Edit tour

Windows Analysis Report
itLDZwgFNE.exe

Overview

General Information

Sample name:	itLDZwgFNE.exe
Analysis ID:	1576729
MD5:	8bb556dc8633bc4fe7bebc38bafcbf6a
SHA1:	6f4893d171d01a13a3e8a96db7150fd1b7c963ce
SHA256:	b385555834f9fbb1a2dab687cc7bcdfd760cbba033f69c04617b4506bb23b88c
Infos:

Detection

Flesh Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Flesh Stealer

Connects to many ports of the same IP (likely port scanning)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

itLDZwgFNE.exe (PID: 7676 cmdline: "C:\Users\user\Desktop\itLDZwgFNE.exe" MD5: 8BB556DC8633BC4FE7BEBC38BAFCBF6A)

cmd.exe (PID: 1520 cmdline: "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

chcp.com (PID: 1244 cmdline: chcp 65001 MD5: CA9A549C17932F9CAA154B5528EBD8D4)

netsh.exe (PID: 3320 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 5128 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: itLDZwgFNE.exe PID: 7676	JoeSecurity_FleshStealer	Yara detected Flesh Stealer	Joe Security

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All, CommandLine: "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\itLDZwgFNE.exe", ParentImage: C:\Users\user\Desktop\itLDZwgFNE.exe, ParentProcessId: 7676, ParentProcessName: itLDZwgFNE.exe, ProcessCommandLine: "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All, ProcessId: 1520, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: itLDZwgFNE.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: itLDZwgFNE.exe

ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: itLDZwgFNE.exe

Joe Sandbox ML: detected

Source: itLDZwgFNE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: itLDZwgFNE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Could not find a part of the path 'C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062'.0 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\User Data source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ur\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 89.23.100.233 ports 0,2,3,32048,4,8

Source: global traffic

TCP traffic: 192.168.11.20:49757 -> 89.23.100.233:32048

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 89.23.100.233 89.23.100.233
Source: Joe Sandbox View	IP Address: 89.23.100.233 89.23.100.233
Source: Joe Sandbox View	IP Address: 104.16.184.241 104.16.184.241

Source: Joe Sandbox View

ASN Name: MAXITEL-ASRU MAXITEL-ASRU

Source: unknown

DNS query: name: icanhazip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.233

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: 140.244.14.0.in-addr.arpa

Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/X
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/p
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA6BE000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101585163818.0000017DCA838000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D85000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DAE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DB8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D64000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1A2A000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101585163818.0000017DCA7F0000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA69C000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA6BE000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101585163818.0000017DCA838000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DB8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1A2A000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA69C000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DB8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1A2A000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA69C000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: itLDZwgFNE.exe, 00000000.00000002.101585163818.0000017DCA838000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DB8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1A2A000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA69C000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/FleshStealer
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/FleshStealert
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/about/gro.allizom.www.
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/contribute/gro.allizom.www.
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/central/gro.allizom.www.
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/privacy/firefox/gro.allizom.www.
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpgk
Source: tmp2CFD.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: itLDZwgFNE.exe, 00000000.00000000.100310932452.0000017DAFB56000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.exe" vs itLDZwgFNE.exe
Source: itLDZwgFNE.exe	Binary or memory string: OriginalFilenameSystem.exe" vs itLDZwgFNE.exe

Source: itLDZwgFNE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: itLDZwgFNE.exe, grIcMJRLeSLw.cs

