.....}?....0..A........u........4.,/(6....{>....{>...o7...,.(8....{?....{?...o9...... ..:. )UU.

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\PilotEdit.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110228532
Entropy (8bit):	1.531750627424518
Encrypted:	false
SSDEEP:
MD5:	0D9B524228544CB2C010A34B20C1D31F
SHA1:	50D4FCA523B3CCA0CEA4EAA4F7EAB6B906AEEA7A
SHA-256:	202806A5AD89FBC94B6E46CBA5B4DC3741D428E0F1D9ACC99D7A74EB067B9263
SHA-512:	ABF460A645CF6AE6DDEFA4DF64144A870BEA3664A6F830DA1BE4D3FBB1C626542BBC74CB064BCA876E708A5E9BB49C12EAF65961CFBE26C75D3EEFD8FEDF2E2F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................9\|..-$....-2.v...-5..\|..-;./...-%....- ....Rich....................PE..L......g................."K..>.......-.......@K...@..........................@.......X......................................4.d......0$............................`SK...............................^.@............@K.(....-d.@....................text....!K......"K................. ..`.rdata.......@K..0...&K.............@..@.data.......pd......Vd.............@....rsrc........0$......`f.............@..@................................................................................................................................................................................................................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-16N32.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-6R8MJ.tmp\Setup.tmp

C:\Users\user\AppData\Local\Temp\is-DR2HE.tmp\Setup.tmp

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-NLL60.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\FxCopCommon.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.TeamFoundation.Deployment.Workflow.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.LanguageServices.TypeScript.resources.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\Microsoft.WebTools.ProjectSystem.Components.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\MpRtp.dll (copy)

C:\Users\user\AppData\Roaming\{73E5A364-F722-4251-A2AD-B613D6FDA6BD}\NuGet.Common.dll (copy)

Windows Analysis Report
Setup.exe