Base64 encoded string: 'L2Mgc3RhcnQgL2IgcG93ZXJzaGVsbCDigJNFeGVjdXRpb25Qb2xpY3kgQnlwYXNzIFN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICci', 'U29mdHdhcmVcQ2xhc3Nlc1xtcy1zZXR0aW5nc1xTaGVsbFxPcGVuXGNvbW1hbmQ=', 'QUNnYktLOG8veWpmS084b1Z5ajJLRElvUVNpQUtFQW9KQ2dzS0E4b0pTZ2tLQUFvUUNocEtKSW96aWk5S1A4byt5Z3ZLQjRvQVNnZ0FBPT0=', 'QUNnQUtBQW9BQ2lKS0Iwb0V5aTdLT1FvZUNnaktFQW9BQ2dBS0FBb0FDZ0FLQ0FvR2lqMEtING9YeWdKS0NNb1FDZ0FLQUFvQUNnZ0FBPT0=', 'QUNnQUtBQW80Q2p6S01Zb0ZDZ0pLQThvL3loRUtMRW81Q2lFS01Bb3BDajBLRWNvOENoZktLa29BU2dnS0hRb2Z5aEVLQUFvQUNnZ0FBPT0=', 'QUNnQUtLQW9BU2lBS0E0b0FDZ0FLQmdvL0NoL0tEc29HU2pOS01Bb1BDZzVLRjhvL3lqRUtNTW9BQ2dBS0Jnb1JDZ0lLRVFvQUNnZ0FBPT0=', 'QUNnQUtBY29nQ2pzS1BZbzdDaHJLSXNvZkNpM0tGY29nQ2lYS0Frb0p5aEFLTW9vdUNqbktORW85Q2p0S1BRbzlDaEVLRGdvQUNnZ0FBPT0=', 'QUNpNEtBQW9DQ2dKS0Jzb055aitLUDhveHlqdktPY295eWlKS0gwb0RTaVpLUDBvemlqL0tQOG9KeWdmS0Fzb0FTaEdLQUFvUkNnZ0FBPT0=', 'QUNpNEtJQW9RQ2dBS0lBb1lDZ1lLSWtvZnlqL0tQOG8veWhXS0FFb3NDai9LUDhvL3lqL0tFZ29FU2dpS01Bb0FDam5LRUFvUnlnZ0FBPT0=', 'QUNnWUtFNG9EeWdXS0JNb0VpZ1NLRG9vL3loSUtMY29neWdCS0FBb0RpZzhLSDRveVNqL0tBY29BQ2dBS0Fnb2dTZ0pLS3NvQUNnZ0FBPT0=', 'QUNnQUtLRW9BQ2dRS0VBb0FDZ0FLQUFvT1NqL0tPNG9JaWhIS0FBb3VDZ1FLUFVvdnlnTEtBQW9BQ2dBS0FBb0JpZ0FLRXdvQUNnZ0FBPT0=', 'QUNnQUtBQW9veWdBS0Fnb2hDZ0FLQUFvQUNnSUtCa29SeWhHS0JBb3VDaTRLQXNvQVNnQUtBQW9BQ2dBS0Fvb0FDaGNLQUFvQUNnZ0FBPT0=', 'QUNnQUtBQW9BQ2dSS01Rb0FDZ1JLSVFvUUNnQUtBQW8veWptS09RbzlDaitLQUFvQUNnQUtFQW9FQ2dCS09Bb0NpZ0FLQUFvQUNnZ0FBPT0=', 'QUNnQUtBQW9BQ2dBS0Fnb0VpaWtLSDhvQ0NnUUtBQW9OQ2l0S1A4bzdTZ3VLQUFvRWlncEtQNG9aQ2dhS0FFb0FDZ0FLQUFvQUNnZ0FBPT0=', 'QUNnQUtBQW9BQ2dBS0FBb0FDZ0FLQWdvRUNnQUtDUW9BQ2lJS1BZb1dDZ0FLQ1FvRkNnQ0tBRW9BQ2dBS0FBb0FDZ0FLQUFvQUNnZ0FBPT0=', 'QUNnQUtBQW9BQ2dBS0FBb0FDZ0FLQUFvQUNnQUtBQW9BQ2dBS0Jrb0FDZ0FLQUFvQUNnQUtBQW9BQ2dBS0FBb0FDZ0FLQUFvQUNnZ0FDQUE=', 'Q1FBSkFEM1lzOXdnQUVNQWNnQmxBR1FBYVFCMEFFTUFZUUJ5QUdRQWN3QTZBQ0FB', 'Q1FBSkFEM1lGdDBnQUVJQWJ3QnZBR3NBYlFCaEFISUFhd0J6QURvQUlBQT0=', 'Q1FBSkFEM1k1dHdnQUVRQWJ3QjNBRzRBYkFCdkFHRUFaQUJ6QURvQUlBQT0=', 'Q1FBSkFEellxTjhnQUZJQVpRQnpBSFFBYndCeUFHVUFWQUJ2QUdzQVpRQnVBSE1BT2dBZ0FBPT0=', 'Q1FBSkFEN1l5dDBnQUZjQVlRQnNBR3dBWlFCMEFITUFPZ0FnQUE9PQ==', 'Q1FCRUp3LytJQUJYQUdFQWJBQnNBR1VBZEFCekFDQUFRUUJ3QUhBQU9nQWdBQT09', 'Q1FBKzJLTGRJQUJRQUdrQVpBQm5BR2tBYmdBZ0FFRUFjQUJ3QURvQUlBQT0=', 'Q1FBOTJIN2NJQUJFQUdrQWN3QmpBRzhBY2dCa0FDQUFWQUJ2QUdzQVpRQnVBSE1BT2dBZ0FBPT0=', 'Q1FBSUp3LytJQUJVQUdVQWJBQmxBR2NBY2dCaEFHMEFJQUJ6QUdVQWN3QnpBR2tBYndCdUFITUE=', 'Q1FBQkpnLytJQUJUQUdzQWVRQndBR1VBSUFCekFHVUFjd0J6QUdrQWJ3QnVBQT09', 'Q1FBOTJIN2NJQUJFQUdrQWN3QmpBRzhBY2dCa0FDQUFkQUJ2QUdzQVpRQnVBQT09', 'Q1FBOTJLM2NJQUJUQUdrQVp3QnVBR0VBYkFBZ0FITUFaUUJ6QUhNQWFRQnZBRzRB', 'Q1FBODJLN2ZJQUJUQUhRQVpRQmhBRzBBSUFCekFHVUFjd0J6QUdrQWJ3QnVBQT09', 'Q1FBODJLN2ZJQUJWQUhBQWJBQmhBSGtBSUFCekFHVUFjd0J6QUdrQWJ3QnVBQT09', 'Q1FDWkpnLytJQUJRQUhJQWJ3QmpBR1VBY3dCekFHVUFjd0E2QUNBQQ==', 'W1x3LV17MjQsMjZ9XC5bXHctXXs2fVwuW1x3LV17MjUsMTEwfXxtZmFcLlthLXpBLVowLTlfXC1dezg0fQ==', 'U29mdHdhcmVcTWljcm9zb2Z0XE9mZmljZVwxNS4wXE91dGxvb2tcUHJvZmlsZXNcT3V0bG9va1w5Mzc1Q0ZGMDQxMzExMWQzQjg4QTAwMTA0QjJBNjY3Ng==', 'U29mdHdhcmVcTWljcm9

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/1@2/2

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

File created: C:\Users\user\AppData\Local\Temp\downloadedFile.exe

Jump to behavior

Source: itLDZwgFNE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: itLDZwgFNE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B45000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B66000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D04000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B03000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B87000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AE2000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C5E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D8F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA695000.00000004.00000020.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1D69000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1DB3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101585163818.0000017DCA834000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8B000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199B000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE5000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: itLDZwgFNE.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\itLDZwgFNE.exe "C:\Users\user\Desktop\itLDZwgFNE.exe"
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\findstr.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: itLDZwgFNE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: itLDZwgFNE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Could not find a part of the path 'C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062'.0 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\User Data source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ur\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB21F2000.00000004.00000800.00020000.00000000.sdmp

Source: itLDZwgFNE.exe

Static PE information: 0x9A13B17D [Thu Nov 30 18:31:25 2051 UTC]

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Code function: 0_2_00007FFE605000BD pushad ; iretd

0_2_00007FFE605000C1

Source: itLDZwgFNE.exe, JyXPYwFPsUXzoBXySOFA.cs	High entropy of concatenated method names: 'cRDxgMehNgx', 'IJJSKkqaHYtNHzq', 'eOgneCBoZJOrIcMWYxdXXCQoP', 'ckOjcQUrtQSKjaxwbFBOEo', 'CUiochHniXH', 'FMTKmwQbLnikunoKlV', 'xLGJWfxZhpodCFsJawu', 'zQGhyrydyyNiJXzMJP', 'BfUAubfEitKQjbvTANNmwRYv'
Source: itLDZwgFNE.exe, yPKKzGBmWpkszYDBPvleBwIK.cs	High entropy of concatenated method names: 'merTkzNpseRJ', 'pVMtqNbFrWidEsOytBGA', 'NbKTmpWCGt', 'riFQRHGuiCuIIpfGzrzdL', 'ectCaEYEDlcw', 'VmyhlvLRzSSCdGiXLGPai', 'dWPhBWezJfL', 'JUBJNhzrfKb', 'xxqgreNWDRJbSEupmzImqZwOW', 'siaqYTvPjD'
Source: itLDZwgFNE.exe, grIcMJRLeSLw.cs	High entropy of concatenated method names: 'iBjHlqDSCnkVvZFOL', 'UPwwAOQiwNbJvxMLc', 'RBrvFqdDYGRj', 'xStqhamBVqDup', 'srnJjwvwKhZJGSwqKRMCeqC', 'elqIwKoBPzlM', 'winPBIMRXUTEffmhnMBog', 'xGnAzsYtGhkFNiZmdiq', 'HRXDQeCTcmjXERkhcAJTtd', 'lUaRDIBjTyrXgi'

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Speed FROM Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PnPEntity

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Speed FROM Win32_PhysicalMemory

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Memory allocated: 17DAFF80000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Memory allocated: 17DC9970000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Window / User API: threadDelayed 1597			Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Window / User API: threadDelayed 980			Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Version FROM Win32_BIOS

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Last function: Thread delayed

Source: itLDZwgFNE.exe, 00000000.00000002.101582717376.0000017DCA51E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure DriverSystemEnableMicrosoft Hyper-V Virtualization Infrastructure Driver

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior

Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ACTIVE WINDOW: Program Managert
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ACTIVE WINDOW: Program Manager
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ACTIVE WINDOW: Program Manager2L
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ACTIVE WINDOW: Program Managerp^L

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Queries volume information: C:\Users\user\Desktop\itLDZwgFNE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\itLDZwgFNE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Flesh Stealer

Source: Yara match

File source: Process Memory Space: itLDZwgFNE.exe PID: 7676, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1FC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Application Data Electrum
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Application Data Jaxx
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet2L
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Ethereum\keystore2L
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1FC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Application Data ExodusWeb3
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 5C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets2L
Source: itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Ethereum\keystore2L

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Mozilla\Firefox\Profiles\kzpbmws1.default\logins.json	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\itLDZwgFNE.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Remote Access Functionality

Yara detected Flesh Stealer

Source: Yara match

File source: Process Memory Space: itLDZwgFNE.exe PID: 7676, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	33 Virtualization/Sandbox Evasion	1 OS Credential Dumping	421 Security Software Discovery	Remote Services	1 Email Collection	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	33 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	154 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
itLDZwgFNE.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
itLDZwgFNE.exe	100%	Avira	TR/Spy.Agent.iagwx
itLDZwgFNE.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
icanhazip.com	104.16.184.241	true	false		high
140.244.14.0.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/FleshStealer	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pki.goog/gtsr1/gtsr1.crl0W	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pki.goog/repository/0	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com/p	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pki.goog/repo/certs/gtsr1.der04	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B61000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1DBD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A9E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC199E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AC6000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C1E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BE7000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CBC000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1C58000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B1F000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1BA3000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D43000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B40000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1AFE000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1D8E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1ADD000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1B82000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CFB000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1CE8000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/FleshStealert	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.	tmp2CFD.tmp.dat.0.dr	false		high
http://icanhazip.com/X	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C6E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C2C000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C6E000.00000004.00000800.00020000.00000000.sdmp, itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1C86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	tmp2CFD.tmp.dat.0.dr	false		high
https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire	tmp2CFD.tmp.dat.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	itLDZwgFNE.exe, 00000000.00000002.101570783913.0000017DB1971000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	itLDZwgFNE.exe, 00000000.00000002.101575265421.0000017DC1A7D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.23.100.233	unknown	Russian Federation		48687	MAXITEL-ASRU	true
104.16.184.241	icanhazip.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576729
Start date and time:	2024-12-17 13:33:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	itLDZwgFNE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/1@2/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target itLDZwgFNE.exe, PID 7676 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: itLDZwgFNE.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.23.100.233	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	89.23.100.233:1490/upload
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	89.23.100.233:1490/upload
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	89.23.100.233:1488/upload
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	89.23.100.233:1489/upload
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	89.23.100.233:1488/upload
104.16.184.241	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	icanhazip.com/
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
icanhazip.com	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	104.16.184.241
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.16.185.241
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	104.16.185.241
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.16.185.241
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.185.241
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	104.16.184.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	https://sos-at-vie-1.exo.io/ilbuck/sato/process/continue-after-check-vr2.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	https://www.cadbury.com@nmlr.xyz/christmas-hamper	Get hash	malicious	Unknown	Browse	104.26.9.83
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	104.21.32.1
	Doc_23-03-27.js	Get hash	malicious	Unknown	Browse	104.21.80.1
	c2.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	23d5f89e-2c54-ee19-3778-06a4bec842b9.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	https://protect.checkpoint.com/v2/r01/___https://link.edgepilot.com/xdg~fiaa57dVgx2DluRTp19jF8WMmYfWl?z=myyux:ddjrfnq.ynintwjuqD.htrdhdjOBhER6ylHFZFTGu9JoBlVNMIw79G-bMOgKn5Sf55EkuFm_s/LOKQ2pPEoswuEsuU2A7WKVctU0F0LxRir4fJPhZrPOzTgvHZltxJFSX/jFwCJW7F4BtO0gjUt6gM8NiU9g~uEaD_oE2wiDMlq2GDu8zhwYySQbzr0kVZGcn8s4Dk7cEDvSl6XRkaXaP7a5RqmSqgUx7-yk6g8/s-FxFFU__PNlcuV___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmRkMGI4MjA2MTNmMjg1YzMyNTM2YjE2YzI0MjAzMGU1Ojc6MzQ1NjphZDU1ODAwMDRlN2FjYWY0Nzk3ODJmN2U3MjI1MmNkMTUyZWIyNWZlZjgyYTY4N2M3ZWVjN2E0NjVmZjU3M2E4Omg6VDpU	Get hash	malicious	Unknown	Browse	104.16.123.96
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.129.27
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
MAXITEL-ASRU	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	89.23.100.233
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	89.23.100.42
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	89.23.100.42
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	89.23.100.233
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	Installer_setup32_64x.exe	Get hash	malicious	LummaC, Stealc	Browse	89.23.96.109
	9fGsCDYKLV.exe	Get hash	malicious	Flesh Stealer	Browse	89.23.100.233

Process:	C:\Users\user\Desktop\itLDZwgFNE.exe
File Type:	SQLite 3.x database, user version 57, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 2, database pages 41, cookie 0x21, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.035631294721445904
Encrypted:	false
SSDEEP:	192:bZjnkYjcoBMcygNDI7oslTYBIQg6Ism2Vspvp0:bZTVTBMcygNDuT1l62p
MD5:	59E4A8110FA2BCC012E341B93E96E93D
SHA1:	EE08810B0CE857F01170C08A24B9D438B64D577D
SHA-256:	3A85F2FC349A7E431EA6F1FC4568C99C1918D478AD6FE6445D560EF00395DB40
SHA-512:	2AD00B0FCBE4FC37ECAA68C16BE32A904D682A23ACF5B39BCECF5DC280E23933FDD5A0D2A92A45F2C77618CA7466334AFEB1EAA7EA07BF4E043282B31039E8FF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......)...........!...................9..................................S`....(e......}$\|.\|N{.{sz.z{z.yAx.x!w.v.wZu7tNt.s.s\r.rJq.p.q.p.o.o.o.m.mal&k.k.g.g3f.f.e.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.589877734824581
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	itLDZwgFNE.exe
File size:	275'968 bytes
MD5:	8bb556dc8633bc4fe7bebc38bafcbf6a
SHA1:	6f4893d171d01a13a3e8a96db7150fd1b7c963ce
SHA256:	b385555834f9fbb1a2dab687cc7bcdfd760cbba033f69c04617b4506bb23b88c
SHA512:	36e01d1256fdf01697bd1ce8875fab906e9c3a983acd965ca82261ae48e0fc43bf1d3400264c0f71d406d0fcfebd1ad8c875db535e5eebc386c2be2e46d05a2f
SSDEEP:	6144:I/M4uCQW7bqrhB3uag7I8F0E7hewZbcZSdHE8:I/juXabqrhpCE6Z9Iy
TLSH:	7D44C72C2BED780CF9AE4B7D5C9E9D6BC66854522C03B753794335620F11A8CEE8B0E5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}............."...0..,...........J... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x444ace
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9A13B17D [Thu Nov 30 18:31:25 2051 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x44a74	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x5b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x42ad4	0x42c00	c0d93f4ad2f5f9220bd269f77cb48894	False	0.4444054307116105	data	5.604321866775138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x5b0	0x600	82b22d07923431b220994f8fe6e9e4db	False	0.423828125	data	4.072930934952341	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	c1efac4e09d49e850418cb15d9c20967	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x460a0	0x324	data			0.43407960199004975
RT_MANIFEST	0x463c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 13:35:21.018802881 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:35:21.153712988 CET	80	49756	104.16.184.241	192.168.11.20
Dec 17, 2024 13:35:21.154006004 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:35:21.154238939 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:35:21.289203882 CET	80	49756	104.16.184.241	192.168.11.20
Dec 17, 2024 13:35:21.313793898 CET	80	49756	104.16.184.241	192.168.11.20
Dec 17, 2024 13:35:21.366749048 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:35:28.503832102 CET	49757	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:28.775175095 CET	32048	49757	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:29.286859035 CET	49757	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:29.558310986 CET	32048	49757	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:30.067974091 CET	49757	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:30.344384909 CET	32048	49757	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:30.849026918 CET	49757	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:31.120723009 CET	32048	49757	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:31.630090952 CET	49757	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:31.901422977 CET	32048	49757	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:32.411339998 CET	49758	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:32.689842939 CET	32048	49758	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:33.192255974 CET	49758	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:33.471087933 CET	32048	49758	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:33.973411083 CET	49758	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:34.252229929 CET	32048	49758	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:34.754467964 CET	49758	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:35.032985926 CET	32048	49758	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:35.535531998 CET	49758	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:35.814042091 CET	32048	49758	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:36.316754103 CET	49759	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:36.590303898 CET	32048	49759	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:37.097594976 CET	49759	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:37.371217966 CET	32048	49759	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:37.878727913 CET	49759	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:38.152307034 CET	32048	49759	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:38.659811020 CET	49759	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:38.933578968 CET	32048	49759	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:39.440934896 CET	49759	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:39.715604067 CET	32048	49759	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:40.222119093 CET	49760	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:40.499809027 CET	32048	49760	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:41.003108978 CET	49760	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:41.281008959 CET	32048	49760	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:41.784145117 CET	49760	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:42.062129974 CET	32048	49760	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:42.565264940 CET	49760	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:42.842952013 CET	32048	49760	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:43.346339941 CET	49760	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:43.624193907 CET	32048	49760	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:44.127603054 CET	49761	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:44.399502039 CET	32048	49761	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:44.908449888 CET	49761	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:45.180248976 CET	32048	49761	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:45.689532042 CET	49761	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:45.961231947 CET	32048	49761	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:46.470645905 CET	49761	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:46.742486000 CET	32048	49761	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:47.251708984 CET	49761	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:47.523269892 CET	32048	49761	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:48.032985926 CET	49762	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:48.304872990 CET	32048	49762	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:48.813882113 CET	49762	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:49.085381031 CET	32048	49762	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:49.595010996 CET	49762	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:49.866904974 CET	32048	49762	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:50.376013994 CET	49762	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:50.648071051 CET	32048	49762	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:51.157052040 CET	49762	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:51.428772926 CET	32048	49762	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:51.938426018 CET	49763	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:52.216200113 CET	32048	49763	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:52.719191074 CET	49763	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:52.996777058 CET	32048	49763	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:53.500325918 CET	49763	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:53.777882099 CET	32048	49763	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:54.281392097 CET	49763	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:54.559442043 CET	32048	49763	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:55.062473059 CET	49763	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:55.340190887 CET	32048	49763	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:55.843786001 CET	49765	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:56.122361898 CET	32048	49765	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:56.624665022 CET	49765	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:56.905966997 CET	32048	49765	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:57.421361923 CET	49765	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:57.700038910 CET	32048	49765	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:58.202435017 CET	49765	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:58.481218100 CET	32048	49765	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:58.983549118 CET	49765	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:35:59.262128115 CET	32048	49765	89.23.100.233	192.168.11.20
Dec 17, 2024 13:35:59.764785051 CET	49766	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:00.036755085 CET	32048	49766	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:00.545727968 CET	49766	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:00.817433119 CET	32048	49766	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:01.326720953 CET	49766	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:01.598526955 CET	32048	49766	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:02.107868910 CET	49766	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:02.380311966 CET	32048	49766	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:02.888936996 CET	49766	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:03.162641048 CET	32048	49766	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:03.670249939 CET	49767	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:03.944114923 CET	32048	49767	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:04.451153994 CET	49767	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:04.725125074 CET	32048	49767	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:05.232074976 CET	49767	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:05.505954981 CET	32048	49767	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:06.013181925 CET	49767	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:06.287733078 CET	32048	49767	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:06.794286013 CET	49767	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:07.068125010 CET	32048	49767	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:07.575496912 CET	49768	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:07.846873999 CET	32048	49768	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:08.356467009 CET	49768	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:08.627720118 CET	32048	49768	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:09.137537956 CET	49768	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:09.408716917 CET	32048	49768	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:09.918612003 CET	49768	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:10.190192938 CET	32048	49768	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:10.699671030 CET	49768	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:10.971478939 CET	32048	49768	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:11.481081963 CET	49769	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:11.752902031 CET	32048	49769	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:12.261820078 CET	49769	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:12.534415007 CET	32048	49769	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:13.043169975 CET	49769	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:13.314945936 CET	32048	49769	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:13.823951960 CET	49769	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:14.095765114 CET	32048	49769	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:14.605139971 CET	49769	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:14.876756907 CET	32048	49769	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:15.386358023 CET	49770	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:15.657569885 CET	32048	49770	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:16.167210102 CET	49770	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:16.438414097 CET	32048	49770	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:16.948249102 CET	49770	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:17.219460964 CET	32048	49770	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:17.729370117 CET	49770	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:18.000597000 CET	32048	49770	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:18.510449886 CET	49770	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:18.781541109 CET	32048	49770	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:19.291745901 CET	49771	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:19.565701962 CET	32048	49771	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:20.072582006 CET	49771	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:20.346653938 CET	32048	49771	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:20.853717089 CET	49771	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:21.127707005 CET	32048	49771	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:21.634927034 CET	49771	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:21.909240007 CET	32048	49771	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:22.415827990 CET	49771	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:22.689805031 CET	32048	49771	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:23.197125912 CET	49772	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:23.468981028 CET	32048	49772	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:23.978060961 CET	49772	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:24.250243902 CET	32048	49772	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:24.759114027 CET	49772	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:25.033746004 CET	32048	49772	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:25.540139914 CET	49772	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:25.812247038 CET	32048	49772	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:26.321260929 CET	49772	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:26.593210936 CET	32048	49772	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:27.102530956 CET	49773	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:27.373953104 CET	32048	49773	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:27.883404016 CET	49773	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:28.154858112 CET	32048	49773	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:28.664521933 CET	49773	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:28.935950041 CET	32048	49773	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:29.445538998 CET	49773	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:29.716777086 CET	32048	49773	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:30.226696968 CET	49773	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:30.498162985 CET	32048	49773	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:31.007950068 CET	49774	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:31.281455040 CET	32048	49774	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:31.788805962 CET	49774	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:32.062516928 CET	32048	49774	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:32.569859982 CET	49774	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:32.843360901 CET	32048	49774	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:33.351267099 CET	49774	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:33.624761105 CET	32048	49774	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:34.131982088 CET	49774	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:34.406930923 CET	32048	49774	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:34.913393021 CET	49775	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:35.187001944 CET	32048	49775	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:35.694175959 CET	49775	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:35.967890024 CET	32048	49775	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:36.475203991 CET	49775	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:36.748820066 CET	32048	49775	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:37.256335020 CET	49775	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:37.530214071 CET	32048	49775	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:38.037415028 CET	49775	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:38.311096907 CET	32048	49775	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:38.818717003 CET	49776	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:39.090420008 CET	32048	49776	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:39.599586010 CET	49776	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:39.871144056 CET	32048	49776	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:40.380651951 CET	49776	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:40.652292967 CET	32048	49776	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:41.161741972 CET	49776	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:41.433090925 CET	32048	49776	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:41.942780972 CET	49776	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:42.214551926 CET	32048	49776	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:42.724204063 CET	49777	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:42.997884989 CET	32048	49777	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:43.505017042 CET	49777	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:43.778886080 CET	32048	49777	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:44.286102057 CET	49777	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:44.560134888 CET	32048	49777	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:45.067187071 CET	49777	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:45.341753960 CET	32048	49777	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:45.848239899 CET	49777	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:46.122178078 CET	32048	49777	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:46.629518986 CET	49778	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:46.907959938 CET	32048	49778	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:47.410388947 CET	49778	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:47.688992977 CET	32048	49778	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:48.191457033 CET	49778	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:48.469919920 CET	32048	49778	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:48.972563028 CET	49778	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:49.250943899 CET	32048	49778	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:49.753640890 CET	49778	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:50.031927109 CET	32048	49778	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:50.535012007 CET	49779	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:50.808543921 CET	32048	49779	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:51.315831900 CET	49779	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:51.591605902 CET	32048	49779	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:52.096837044 CET	49779	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:52.370769024 CET	32048	49779	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:52.877948046 CET	49779	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:53.151400089 CET	32048	49779	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:53.659069061 CET	49779	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:53.932866096 CET	32048	49779	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:54.440341949 CET	49780	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:54.711878061 CET	32048	49780	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:55.221126080 CET	49780	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:55.492705107 CET	32048	49780	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:56.002167940 CET	49780	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:56.274192095 CET	32048	49780	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:56.783358097 CET	49780	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:57.055073023 CET	32048	49780	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:57.564433098 CET	49780	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:57.836285114 CET	32048	49780	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:58.345710039 CET	49781	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:58.624326944 CET	32048	49781	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:59.126549006 CET	49781	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:36:59.405356884 CET	32048	49781	89.23.100.233	192.168.11.20
Dec 17, 2024 13:36:59.907641888 CET	49781	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:00.188472033 CET	32048	49781	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:00.688771963 CET	49781	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:00.967222929 CET	32048	49781	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:01.330212116 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:37:01.465923071 CET	80	49756	104.16.184.241	192.168.11.20
Dec 17, 2024 13:37:01.466156006 CET	49756	80	192.168.11.20	104.16.184.241
Dec 17, 2024 13:37:01.469839096 CET	49781	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:01.747850895 CET	32048	49781	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:02.251035929 CET	49782	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:02.524334908 CET	32048	49782	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:03.032032967 CET	49782	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:03.305521011 CET	32048	49782	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:03.813082933 CET	49782	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:04.086643934 CET	32048	49782	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:04.594090939 CET	49782	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:04.867360115 CET	32048	49782	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:05.375221014 CET	49782	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:05.648710966 CET	32048	49782	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:06.156414986 CET	49783	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:06.427707911 CET	32048	49783	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:06.937355995 CET	49783	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:07.208724976 CET	32048	49783	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:07.718534946 CET	49783	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:07.990845919 CET	32048	49783	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:08.499588013 CET	49783	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:08.770790100 CET	32048	49783	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:09.280536890 CET	49783	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:09.552073002 CET	32048	49783	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:10.061913967 CET	49784	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:10.335161924 CET	32048	49784	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:10.842897892 CET	49784	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:11.116108894 CET	32048	49784	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:11.623859882 CET	49784	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:11.898390055 CET	32048	49784	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:12.404855013 CET	49784	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:12.678250074 CET	32048	49784	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:13.185978889 CET	49784	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:13.460630894 CET	32048	49784	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:13.967384100 CET	49785	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:14.238765001 CET	32048	49785	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:14.748106003 CET	49785	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:15.019666910 CET	32048	49785	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:15.529243946 CET	49785	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:15.800429106 CET	32048	49785	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:16.310303926 CET	49785	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:16.581650019 CET	32048	49785	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:17.091321945 CET	49785	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:17.362507105 CET	32048	49785	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:18.950439930 CET	49786	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:19.224471092 CET	32048	49786	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:19.731815100 CET	49786	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:20.005414963 CET	32048	49786	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:20.513066053 CET	49786	32048	192.168.11.20	89.23.100.233
Dec 17, 2024 13:37:20.786638021 CET	32048	49786	89.23.100.233	192.168.11.20
Dec 17, 2024 13:37:21.294246912 CET	49786	32048	192.168.11.20	89.23.100.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 13:35:20.872988939 CET	52966	53	192.168.11.20	1.1.1.1
Dec 17, 2024 13:35:21.014595985 CET	53	52966	1.1.1.1	192.168.11.20
Dec 17, 2024 13:35:21.320456982 CET	61417	53	192.168.11.20	1.1.1.1
Dec 17, 2024 13:35:21.456497908 CET	53	61417	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 13:35:20.872988939 CET	192.168.11.20	1.1.1.1	0x42cc	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 13:35:21.320456982 CET	192.168.11.20	1.1.1.1	0xb8ff	Standard query (0)	140.244.14.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 13:35:21.014595985 CET	1.1.1.1	192.168.11.20	0x42cc	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Dec 17, 2024 13:35:21.014595985 CET	1.1.1.1	192.168.11.20	0x42cc	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Dec 17, 2024 13:35:21.456497908 CET	1.1.1.1	192.168.11.20	0xb8ff	Name error (3)	140.244.14.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49756	104.16.184.241	80	7676	C:\Users\user\Desktop\itLDZwgFNE.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 13:35:21.154238939 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Dec 17, 2024 13:35:21.313793898 CET	538	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 12:35:21 GMT Content-Type: text/plain Content-Length: 16 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=uYBjwK44azWs0Pw2gmc1cEnR0fgbn_fOSsCVmANvzeI-1734438921-1.0.1.1-5BGHrQd6sg18ldGte1_F8im.XYG88nVlcTVlhTH7Zb85vMFhoLjeiFRDYzOV6f1bjEC0Nzr8r4lsi1fVViym6g; path=/; expires=Tue, 17-Dec-24 13:05:21 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8f36f3d9a8dc32e0-JAX alt-svc: h3=":443"; ma=86400 Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 30 35 0a Data Ascii: 102.129.152.205

Target ID:	0
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\itLDZwgFNE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\itLDZwgFNE.exe"
Imagebase:	0x17dafb10000
File size:	275'968 bytes
MD5 hash:	8BB556DC8633BC4FE7BEBC38BAFCBF6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Imagebase:	0x7ff76f1c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62eec0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff62eec0000
File size:	14'848 bytes
MD5 hash:	CA9A549C17932F9CAA154B5528EBD8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff765910000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:35:09
Start date:	17/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff7ea1e0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFE60505D68 Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

SL_^, xrefs: 00007FFE60505DBD
;L_^, xrefs: 00007FFE60505F2D

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID: ;L_^$SL_^
API String ID: 0-259380329
Opcode ID: 7a946809e38a9604260d73cbc6c2539f25042a8e82305cbc4265e36cb5fd25cd
Instruction ID: 46f60378a4ce8779bb83e44624f280c92ef1bfc9ab782a00a8035ca37fe8f2a7
Opcode Fuzzy Hash: 7a946809e38a9604260d73cbc6c2539f25042a8e82305cbc4265e36cb5fd25cd
Instruction Fuzzy Hash: 3E41B321A29A1E8FF7A9A76844192BD36D2EF49304F5401BAD64FD73F3DD1C6A018341

Function 00007FFE60505EB8 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

;L_^, xrefs: 00007FFE60505F2D

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID: ;L_^
API String ID: 0-130345473
Opcode ID: f5c8075eefc1a46a9c64f1594b62fb047d6c00024433fbd57af9362ab15ebcc9
Instruction ID: ab109db0bbe31098492ba70a9b391949c13bd424f75e3c9a9bd41cc7ee32ecda
Opcode Fuzzy Hash: f5c8075eefc1a46a9c64f1594b62fb047d6c00024433fbd57af9362ab15ebcc9
Instruction Fuzzy Hash: 4301FB31F29A2D8AEBA8B7B8041A2BD21C2AF482117540479E10EC33B3EC2969414241

Function 00007FFE60505EF8 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

;L_^, xrefs: 00007FFE60505F2D

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID: ;L_^
API String ID: 0-130345473
Opcode ID: 73ee24e58da3ded3ed83d5ef886bd2efc62603ad5a416f9392a80f14aedc8d7a
Instruction ID: decf5436d7bdbae5b4fab439d2d5091fb1e4ec8f0096e8ab804778c19fe8bba7
Opcode Fuzzy Hash: 73ee24e58da3ded3ed83d5ef886bd2efc62603ad5a416f9392a80f14aedc8d7a
Instruction Fuzzy Hash: 2EF04F21B29A2D8BE678B7BC041E2BD21C2AF88211B980579D51EC33E3EC2DA9414242

Function 00007FFE605055E8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5350000fc9569401349d9e822a39798680bdee38c3fbc1e2d8dbe6e69009a49c
Instruction ID: 82275186553f9b63aafcc0ab7ec602e543d863796c3e250f3546ad0982876adb
Opcode Fuzzy Hash: 5350000fc9569401349d9e822a39798680bdee38c3fbc1e2d8dbe6e69009a49c
Instruction Fuzzy Hash: 7751F831E19A1D9FEB68EB7884197BD77E1EF69311B4000BED50DD73B2EE2958418780

Function 00007FFE605059B0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c08f327267c47f58b32591d93af575439c113d359db80b0beff6b2030644b16
Instruction ID: f9d28b2c23f85f3b507d7cec6c16d7c8a816807f8f6ef5c86c6cae4a02b09695
Opcode Fuzzy Hash: 6c08f327267c47f58b32591d93af575439c113d359db80b0beff6b2030644b16
Instruction Fuzzy Hash: A5411324E1DBCE8FEB42A77888156EE7FF0EF56211B0405FAC18ADB1F3D92818068351

Function 00007FFE6050583F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9617b7d8419ae01b9ab16d020d7527b518a5c6451c21bedb0d4ada4c5e3c8d
Instruction ID: d0e495f55fbdb90889a02c40b8fdb5b0270f6baa86290faaea9b006af73cb675
Opcode Fuzzy Hash: 3c9617b7d8419ae01b9ab16d020d7527b518a5c6451c21bedb0d4ada4c5e3c8d
Instruction Fuzzy Hash: 11218611E2DA9F9FEB5673BC08265FD6AD0AF85210B5001F5D64FDB2F7DC1C69064241

Function 00007FFE60505F84 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76c1a47387aa55ee367361ff26ad737faf4ea7b285a710f76d5180a30259bf6
Instruction ID: 80fc8ce8d73547a98e1a855c2fcf5ffe9fe200c32f2ad75ae8c2dab42db48f46
Opcode Fuzzy Hash: a76c1a47387aa55ee367361ff26ad737faf4ea7b285a710f76d5180a30259bf6
Instruction Fuzzy Hash: 4421861471DA8A8FF746A3FC48267B9B6D2AF95300F6442BDD14ED72F7CC1869018712

Function 00007FFE6050603C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b403c8b024cf845d1d7b9733981ee39e9e57a34ee07394d09e0ba6dc33df69f1
Instruction ID: 37781981805cad4815ee6e9f2043be969e951622687f824dca1db7d38294fd54
Opcode Fuzzy Hash: b403c8b024cf845d1d7b9733981ee39e9e57a34ee07394d09e0ba6dc33df69f1
Instruction Fuzzy Hash: B321A120A1965A8FE36AAB3844257BE66D2EF46300F5006BDD24FCB3F7DE5D69858301

Function 00007FFE60505B29 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfeeed7051acf716762969c1cd946338a52268239c2850942876407cd859a26
Instruction ID: cbbdd3fabc2e2a141fab2fe87302a4a58a95a4105f079086247ecba5695e52f5
Opcode Fuzzy Hash: 9bfeeed7051acf716762969c1cd946338a52268239c2850942876407cd859a26
Instruction Fuzzy Hash: 0101C46191EB9C5FD35AA734082A6AA3EE1EF9625074504EED18FC72E3DD1869048711

Function 00007FFE60505B9B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.101587586032.00007FFE60500000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE60500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe60500000_itLDZwgFNE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc740bdb4c4b345b4cbdac63c906fd6bf4e994b7f391ba818020dbdf54a55a5
Instruction ID: 6e83740749cb0ef7c0dc8d3d1c085d9739fcaf8b197fab63e63af32c158cd6a8
Opcode Fuzzy Hash: edc740bdb4c4b345b4cbdac63c906fd6bf4e994b7f391ba818020dbdf54a55a5
Instruction Fuzzy Hash: A6F08250B29E5D9FEB98E76C44956BD77D2EF98210B80047DE10FC73E3DD1968458740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report itLDZwgFNE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\tmp2CFD.tmp.dat

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
itLDZwgFNE.exe